last executing test programs: 21.533221207s ago: executing program 1 (id=5086): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c0100001000130780fffffffcdbdf252001000000000000000000000000000020010000000000000000000000000001000000004e210002000000006c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000000fe32000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000090000000000000001000000ffffffff"], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, r2, 0x1, 0x70bd2b, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RATE_SAMPLE_INTERVAL={0x8, 0x17, 0x4}]}, 0x34}}, 0x240008c0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r3) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r3) sendmsg$NL802154_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010000000000000000000f"], 0x1c}, 0x1, 0x0, 0x0, 0x4004040}, 0x10) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r7) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r9, &(0x7f00000007c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x2c, 0xd, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_TABLE={0x0, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x402c880}, 0x80) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000026c0)=@newtfilter={0x70, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x10}, {0xe40ca4f7c51e5624}, {0xfff1, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_skbmod={0x30, 0x16, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0x2}}]}, 0x70}, 0x1, 0x0, 0x0, 0x4810}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) 21.284462139s ago: executing program 1 (id=5091): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000001340)=ANY=[@ANYBLOB="18000000000000000000000000000000611234000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) (async) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000071100600000000009500000000000000e20c0d130193348c02824f4952e8fe8991866f9db437d47d58088f2cb318b9fc6bb2d7ccea68a0a1ad2336abf97540331cd0c377b6a2135ea8e182b8ac3254466eba5f550f89d85967e2393b59"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) (async) setsockopt$sock_int(r2, 0x1, 0x2d, 0x0, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window={0x3, 0x6, 0x3ff}, @sack_perm, @mss, @timestamp, @mss={0x2, 0xffff}, @timestamp], 0x7) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x0, 0x5e}, {0x0, 0x800, 0x0, 0x7, 0x0, 0x0, 0x3, 0x7}, {0x0, 0x0, 0x3}}, [@tmpl={0x184, 0x5, [{{@in=@remote, 0x0, 0x6c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x8}, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x1}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in6=@remote, 0x3502}, {{@in6=@loopback, 0x0, 0x3c}, 0x2, @in=@remote, 0x0, 0x1, 0x3}, {{@in6=@mcast2, 0x4d3, 0x3c}, 0x2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in=@empty, 0x0, 0x32}, 0x2, @in=@dev, 0xffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x2b}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x4}]}]}, 0x23c}}, 0x0) (async) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000140)) 21.199287399s ago: executing program 1 (id=5095): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x18, 0x1a, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000500000000000000aa8c000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000040000000001801000020756c3d00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="00000000000000008500000075000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r2}, 0x10) socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB='b 75:*\trmr'], 0xa) 21.018370989s ago: executing program 1 (id=5099): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) connect$rose(r0, &(0x7f0000000200)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x5, [@bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x40) socket(0x2, 0xa, 0x300) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000001840), 0x3b, 0x0) 20.887385335s ago: executing program 1 (id=5104): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000380)='rxrpc_call\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='rxrpc_call\x00', r1}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETTXFILTER(r2, 0x400454d1, 0x0) r3 = socket$kcm(0x21, 0x2, 0xa) r4 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x800) sendto$packet(r4, &(0x7f0000000140)="ee6589634e688c8f656946ff0bbf324c1c835ba273fef6a945cd84aed37b22a45e9c5ae05d425e895d7b2bebc9b9d327e5864c7a7fdb8afec316b583", 0x3c, 0x4000, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0xfffc, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0xfc00) 20.60313689s ago: executing program 1 (id=5109): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x801, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$nci(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="61a88f4e67c8eb920d0220162d0b22d2cfe847daf629bd4a35c4e092e9bd863ac6770841e591674dba7e9af6c913e93cddfa68d60f859f62aab9fffcb0fa3a69ae2447fb7d1600c798a1a49e1fe044dff958e06629fec708e2dc8bb44dc2624fd1d8cdaefa81e8a64d4bb248abf90efdf2fe6378cfebd0c0170ecc1ceeb26cf94a347d51101f9126e8aaaa6d899af03f00bcb34a1595a6049063"], 0x3) r2 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_KEY(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x48, r5, 0x801, 0x400, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac02}]}]}, 0x48}}, 0x0) sendmsg$NL80211_CMD_DEL_TX_TS(r4, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001280)={0x50, r5, 0x20, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xd}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x1}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xb}]}, 0x50}}, 0x8000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(r7, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000016c0)={0x10, 0x26, 0x1}, 0x10}], 0x1}, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r8, 0x11c, 0x2, &(0x7f0000000240)=""/4096, &(0x7f0000000140)=0x1000) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) socketpair(0x2b, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TLS_RX(r9, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x304}, "64fdc95ef2524596", "c6b7b01b8428b5bf00", "01adaefe", "33b75f3f68d48ed0"}, 0x38) 18.926905137s ago: executing program 4 (id=5137): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x4c, &(0x7f0000000000), 0x4) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2000) ioctl$TUNSETNOCSUM(r1, 0xff03, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000004e40)=0xffffffffffffffff, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004e80)=ANY=[], 0x50) sendmsg$NFC_CMD_GET_SE(0xffffffffffffffff, &(0x7f0000004a80)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000004a40)={&(0x7f0000004a00)={0x14, 0x0, 0x100, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x80000c0}, 0x8000) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4a0, 0x0, 0x5802, 0x294, 0x0, 0x294, 0x3d0, 0x325, 0x378, 0x3d0, 0x378, 0x3, 0x0, {[{{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, [0x0, 0xff000000, 0x0, 0xffffff00], [0x0, 0xffffffff, 0xff, 0xff], 'macsec0\x00', 'veth1_virt_wifi\x00', {0xff}, {}, 0x8e, 0x0, 0x7, 0x7}, 0x0, 0x220, 0x288, 0x52020000, {}, [@common=@inet=@hashlimit2={{0x150}, {'netpci0\x00', {0xfffffffffffffffd, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x40, 0x78}}}, @common=@ipv6header={{0x28}, {0x88, 0xa}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x8, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@dst={{0x48}, {0x1, 0x0, 0x0, [0x8, 0x7, 0x8, 0x6, 0x101, 0x800, 0x8, 0x8000, 0x4a, 0x9, 0xff, 0x1000, 0x1, 0x8, 0x4c8, 0xa68], 0xa}}, @common=@frag={{0x30}, {[0x3]}}]}, @common=@unspec=@NFQUEUE0={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x500) r5 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000017c0)={'wg0\x00', 0x0}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000004dc0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004000000000000f661a3b4bc2c8fab15340a62f0a0fff484c176fa5e95965057d292d82b95904cc494382f7eb52a55fc93dc5d74d03d"], 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r8, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r9, 0x4) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000004bc0)={0xffffffffffffffff, 0x211e, 0x18}, 0xc) r11 = socket$inet_sctp(0x2, 0x5, 0x84) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x24048895) sendmsg$NFT_BATCH(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a0b040000000000000000020000002c0004802800018007000100637400001c0002800800014000000002080002400000001705000300030000000900010073797a30000000000900020073797a32"], 0x84}}, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r11, 0x0, 0x484, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000004cc0)={0x5, 0x5, &(0x7f0000004f00)=ANY=[@ANYBLOB="bc11d2fbd5eb7dacebf639eb82e6f25eedac98c240a2e739b44df970246b5e932755be0ca04be05d119910a400760439cdbeb1b08d5e031a6a9927ceeb5f4e2e8b5086da97963ae2cfa657b9959611766605d37c6779d39fb63abe8c387a0f0884c12e2c5d59fa31e97cdea23d1b9644e75ed7e5f7f4464535d4ccab0fa98009dba08304db411432f11f5cb84abfa72a55e915ba3400afe0125c74a1ef55bcb90fbc99200a7932eea97544c7a8c02671ee9aadf53934623f50145568f08fce532283fb8800fd8027c45cff74e71f15dafca2c06eccf980ab14de", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000"], &(0x7f0000001780)='syzkaller\x00', 0x3a5, 0x0, 0x0, 0x41000, 0x16, '\x00', r6, @fallback=0xe, r7, 0x8, &(0x7f0000004b80)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, r9, 0xffffffffffffffff, 0x7, &(0x7f0000004c00)=[r2, r2, r10, r2], &(0x7f0000004c40)=[{0x4, 0x3, 0x0, 0xc}, {0x5, 0x1, 0x6, 0x2}, {0x3, 0x4, 0x6, 0xa}, {0x3, 0x2, 0x6, 0xa}, {0x4, 0x1, 0x9}, {0x3, 0x3, 0xc, 0xc}, {0x2, 0x2, 0x3, 0x4}], 0x10, 0x1}, 0x94) socket$kcm(0x2, 0x1000000000000002, 0x0) r13 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r13, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) ioctl$sock_inet_SIOCSIFADDR(r13, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0xfffe, @empty}}) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000040)="2f30c8307b0a", 0x6}], 0x1) recvmmsg(r12, &(0x7f0000004140)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000580)=""/255, 0xff}, {&(0x7f00000006c0)=""/236, 0xec}, {&(0x7f00000007c0)=""/217, 0xd9}], 0x3, &(0x7f00000008c0)=""/17, 0x11}, 0x3}, {{&(0x7f0000000900)=@pppol2tp, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000980)=""/47, 0x2f}, {&(0x7f00000009c0)=""/228, 0xe4}, {&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000000ac0)=""/8, 0x8}, {&(0x7f0000000b00)=""/215, 0xd7}, {&(0x7f0000000c00)=""/142, 0x8e}, {&(0x7f0000000cc0)=""/39, 0x27}], 0x7, &(0x7f0000003c40)=""/247, 0xf7}, 0x9}, {{&(0x7f0000000e80)=@x25, 0x80, &(0x7f0000001100)=[{&(0x7f0000000f00)=""/69, 0x45}, {&(0x7f0000000f80)=""/18, 0x12}, {&(0x7f0000000fc0)=""/36, 0x24}, {&(0x7f0000002800)=""/4096, 0x1000}, {&(0x7f0000001000)=""/123, 0x7b}, {&(0x7f0000001080)=""/107, 0x6b}], 0x6}, 0x1}, {{&(0x7f0000001180)=@alg, 0x80, &(0x7f00000014c0)=[{&(0x7f0000001200)=""/105, 0x69}, {&(0x7f0000001280)=""/73, 0x49}, {&(0x7f0000001300)=""/102, 0x66}, {&(0x7f0000001380)=""/90, 0x5a}, {&(0x7f0000001400)=""/100, 0x64}, {&(0x7f0000001480)=""/61, 0x3d}], 0x6, &(0x7f0000001540)}, 0x4}, {{&(0x7f0000001580)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f0000003800)=[{&(0x7f0000001600)=""/65, 0x41}, {&(0x7f0000001680)=""/245, 0xf5}, {&(0x7f0000005000)=""/4081, 0xff1}], 0x3, &(0x7f0000003840)=""/244, 0xf4}, 0x8001}, {{&(0x7f0000003940)=@pppol2tpv3, 0x80, &(0x7f0000003b00)=[{&(0x7f00000039c0)=""/172, 0xac}, {&(0x7f0000003a80)=""/112, 0x70}], 0x2, &(0x7f0000003b40)=""/89, 0x59}, 0x606}, {{&(0x7f0000000d80)=@sco, 0x80, &(0x7f0000004040), 0x0, &(0x7f00000040c0)=""/123, 0x7b}, 0x1}], 0x7, 0x10022, &(0x7f00000049c0)={0x0, 0x989680}) 18.023459072s ago: executing program 4 (id=5154): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711007000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newqdisc={0x168, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x138, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}, [@TCA_NETEM_CORR={0x10, 0x1, {0x2, 0x8, 0x6}}, @TCA_NETEM_DELAY_DIST={0x4b, 0x2, "ff5a0d3d93fdcb87637f3de1eac6ec09339ffece563052c19f03fb3deb0946fc339b360075eaeb3cb1602ac1b68a9124bb5355caf0f7bcf8f3057fb4d59886bd953269d79824c4"}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0xffffffff}, @TCA_NETEM_SLOT={0x2c, 0xc, {0xffff, 0x6, 0x400, 0xdc0, 0x0, 0x2827}}, @TCA_NETEM_REORDER={0xc, 0x3, {0xc0, 0x4f9}}, @TCA_NETEM_REORDER={0xc, 0x3, {0x6, 0x4}}, @TCA_NETEM_DELAY_DIST={0x3b, 0x2, "97027ccb54b5bd1901d5bab0e26bfcd16b0e6308855732a41bf6f82ee57f01f23f3615fa75bd372feb1059b461cc2fe3d4b1857e5b4135"}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x1, 0x3, 0xeaa, 0x4, 0x0, 0xd1c}}, @TCA_NETEM_ECN={0x8}]}}}]}, 0x168}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000008c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xb, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xfffffff9, 0x1, 0x7ff, 0x0, 0x0, 0xbd2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2001c061}, 0x4008000) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="788c0a8d1dcc000000", @ANYRES16=0x0, @ANYBLOB="04002cbd7000fcdbdf250100000064000880040000800400008058000080240002009b437d69259d2da9df4bc34ca963d8e4eb758dcb919c61000b8614b12e598bc124000200ad61d292b14f7ebb6b605b4fcc3583e5bfb2dbba080a31559e87c358a8c480e4080003000400000004000980"], 0x78}, 0x1, 0x0, 0x0, 0x448d1}, 0x24000000) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4000, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 17.719397297s ago: executing program 2 (id=5157): r0 = socket(0x10, 0x80002, 0x0) (async) r1 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_buf(r1, 0x107, 0xd, 0x0, &(0x7f00000002c0)) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001500192340834b80040d8c560a067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xc4, 0x19, 0xfd3649826d894c67, 0x70bd2c, 0x0, {{@in=@empty, @in=@initdev={0xac, 0x1e, 0xff, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {0x0, 0xacb0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x2}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x4c050) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@private=0xa010100, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x3, 0x3}]}]}, 0xfc}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x0) recvmmsg$unix(r6, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (async) r7 = socket$kcm(0x2, 0xa, 0x2) r8 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x4c, 0x0, &(0x7f0000001000)) (async) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000003c0)={'syztnl2\x00', 0x0, 0x29, 0x0, 0x84, 0xc, 0x4, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x700, 0x80, 0x800, 0x90}}) sendto$packet(r0, &(0x7f0000000340)="94ca62bab16531f478d49cf35b3c125e7ce339c3d81883638cce7f919511e1f306f9d1fee590c266a9f92d09aa587b9d7ff3f871e9db4ff550e04747687c6a7f75573d04c24b8c4edc550e", 0x4b, 0x8000, &(0x7f0000000440)={0x11, 0x3, r9, 0x1, 0xb7, 0x6, @remote}, 0x14) write$tun(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) r10 = socket$nl_rdma(0x10, 0x3, 0x14) (async) r11 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r11, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) (async) sendmsg$nl_generic(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000001514010100100000000000000800030005000000080001"], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001000080025bd7000fcdbff2500000000", @ANYRES32=0x0, @ANYBLOB="1000000082040400240012800b0001006272696467650000140002800800020001000000080003001d0020"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 17.31978302s ago: executing program 2 (id=5159): bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000700)={{0xffffffffffffffff, 0xffffffffffffffff}, 0x0, 0x0}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x9, 0x24, &(0x7f0000000740)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}, {}, {}, [@exit, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @map_idx={0x18, 0x978331abd2ea3274, 0x5, 0x0, 0xd}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x6, 0x0, &(0x7f0000000300), 0x41100, 0x74, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x1, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000400)=[r0, r0, r0, r0, r0, r0], &(0x7f0000000480)=[{0x1, 0x1, 0x9, 0xa}], 0x10, 0x1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={r1, 0xe0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000300)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x86, &(0x7f0000000640)=[{}, {}], 0x10, 0x10, &(0x7f0000000680), &(0x7f00000008c0), 0x8, 0x99, 0x8, 0x8, &(0x7f0000000900)}}, 0x10) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000a80)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="130000002c600000", @ANYRES32=r1, @ANYBLOB="ac4f5512b7bddeb4b569dc0da9abc13c6391c20000000000003df2865527549a7fa488620efb197df4bc0d11e3836a570c8a9bd31f5f44dd040002e682df53d1d6da085c6446f719bab98d7d409f758d7e12cfc6c0c54097e7d44f69d8230257499792dbd2ad2416a439ea6eafda7332bc888f4b9355850bdf6fce5753e3b662b19de6f2fa8febaf68895e54df13cf0c045c2aa4fa8b157791e990ab24110fea0b90f8", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r2, 0x0, 0x1, &(0x7f0000000280)=0x1, 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r4) getsockopt$WPAN_SECURITY(r4, 0x0, 0x1, &(0x7f00000006c0), &(0x7f0000000b80)=0x4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newlink={0x68, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x50483}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x38, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast1}, @IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e23}, @IFLA_IPTUN_FLAGS={0x8, 0x8, 0x17}, @IFLA_IPTUN_PROTO={0x5, 0x9, 0x4}, @IFLA_IPTUN_ENCAP_LIMIT={0x5, 0x6, 0x7}]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x9005}, 0x0) sendmmsg$inet(r3, &(0x7f0000000880)=[{{&(0x7f0000000580)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r4}, 0x8) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0xc, 0x8, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffe}, 0x50) r7 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r6, &(0x7f0000000200), &(0x7f00000002c0)=@udp6=r7}, 0x20) recvmmsg(r7, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12123, 0x0) sendmsg$802154_dgram(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x24, @none={0x0, 0x3}}, 0x14, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x20040001}, 0x20004080) 17.079625466s ago: executing program 2 (id=5160): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001280)=@mangle={'mangle\x00', 0x2, 0x6, 0x5b8, 0x1a0, 0xd0, 0x360, 0x360, 0x360, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x6, 0x0, {[{{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @private1, [0x0, 0x0, 0xff000000], [], 'pimreg0\x00', 'rose0\x00', {}, {}, 0x21}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000010000000}}, @HL={0x28}}, {{@ipv6={@mcast2, @dev, [], [], 'bridge0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [0x0, 0x0, 0xff], 'bridge0\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @HL={0x28, 'HL\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@private0={0xfc, 0x0, '\x00', 0x4}, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0x160, 0x188, 0x0, {}, [@common=@srh1={{0x90}, {0x2a, 0x9, 0x6, 0xb9, 0xed4, @mcast2, @remote, @loopback, [0xff, 0xff000000, 0xff000000, 0xff], [0xffffff00, 0xffffffff, 0xff000000, 0xff000000], [0x0, 0xffffffff, 0xffffff00, 0xff0000ff], 0x2000, 0x301}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x618) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x2f}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newtaction={0x60, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x4c, 0x1, [@m_sample={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x4}, @TCA_SAMPLE_RATE, @TCA_SAMPLE_PSAMPLE_GROUP={0x8}]}, {0x4}, {0xc}, {0x6, 0x4}}}]}]}, 0x60}}, 0x0) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40008008}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r1, 0x8, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x9, 0x3f}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x7d}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x68}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x46}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x79}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x2e}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x42}]}, 0x70}, 0x1, 0x0, 0x0, 0x4041}, 0x8010) 16.921871042s ago: executing program 2 (id=5163): r0 = socket(0x15, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict]}}, 0x0, 0x26}, 0x20) (async) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict]}}, 0x0, 0x26}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r1, 0x100000, 0x0}, 0x10) getsockopt(r0, 0x200000000114, 0x271b, 0x0, &(0x7f0000000000)) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) socket$inet6(0xa, 0x3, 0x87) (async) r4 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000280)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x4e21, 0x0, 0xa}, {0x0, 0x4, 0x0, 0x80000000, 0x6, 0x9, 0x0, 0x40000000000000}, {0x8000000000000000, 0x100009, 0x53e5, 0x21}, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1}, {{@in=@multicast1, 0xfffffffd, 0x32}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1502, 0x4, 0x0, 0x0, 0x4, 0xfffffffd, 0x1}}, 0xe8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f0000000140)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010700", 0x9c, 0x11, 0x0, @remote, @mcast2, {[], {0x0, 0xe22, 0x4d, 0x0, @wg=@initiation={0x1, 0x1, "8742fe4687d86e5da82e41ef2302058dc3b5674f7389ec494011ccec4f7d012c", "f2760709a418c2d54dfc3bcd6b0dc0f026e4dbbd0fc37c4cf9e05eebedd14ed77e5af90f021be4d1922cd5279600538f", "9cd204eeecae9a729ee1662af2f006faf435c215365df6e6c5db8235", {"aeb6eb691496126a2d28d73f1a738b14", "fc81aa717bf9ce692ed96249827491df"}}}}}}}}, 0x0) (async) syz_emit_ethernet(0xd2, &(0x7f0000000140)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010700", 0x9c, 0x11, 0x0, @remote, @mcast2, {[], {0x0, 0xe22, 0x4d, 0x0, @wg=@initiation={0x1, 0x1, "8742fe4687d86e5da82e41ef2302058dc3b5674f7389ec494011ccec4f7d012c", "f2760709a418c2d54dfc3bcd6b0dc0f026e4dbbd0fc37c4cf9e05eebedd14ed77e5af90f021be4d1922cd5279600538f", "9cd204eeecae9a729ee1662af2f006faf435c215365df6e6c5db8235", {"aeb6eb691496126a2d28d73f1a738b14", "fc81aa717bf9ce692ed96249827491df"}}}}}}}}, 0x0) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x118, 0x2e, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x105, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0xa, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @loopback}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd", @typed={0x4, 0xe9}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x400c445}, 0x0) (async) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x118, 0x2e, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x105, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0xa, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @loopback}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd", @typed={0x4, 0xe9}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x400c445}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}}, 0x24}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_route(0x10, 0x3, 0x0) 16.783895781s ago: executing program 2 (id=5164): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000240)=@assoc_value, &(0x7f0000000280)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000180)={0x0, 0x7d9}, 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x20000800) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x7c, r2, 0x5, 0x8, 0x25dfdbfe, {{}, {@void, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x44, 0xe, {{{}, {}, @device_a, @broadcast, @from_mac}, 0x0, @random=0x4, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @void, @void, @void, @void, @val={0x25, 0x3, {0x1, 0x3, 0x8}}, @void, @val={0x3c, 0x4, {0x1, 0x7, 0x3c, 0x2}}, @void, @void, @val={0x71, 0x7, {0x1, 0x1, 0x0, 0x1, 0x1, 0xf0, 0x8}}, @void}}, @NL80211_ATTR_FTM_RESPONDER={0x10, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_LCI={0x6, 0x2, "4694"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x7c}}, 0x0) 16.749653966s ago: executing program 2 (id=5166): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd29, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2, 0xfffffff9}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80d1}, 0x14000c08) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000580)={'syztnl2\x00', &(0x7f0000000500)={'gretap0\x00', r3, 0x7, 0x8000, 0xfe6, 0x6, {{0x14, 0x4, 0x3, 0x7, 0x50, 0x67, 0x0, 0x2, 0x4, 0x0, @private=0xa010100, @remote, {[@rr={0x7, 0x2b, 0x91, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @rand_addr=0x64010101, @multicast1, @loopback, @multicast2, @empty, @multicast2, @dev={0xac, 0x14, 0x14, 0xd}, @remote]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x4, 0xdb, 0x1, 0x8}, @generic={0x83, 0x7, "b40f0b3e7f"}]}}}}}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@void, @void}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x4}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}]]}, 0x24}}, 0x20040000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x2c, 0x140f, 0x60ceaae1ef55e4c3, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'issm\x00'}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r8, @ANYBLOB="0c00990eff070000700000001400040073797a6b616c6c657230000000001c000800050004"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000002c0)={0x0, @empty}, &(0x7f0000000340)=0xc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'erspan0\x00', &(0x7f0000000440)={'sit0\x00', r10, 0x80, 0x7800, 0xffffff01, 0x6, {{0x1b, 0x4, 0x0, 0x4, 0x6c, 0x64, 0x0, 0x9, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @multicast2, {[@rr={0x7, 0x2b, 0x34, [@multicast1, @rand_addr=0x64010101, @rand_addr=0x64010101, @remote, @private=0xa010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @multicast1, @multicast2, @rand_addr=0x64010102]}, @cipso={0x86, 0x12, 0x1, [{0x2, 0xc, "004a3c6a511dff7ae0d8"}]}, @end, @cipso={0x86, 0xb, 0x0, [{0x2, 0x5, "d35476"}]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0xb, 0x7d, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}]}}}}}) close(r9) socket$netlink(0x10, 0x3, 0x14) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r11 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r11, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='\t\x00', @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x24004000}, 0x20048040) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r13, 0x800452d2, &(0x7f0000000100)) ioctl$PPPIOCGUNIT(r12, 0x80047456, &(0x7f0000000200)) 16.651483767s ago: executing program 3 (id=5167): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000007140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000007280)={0x0, 0x0, &(0x7f0000007240)={&(0x7f00000071c0)={0x1c, r1, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="00000200", @ANYRES16=0x0, @ANYBLOB="000326bd7000fedbdf25010000002c010c800c000b8008000900a2a3c21724000b8008000a001cce000008000a00537a000008000a0015c300000800090075c9b7440c000b8008000a00d06e00004c000b8008000a00d04a000008000a0052ed0000080009000003027408000900ac0ad76808000a00b166000008000900da3b396808000900e49f336108000a00896c000008000900ad903e563c000b8008000900789d527a08000a00c4e8000008000900c75884340800090032870151080009000ee63169080009001d47906908000a00384f00001c000b8008000a00f37e000008000900540e923408000a0071ec000014000b8008000a007fe6000008000a00ea34000034000b8008000900ccb1ae2d080009000216b62f08000a00d296000008000a0067f0000008000a002452000008000a00a26e0000"], 0x140}, 0x1, 0x0, 0x0, 0x4004041}, 0x4004881) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x4c, r3, 0x1, 0x0, 0x0, {0x3d}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd, 0x82}, {0x5, 0x87}}]}, 0x4c}}, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)}, 0x40002000) 16.188705368s ago: executing program 3 (id=5170): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x70, 0x2, 0x6, 0x1, 0x6000006, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xa00}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x70}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000540)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0xfffffffe, 0x10000, 0x670e, 0x0, 0xffffffff}, 0x0, 0x200000, 0x7, 0x8, 0x0, 0x14, 0x0, 0x1b, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, 0x2, 0x0, 0x1000000}}}}]}, 0x78}}, 0xc090) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000037973625c88cfd3b177c00"/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x8, &(0x7f0000000100)=ANY=[@ANYBLOB="189b6674576ef839c10000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b50a000000000000850000000c000000b7000000000000009500000000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x90) 16.079438466s ago: executing program 3 (id=5171): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={0xffffffffffffffff, 0x2, 0x1, 0x50b8}) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000000c0)={'macvlan0\x00', @local}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000f10000000000000020000018010000202070250000000000202020db09f8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000ca00000095"], &(0x7f0000000400)='GPL\x00', 0x1}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) write$cgroup_devices(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xc2) r1 = socket$rds(0x15, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0xe, 0x4, 0x4, 0x1, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r2, &(0x7f00000007c0)="0ff764", &(0x7f00000002c0)=@tcp6, 0x1}, 0x20) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=@setneightbl={0x14, 0x43, 0x1}, 0x14}}, 0x0) r4 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r6, &(0x7f0000000280)="ca", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r6, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r6, &(0x7f0000000600), &(0x7f0000000700)=""/127}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x22, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_fd={0x18, 0x2}, @generic={0xcc, 0x8, 0x9, 0x1, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x3}}, @map_val={0x18, 0x2, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x90}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @generic={0x3, 0x9, 0xe, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x5}, 0x10}, 0x94) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b409000000006930ae0000000000c40900000000000095007400000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000001c0)={0x0, 0x5}, 0x10}, 0x94) socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r7 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x61d0, 0x0) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f0000000000), 0x4) 15.705698141s ago: executing program 3 (id=5172): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000f0200006706000020000000620a00ff0ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2736f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfdb247bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded5275c00"/420], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x8000000}, 0x48) 15.648339039s ago: executing program 3 (id=5173): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) (async) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), r0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x24, r2, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x3}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) (async) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000640)={0x0, 0x401, 0x1, [0x100]}, &(0x7f0000000680)=0xa) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000080)={r6, 0x808000}, 0x8) (async) sendmmsg$inet_sctp(r0, &(0x7f00000009c0)=[{&(0x7f0000000080)=@in={0x2, 0x4e24, @loopback}, 0x10, &(0x7f00000005c0)=[{&(0x7f00000000c0)="0a792e4e803539a971f6b3d5ecfd82219b4b041d02f16ab36722752df07016b50fd0513bf7863f497316daf34d038027736f7630", 0x34}, {&(0x7f00000002c0)="8a67e48858f03900c5c10f102eda6a4af07824c5cf751f5fc6f2ca71e2b558c55c7882daae4495c1d2e9fd0779cd", 0x2e}, {&(0x7f0000000300)="720993a693b231cb0be30b5d32e66b762ed569d28e31a26178bd72141a5445f4c58f3e973538008f9763403fbbe5d7582c8864", 0x33}, {&(0x7f0000000380)="392a40e05cd7b8edf3d9d1f0312c11fc0f6d90459a48669d152309e2810a71c72310acef5a92c9b1b7486548404ed25aa2a789149b371fdcdc9bd57266e32c0b79919a13ee82ebd0501bb6e2188f35c9943678836c7de5cfb6b5a2eccd53cc8aadda78fa3a672a6973e97dd4031b1649e749b6062d4bf478cf248bbee9ce7c7a5bac86c96bffa405cfb9e62add5e77261ebd5ca78db518f2bc400984570931b50677e71570c741346339db49c31bf37666953e2982212d", 0xb7}, {&(0x7f0000000440)="f1fc1d65", 0x4}, {&(0x7f0000000480)="da2c2d594ecba51a29c9a567449132f40e5f1de4bdd64eb06c813f18fc1a3b3b22c23380f4302d1881c6dfc142e27bcf5a3fad6e5ba8e4841453abfc68348dba3d266da1451784660d47c5c9f60c8c81806d4ce779", 0x55}, {&(0x7f0000000540)="2978d46a412bcdc55d76c1f744b46e85ef655fd1098460ddce004562ce5963de9a7ff5aba7dcc77261757d47b59012d0d9c0f98745b184ec943771241bff26b31cbe4b90c5e3fc144864618e12f82e381c6ee251fcb1b8d0616d5dc273a261825df25fff042ba53febe992495a273e2fa90e0d15", 0x74}], 0x7, &(0x7f00000006c0)=[@dstaddrv6={0x20, 0x84, 0x8, @remote}, @dstaddrv6={0x20, 0x84, 0x8, @mcast2}, @sndrcv={0x30, 0x84, 0x1, {0x1, 0x3, 0x4, 0x2b, 0x7, 0x9, 0x3, 0xf28b, r3}}, @dstaddrv4={0x18, 0x84, 0x7, @dev={0xac, 0x14, 0x14, 0x43}}, @init={0x18, 0x84, 0x0, {0xe388, 0x1, 0x0, 0xa}}, @init={0x18, 0x84, 0x0, {0x8, 0x3, 0x6, 0xc8db}}, @sndinfo={0x20, 0x84, 0x2, {0x0, 0x0, 0x7f, 0x802, r6}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, '\x00', 0x3d}}, @prinfo={0x18, 0x84, 0x5, {0x10, 0xd}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x4}}], 0x128, 0x91}, {&(0x7f0000000800)=@in6={0xa, 0x4e24, 0x401, @mcast1, 0x1}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000840)="9cb5d42e1076deede6c747d8a39af1bb92cccd68e38453fa678ec2c8361a24b46049c3d23acb81e20b013e2d7f6d26a7fcd61a1588fb0e8b6c3f7056ff9b7709f552b940a1e5c07c5444547b0f165b89fca45b2ec313f260103c1b89f285313c78ae99a63eb0c717bbc9feb25bf47cfc0ce030e67831ae7c12e75c385f299063a0bba8e9b7a53a3071add157df52e2bc021b95f1d42ce8c15b1a", 0x9a}], 0x1, &(0x7f0000000940)=[@init={0x18, 0x84, 0x0, {0x6, 0x2, 0x4}}, @init={0x18, 0x84, 0x0, {0x0, 0x3, 0x4, 0x2}}, @init={0x18, 0x84, 0x0, {0x3, 0x5, 0x4, 0x2}}, @authinfo={0x18}], 0x60, 0x20000800}], 0x2, 0x1) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0xf, 0x4, 0x8, 0xb}, 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r7, r8, 0x7, 0x0, @val=@tcx={@void, @value=r7}}, 0x1c) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd27, 0xffffffff, 0x25dfd9ff, {0x0, 0x0, 0x0, r1, {0x1b, 0xa}, {}, {0x1c, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8847}, @TCA_FLOWER_KEY_MPLS_OPTS={0x8, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x4}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20004081}, 0x24000085) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000050000ad49240800b64f7110b3000000f9e12a0e0f8ff604a0db000095", @ANYRES64=r0, @ANYBLOB="a6d7102d7d3be3cca294adac54c74ab32de80aa57a486965b93f", @ANYRES64, @ANYRES32=r0], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 15.58815738s ago: executing program 4 (id=5174): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10}, [@ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x8000, 0x50}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x6}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@getnexthop={0x20, 0x76, 0xb0d, 0x0, 0x25dfdbfd, {0x3, 0x2}, [@NHA_ID={0x8}]}, 0x20}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a40)=@allocspi={0x100, 0x16, 0x1, 0x0, 0x0, {{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0xc, 0x0, 0xffffffffffffffff}, {@in6=@local, 0x20000, 0x32}, @in=@broadcast, {0x800, 0x0, 0x800000000, 0x0, 0x8, 0x0, 0x0, 0xf}, {0xffffffffffffffff, 0x3, 0xa, 0xffffffffffffffff}, {0x0, 0x21}, 0x70bd28, 0x0, 0xa}, 0x0, 0xfffffffe}, [@tfcpad={0x8, 0x24, 0x7fff}]}, 0x100}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newlink={0x40, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r1) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x104, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0xa, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x400c445}, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000021bf0000000000000500000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000db090000a1000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x6}, 0x94) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002abd7000000000003900000008000300", @ANYRES32=r3, @ANYBLOB="14005a8010000180040001000500020008000200addf560517f042d9859a168e097a8253793cbdf2455a03b8cf271ba47b5e1ff9da715998b9d1eafe7de4679e83f9ac14f000102ce2d17befe792f3f50d3079f92dd545b762f8ca8a3760822fd8923f395965714b4895da9882a6b5549767c14717fe06618627f783adf5fe76608db96c2082226ed0e99e6506265086c398db12851209b8e97d5c6bb491a7405b41c3056223c30f6393ae2d0b36654784f9ce5cd01461ddb2760341ff820c2e688d6520748f6508afb01112e437b6959e6d5d27d868ec6f8470eabcd87345bfcb91a7a347032e36586cfcd203c475d3b08c95802a36ed1787ce25807d9e4dc8d2f688"], 0x30}, 0x1, 0x0, 0x0, 0x400c040}, 0x0) 15.578822737s ago: executing program 3 (id=5175): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair(0x1a, 0x804, 0x3f, &(0x7f0000000240)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000041c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000800)={0x28, r3, 0x1, 0x70bd28, 0x1, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x24000880) (async) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000800)={0x28, r3, 0x1, 0x70bd28, 0x1, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x24000880) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000280), &(0x7f00000002c0)=0x8) (async) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000280), &(0x7f00000002c0)=0x8) r4 = socket(0x1c, 0x6, 0x9) syz_genetlink_get_family_id$nfc(&(0x7f0000000300), 0xffffffffffffffff) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x8202, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x8202, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000140), 0x3) (async) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000140), 0x3) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f0000000040)={'ip6gre0\x00', 0x400}) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f0000000100)={'wlan0\x00', 0x400}) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(r7) (async) close(r7) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x7c}, [@ldst={0x6}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x3c) getpeername$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000500000000000000b64f7110b5000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newqdisc={0x148, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x73c7d38a1b8432c4, 0x2, [@TCA_RED_STAB={0x104, 0x2, "55f4b32d215d09ad34a54ecd392b645312028acf803a4be046ac0250a6ab00acdbbcc0a681ef62574eb95c3668168a2237f2cc488cf760d067868e8021f61308c6db4e4ac2ec40342736d4b782ed114b6e548109d0d25d975663c05ceaa64032471a805702a7a92bca01e7f16cfd7858b64cf7168d9220b64044c8dab5221c7a97fe9b875c33dfe30b850d7b07be151a84a139feeb514347d3e58683a3a7a624b0c79700622bbb5c8f573b27d294ff211faa3ef5d05472c85cd1ed4d7bdfbbe8aea77753e983bf2350c11b80e2e0c058bc01ebfe9e4faec45b78bb3d2551f3fec86fca5bea0668c9c98e75db02191cc525ec2d3f9a4db0895a3ff2b1931fa0da"}, @TCA_RED_PARMS={0x14}]}}]}, 0x148}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000700000aa4000000060a0b0400000100000000000200000078000480740001800a0001006d617463680000006400028008000240000000000c00010072617465657374004c0003007e6b92c43235dc7e977221f83c3f179e65022fc067b787cd67b6d9983b1bddafbdf6a37da5ed332cd2ee94b31d2ec330ce34cc676c0783a4bcc1e966554b0470582e870b81e92a630900010073797a30000000000900020073797a3200000000140000001100200000000000000000000500000a4426c6ef1a28967af114d191a629c93e4dbbb12e1646aa7c1538b893a00eb75d5a4e4fc77c977912d32f0cc3e179966b82ba0013c74fb91f28749119c2521fb7de5de5690dc8d5b1dbd1cd91b6dacac9bc890d7a25228cf33cb8f309d10cff27ad207d116294c5effe4bf119b999928cd7c8cda79e30b47e95a1cc2385bbdcb7ff"], 0xcc}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) 15.484382493s ago: executing program 4 (id=5177): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x1, @empty, 'ip6tnl0\x00'}}, 0x1e) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x1, @empty, 'ip_vti0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r1, 0x4008b100, &(0x7f00000003c0)={0x18, 0x0, {0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, 'vlan0\x00'}}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)={0x14, 0x0, 0x990, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8090}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet(0xa, 0x5, 0x88) listen(r3, 0x8) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYBLOB="400d0000000000003000128008000100687372002400028008000200", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r5], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 15.46928116s ago: executing program 0 (id=5178): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c0001006272696467"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=@newqdisc={0x4c, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xfff3, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_FWMARK={0x8, 0x12, 0x80000000}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x842}]}}]}, 0x4c}}, 0x4000080) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 15.379950009s ago: executing program 4 (id=5179): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000000c0), r0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r1, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x8) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x2, &(0x7f0000000240)=ANY=[@ANYBLOB="a700000000000000950000000000000003bf2c93e1ad53b44cd118b252d0151971aeff8987a0c189633d4660065bddb0491f42de1bda2a6bbca64edb95356b6e50c25f02663e8ec25af53a2433eb9d4943b9bfcb77ab09547a94c7c1d40202a1373ad4c28a70063e76eeaca86f6a0658"], &(0x7f0000000000)='syzkaller\x00', 0x4}, 0x94) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x8, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x83b}, 0x1c) 15.311801766s ago: executing program 0 (id=5180): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x15, r0, 0x0) sendmsg$tipc(r0, &(0x7f0000001240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x1, {{0x41, 0x4}, 0x2}}, 0x10, &(0x7f0000001140)=[{&(0x7f0000000140)="7ef5e0a0e140de75a0096cf079f4e6f12f4ff0f0a4e91c774d3bd88c6eb49127e6196dfc67f6ab8666792ac47aa61621a708aeb2769c9415651f188c2dba54a26797cc08358206fceaddf19c01ba3c6bc9cf71a3ffd20233952089f38fd93f14e342b8e58b6cdcaf4b1b0ecc2f98fce4d1ca09e1f16a8685c458b1ba52be503b55af4a66efa6a0def2e325cc0e9bcb53dd2c1aa88c5686b876dcb99853f746cd3d28860bc53d085d4b9be6952a3cb936395e324d1764feac213116cb630b11f4097d63c9500efe0397adf47b84698100e9b2e0265bdd897037e7e3d1ce992c54e42cb018c30a2302e5aa3ce4dd1f0a271f4749b54d1667ae3c6ab36881d8198deb1d2deb5d22cfbb31a48b20cd842e356b60aff5ac2d3bacf1fabe90a9acc2b1b21c3c4d158b12b16e653958f018227d07cd12b5979de33582c6b8f8afd0094d614836e4c93c8fd2cc3dcd5f2f76a649f4ab95af2d42af67508844c7336949689315732027284c521750e46df63de7de03b644588d73a4199e93e5db35fc96df3397c4ef17d8fa5a55f88541f9704690289170b58481d116490a6b24aeb6ffc87272643094f3ad26b364bec9dcc582f44f646c761285872951bef9d4ec093bc60aa64675c80c9b121def192366dc3eeeb55862a0fba51d4f2d86f87f623d38b8f2b09594e254168557353b78ddcc69c28c17dfe86a6e31fde0b744b8fcab3aea86d8efc39e2c18c0ab757a2af6ca5f00ff07704c8195a10a11f0e3184031750f8ea488850ad0fb74a211c2e9c7ad1215cceb81ad1ed3e05e6927408d161146dacf32ca137795b5d441083389ff6faad33a66b853fb9936ebe9828b84523337243ed44c77f00cb85070bd79bebc195b78b78405170a44a0998df0dc52228765cef770b2ac4e38f90a92c8575f814b1d3de7e1493b8babee607a6d85b3fc4d12ae28f59aa6388b7ebcf43ba76ddfea22c897e3166302972642463c574ea31bd96637084af7e3ee35d3455f8a286ce9ee0d90148837df4e925f6bceaa6be2b618939effbe51469c8410325253061b2d9115e40c5921eb680c8d6211ce8f70239aa7ea1323a42673cc7d99c74d6ff4b5e17348b92606289cd93af2c141de3608be697e63d0c15a809839b8066b6882c1325ec16fcae3629441335b85e29082f301f6417c0345b842d5c608a60c1dac2039662219e7172adf44f23ef470b56119fc96f068511675cb54679075a259098168a284eecaf9a42bb9a94b2e4e226a7fcb0d95f4d11ba31cf50effc648cd6b45056c9c0a264949326e7cd14bc106308a997f861ec613771a7eba9e48cdb429a297075abda5c7e9e8f3cf453803dad62953b5dd0a043e8c4fe93e932baa4e8b8af9dc1c7c61d86b8707d3672a3ac02502c821a555039f10daa9e758f110a3dc294741250fb543d318b2ce1b9e7701bd1af60388493cee14998fbff120daaa54f318ea0c568a352aae9d1e3c929b3a79307cec1a8e2eee12c3aff6290be5a7ba74f674c1e003cc6778cfc6bfb086cea5ba79240f5703ad37781a986897fdbf5decb58e0d20656eb4ea3fb67d4d5f08c8e60abf3f11dd8543429fef67b91f667fc119fc9d61b4d3ab17d56657738ee28b7e90f6470c73d5caa09f5bba0d1815d07c9498f917a1f0ee847a5f363f545edfb11fd59e661d9ddeff06af8504d4c075da5ed4e63e71c2adad06683d2acc20e861c6d5dba63595d4a139638cbef7c0f432a20b3ae3220e822ce9762e707dcdd6f059f04dce28b01165929a9cbe8abb0b4340b003ef908f4bfe3b2455dda40cf1eed77037bfb5eece51d4a60ac20b57ecdfe38de79eac3f863bdbd6fc496f7ec52d5950f2574e6d235f82e27dc7bb0824673d0c00a2c60e3da4231bc4d477c85ed208947480314a68ec88011813b7a1fc36d05e306878ef1544057ca936266de3f893a0a131c58ce28168d97dcbbc53beaa5a5379651705221d7c91b1a897556e3e2a975f6d220f5344508d6cc3db11a4bddd526612f0d5690bd3fbe09d9e9a08d173d515fc5c5a32c44a8305435d007f181841ee867e477d23f145a4f5ba35d972714f3c3855e78d021596dedf83d6a150044bc4a69fdac18d4a8492dbe1613fc03f37000cfec52a783be83d773de812db5df5fa731872e27fe163e55dc5bb46a5c2c6cfc90208aacab9d96c2292ceaf88f5322ddc879ed7c12119df0d9de2804095c198ebdc398e6f796f01a797fa09bf0a76cd532fbaf52b33e90db887e00aed89e2610442d7e8e78c7b0cd47753f1a6142da32ac304621bbaa39f901574bcf23958a76d578c88a503f69d84e07b60fce39ff72b66ef3b7f9fa46c180636833a9674e2a75429c9d113a69d965052ca65b2eb7763398987220a103ef29280cc1ee1eca969bf284e84a33b93de5cfb86be6081f67b6b1144727ac8d0644b26e78ad85752cc0cc28a1c1258fec35c39f6f36e0eb0f10b00fe63686d0a6dc20e5432474b58377c6a7a61e80591aaf0b1ded458394ea2fced49a5d7722891d61c9a32b1fb5c1811f771e92f6668b91e3b96a479a905418bafb5b032f70339437a2f755ed1d863725b3f1025aed7d6ce9114224bcfa4bbfa5f6678e6a8df7e746eeb62b05744f603401f87c5d0a8987493244b9e8cd1f1938ed6240be159b1e16941c9164bec5918925637c1c566aae70153a08021f754adddc8647b00400c02a6a8ba4cd5f646988a4ebd621d6c27202a9ec1469717a9b591ceecedd87a145eae25d2fa276ca9ada27610242223f5948eb79c7d12552159d56c54004d71ba4b40f41a5e01b2bb074d92ac4cf7938db80ad041de51bc6ad12edf06aec3019619cb77208ace7cd3005f444ef1d431e57e67cc3285ad5d480de5754d5cc9a22f45f98252a96e35aafc2fb19428ddb586925535b2749f82db5f8e1a622ed45c22eff7ad07f3b5e15a2819b2cb4710d7870fe5ca33c12278783d33e88a94b789b8380e5254594bdca28024d7a261241f1d67874a4858abcb5c68e6c000ebaa2d6e53ba38e7116d56d4f93d588ffd7804eb8090f237fb442873f8ef547850a1d2038d6841e861190dd38d3c4d41d37ca7d7070c66b330192926008db582a76fd5f3082b1727a4a89b5a809d785a68f9adf267505439ff9e512fae10bd30b3c3b3386a5081f1f52580acaee17a704b9ed25235ac3cd7b9562d19aa43cc3151b81099c43c4467b6c0f810939a00f3ad4b5a51e8e3312a0c0231b65c88814e5f30c7c3664a86ae1e2f171c705b6a1988f0a7ff2bcbb8e3d3a0e9a0bc41a22c5cf94201ac79e00d09c66c8e9de9ab2cbb2d98b95ce6eb1c16a4a7ed5b277d1a39517d9a956417117f195af4e2b795d18f2662796916e2aa8da8edd990cacaaf1489b6f53a01bafb44b4c3dc54d9cff06754644ca9e95fb29017afe284afee8a8601b14766af065008d4a79acf380079262878a195a18a8db805d40733f4b433eab3fa1c46f26e160a750f2d671f157b52500749872d76b5b4769a2fe856c1843cc1ab8e5ba9196b84ecf769c205477ff51a6e9a3abef00212ec792d897746f5708baad4f9de6688adb09cc5a3f9012e4ebde031c462fd8bffce69ada26287edcb2760b8000db62b5179abdf58d398a67182265b521de703c0735170f2ddaf6a66faaaf33f1fe516e4855bf1ee4eedee24f087fa0b7dbabe5ec6303dbd7df059f0bcc4b185d40775eb9277a84c9f766fef6a36fc0162969dbfdc6267da5804f29a3255a773ec698c19c352e909425ff28cca10484b6fb32e9bc690236a6e3cfec4c477534457f052677172d8fb367b359b5e88c12c30e3c773804ce4ceb7c29531afe0b0afe7f5e4d994a8552c0a96155809d161a4903ac7c2d6d278132820012680be5a04c01488230a4a946d40e5bffd41ad2b1f4de015afac60f059167d9820c81dfc037ca7521b1fc00769d7b81a721863b1e15f9197a2d6d69c53597ca99e24b1e95cdc89a2349a28e94b1abdefe7781ac7095447b5c9a3a85aef15034c6a25bb90acd40edc28412000526c4dfa09384ce09f7bf69f6d119e0635ba803fa7348a4b3650e5717e56d6c4d8bd709da54a0ead95b6ff13771c48d430ceeed59fb62e9d468710b4ccd6f9d3c244718ce2423181732bcf3c2c03640e2bab6ebbeccecbbcc12b7cbdf407552d0d159bf82b5c7dd33a2f7306f60f5fcdff7951b48619f81e25444262e1cd752f9b648952bb94294ac79192838cc66e3820f6b9aa9f0eff0c635e8c7e7c86b22652e31888558acc68446372a4a0d2eccf435bcb6cc1ae8813db259ee8e956472f285a90a3c09869b29d8e096057f026f3fb1e0aa3cd6c34a9a450769c0cb2043ebc69d4cef9a56e3916d3923d18ceca103f0d9ff9b19207757022c0cba2c10d6b5f3795f966d8c0f64f9dd620c8a26eaa779862be86b40d46bf0604a44f09d7420036e9cffd88654ead34dce43fe80478265fab3cc505020ebb4be1518c23fba1a7c9746058c51280ba2d8bd1281d46ebb072afd7878d3571a05842b4c288f5525d189a92ab73c8d73a7ceada83254512abfd6f8bb5f00e03a841a45f996eb7ab6c75e8401ebd15f980bce1013f43354f879f562485113c9c37301dab46dfb0777a7fe94674af574b7b178c27450ca91c948ee1dd4cccde10bf34b5da1612abe805bf9167ca4a70b544bfed1269353b16e7eaefc153a04918999373e3f5ff4552fd913363ac9fced939de173872de2a1866dd6afa4eb80072fa2b5cb5486362375125cd9c3a5ebd26c251376f7802b16681dccfb5c284d4c372f6eff24088aad8812fb2d4d7e966eea5509da67b26a62b9b7cdf87f3af71c22a37d7107f67d24f93e44f92b5dfcd0c630201abf4357debb7ab15de851356bf54c80ab312481d9958fe6db810d46dd5ec97f8afc6618f2a0cde5842c735bfff2820ee69315aea1dd01c9b14d5c39da3b9a7551c7be242e8795b4b87f74c5a5c819171aed83916f794f82c3866b792afc8076c4aaeaaeedb22e93ad514406c1877f8d4812f9a3ab6322f870d3acaa0183f333bacea75dfaa6157731881c26896fa8722cee0df64d67a713daa567ceb11aa2c16ffa963386649b73cd371acab3237c65c93bf25047cfb7f65bf851b2045d56dd0fc883432a6921d928e4bc372994c613920c6bf32d9c1117f8f4e2c3772517c5746e2677ca5f68bd380410c920a3e1ceda9587f6562946f4ad82d61e88896bc75efdf4978125d33dd0124bc543d2e23cda36d01a0dc224ca47cb7450aa55c2be9d25681f29431babcf36d1e1a2cdbf13b48b89ea38f60f6ad56ca2d836c3404042d5135d2117d7b596019d8d158ee9bf8e2407783e9b1eebca34c09cd148a0c6299cb1f25c66a43d0b4c69b2832080abb2fd3a3fc4cf4bd7ce649dd18a79561d357a674ace5b4a1bb3cfd48cd4959e492d51aa1214c20499791d596bce952dc886111152eec76d095c2bb92192241c8d75cdf5adab2e532feb182c9f72749c3eda19f6842990bdc5cb28c632cdf7a8b47e70f331d386624855dd8bb79b6583973a35601d519c4b0d3d32f9845d105c45f4c4628ba7a372aee7f1f10e5cce8565460888297cb3ffe6a99912ed4e2b4f272bd534280ca372ad0185fe2e3178e669345a61f6722b9f10167018c097c9c4c1e295b005973c4e48f94dcd30cc07d7997b66f5fc93f0b3f7da1053cf0aea40b158495248566f5cd0d0e40e6e4345af046ec17bd623a94c7cc42b7a2c822dd94c075e2e8b87dc4d7fce088347115ca00ba819062cd092a4dff441b08dd40c783cb04b190", 0x1000}, {&(0x7f00000000c0)='O', 0x1}], 0x2, &(0x7f0000001180)="ec87f0af000db75d899aa86bd08ede30f23d7bc38a619a270dc3e4a309fc794e41e129ae128606ce36fd9c200713f2efe26f201d441c3cd91f74c992e9967d2d7c6b12b538315ceede7e90d93c06204152743d7a085382bbd8508a025b29501aa9effd1cc409af7e8e033274fd602ccb421c9245ea13858cff934ba5beefb5b173a94f84effaf286e913e8cab91bdbd17b3078c8875905d8f929", 0x9a, 0x84}, 0x40880) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r2, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) ioctl$sock_netdev_private(r2, 0x89f2, &(0x7f0000000000)) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000004700)=ANY=[@ANYBLOB="a04400005200010000000000000000001c0000008b4409", @ANYBLOB], 0x44a0}}, 0x0) getsockopt$inet6_tcp_int(r1, 0x6, 0x1e, &(0x7f0000001280), &(0x7f00000012c0)=0x4) 15.300623735s ago: executing program 4 (id=5181): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000006c0)='./cgroup/cgroup.procs/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000010a40)=[0x93e6], 0x0, 0x0, 0x1}}, 0x40) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r2}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r3, 0x4010744d, &(0x7f0000000180)) 15.256788087s ago: executing program 0 (id=5182): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000001c0)=0x144, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000000)=0x7d, 0x4) recvfrom$inet(r0, 0x0, 0x0, 0x2043, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6(0x10, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x0, 0x0, 0xfff00002}, {0x16}]}, 0x10) sendto$inet6(r1, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000001c0)=0x144, 0x4) (async) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) (async) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) (async) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000000)=0x7d, 0x4) (async) recvfrom$inet(r0, 0x0, 0x0, 0x2043, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) socket$inet6(0x10, 0x2, 0x0) (async) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x0, 0x0, 0xfff00002}, {0x16}]}, 0x10) (async) sendto$inet6(r1, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) (async) 15.18040425s ago: executing program 0 (id=5183): r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r2, 0x6, 0x6, &(0x7f0000000180)=0x1, 0x4) getsockopt$inet6_tcp_int(r2, 0x6, 0x6, 0x0, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000140)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r3, 0x11, 0x16, @remote}, 0x10) r4 = socket(0x2d, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b", 0x83}], 0x1}, 0x0) socket(0x22, 0x3, 0x71) connect$qrtr(r4, &(0x7f0000000300)={0x2d, 0x0, 0x4001}, 0xc) write(r0, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) 15.173536559s ago: executing program 0 (id=5184): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="1b000000190001001a848efa961fb2d82d"], 0x1c}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{}, 0x0, 0x0}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000061190400000000009500000000000000d60eaa93209407d3da2a7c43ac9f4105a03e907be52fe3a0d3e089794f43838a944161640bd095fe6152e048e5f8426a2b8b80ab66559358d93a6d912e5a9e5cf32d9c1b5f5560437db009577bb9"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xb6) 15.142707987s ago: executing program 0 (id=5185): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x6, 0xb, 0x0, 0x0, @str='{\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) r1 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x800) accept4$unix(r1, &(0x7f0000000080)=@abs, &(0x7f0000000140)=0x6e, 0x1000) 5.117886173s ago: executing program 32 (id=5109): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x801, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$nci(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="61a88f4e67c8eb920d0220162d0b22d2cfe847daf629bd4a35c4e092e9bd863ac6770841e591674dba7e9af6c913e93cddfa68d60f859f62aab9fffcb0fa3a69ae2447fb7d1600c798a1a49e1fe044dff958e06629fec708e2dc8bb44dc2624fd1d8cdaefa81e8a64d4bb248abf90efdf2fe6378cfebd0c0170ecc1ceeb26cf94a347d51101f9126e8aaaa6d899af03f00bcb34a1595a6049063"], 0x3) r2 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_KEY(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x48, r5, 0x801, 0x400, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac02}]}]}, 0x48}}, 0x0) sendmsg$NL80211_CMD_DEL_TX_TS(r4, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001280)={0x50, r5, 0x20, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xd}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x1}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xb}]}, 0x50}}, 0x8000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(r7, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000016c0)={0x10, 0x26, 0x1}, 0x10}], 0x1}, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r8, 0x11c, 0x2, &(0x7f0000000240)=""/4096, &(0x7f0000000140)=0x1000) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) socketpair(0x2b, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TLS_RX(r9, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x304}, "64fdc95ef2524596", "c6b7b01b8428b5bf00", "01adaefe", "33b75f3f68d48ed0"}, 0x38) 1.08711956s ago: executing program 33 (id=5166): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd29, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2, 0xfffffff9}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80d1}, 0x14000c08) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000580)={'syztnl2\x00', &(0x7f0000000500)={'gretap0\x00', r3, 0x7, 0x8000, 0xfe6, 0x6, {{0x14, 0x4, 0x3, 0x7, 0x50, 0x67, 0x0, 0x2, 0x4, 0x0, @private=0xa010100, @remote, {[@rr={0x7, 0x2b, 0x91, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @rand_addr=0x64010101, @multicast1, @loopback, @multicast2, @empty, @multicast2, @dev={0xac, 0x14, 0x14, 0xd}, @remote]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x4, 0xdb, 0x1, 0x8}, @generic={0x83, 0x7, "b40f0b3e7f"}]}}}}}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@void, @void}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x4}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}]]}, 0x24}}, 0x20040000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x2c, 0x140f, 0x60ceaae1ef55e4c3, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'issm\x00'}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r8, @ANYBLOB="0c00990eff070000700000001400040073797a6b616c6c657230000000001c000800050004"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000002c0)={0x0, @empty}, &(0x7f0000000340)=0xc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'erspan0\x00', &(0x7f0000000440)={'sit0\x00', r10, 0x80, 0x7800, 0xffffff01, 0x6, {{0x1b, 0x4, 0x0, 0x4, 0x6c, 0x64, 0x0, 0x9, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @multicast2, {[@rr={0x7, 0x2b, 0x34, [@multicast1, @rand_addr=0x64010101, @rand_addr=0x64010101, @remote, @private=0xa010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @multicast1, @multicast2, @rand_addr=0x64010102]}, @cipso={0x86, 0x12, 0x1, [{0x2, 0xc, "004a3c6a511dff7ae0d8"}]}, @end, @cipso={0x86, 0xb, 0x0, [{0x2, 0x5, "d35476"}]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0xb, 0x7d, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}]}}}}}) close(r9) socket$netlink(0x10, 0x3, 0x14) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r11 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r11, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='\t\x00', @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x24004000}, 0x20048040) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r13, 0x800452d2, &(0x7f0000000100)) ioctl$PPPIOCGUNIT(r12, 0x80047456, &(0x7f0000000200)) 59.753516ms ago: executing program 34 (id=5185): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x6, 0xb, 0x0, 0x0, @str='{\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) r1 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x800) accept4$unix(r1, &(0x7f0000000080)=@abs, &(0x7f0000000140)=0x6e, 0x1000) 37.643272ms ago: executing program 35 (id=5175): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair(0x1a, 0x804, 0x3f, &(0x7f0000000240)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000041c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000800)={0x28, r3, 0x1, 0x70bd28, 0x1, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x24000880) (async) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000800)={0x28, r3, 0x1, 0x70bd28, 0x1, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x24000880) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000280), &(0x7f00000002c0)=0x8) (async) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000280), &(0x7f00000002c0)=0x8) r4 = socket(0x1c, 0x6, 0x9) syz_genetlink_get_family_id$nfc(&(0x7f0000000300), 0xffffffffffffffff) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x8202, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x8202, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000140), 0x3) (async) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000140), 0x3) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f0000000040)={'ip6gre0\x00', 0x400}) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f0000000100)={'wlan0\x00', 0x400}) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(r7) (async) close(r7) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x7c}, [@ldst={0x6}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x3c) getpeername$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000500000000000000b64f7110b5000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newqdisc={0x148, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x73c7d38a1b8432c4, 0x2, [@TCA_RED_STAB={0x104, 0x2, "55f4b32d215d09ad34a54ecd392b645312028acf803a4be046ac0250a6ab00acdbbcc0a681ef62574eb95c3668168a2237f2cc488cf760d067868e8021f61308c6db4e4ac2ec40342736d4b782ed114b6e548109d0d25d975663c05ceaa64032471a805702a7a92bca01e7f16cfd7858b64cf7168d9220b64044c8dab5221c7a97fe9b875c33dfe30b850d7b07be151a84a139feeb514347d3e58683a3a7a624b0c79700622bbb5c8f573b27d294ff211faa3ef5d05472c85cd1ed4d7bdfbbe8aea77753e983bf2350c11b80e2e0c058bc01ebfe9e4faec45b78bb3d2551f3fec86fca5bea0668c9c98e75db02191cc525ec2d3f9a4db0895a3ff2b1931fa0da"}, @TCA_RED_PARMS={0x14}]}}]}, 0x148}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000700000aa4000000060a0b0400000100000000000200000078000480740001800a0001006d617463680000006400028008000240000000000c00010072617465657374004c0003007e6b92c43235dc7e977221f83c3f179e65022fc067b787cd67b6d9983b1bddafbdf6a37da5ed332cd2ee94b31d2ec330ce34cc676c0783a4bcc1e966554b0470582e870b81e92a630900010073797a30000000000900020073797a3200000000140000001100200000000000000000000500000a4426c6ef1a28967af114d191a629c93e4dbbb12e1646aa7c1538b893a00eb75d5a4e4fc77c977912d32f0cc3e179966b82ba0013c74fb91f28749119c2521fb7de5de5690dc8d5b1dbd1cd91b6dacac9bc890d7a25228cf33cb8f309d10cff27ad207d116294c5effe4bf119b999928cd7c8cda79e30b47e95a1cc2385bbdcb7ff"], 0xcc}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) 0s ago: executing program 36 (id=5181): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000006c0)='./cgroup/cgroup.procs/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000010a40)=[0x93e6], 0x0, 0x0, 0x1}}, 0x40) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r2}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r3, 0x4010744d, &(0x7f0000000180)) kernel console output (not intermixed with test programs): lting to 1000 [ 337.668104][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.707884][T16878] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3244'. [ 337.725903][T16861] chnl_net:caif_netlink_parms(): no params data found [ 337.921588][T16878] delete_channel: no stack [ 337.943009][T16878] delete_channel: no stack [ 338.007045][T16861] bridge0: port 1(bridge_slave_0) entered blocking state [ 338.024711][T16861] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.032333][T16861] bridge_slave_0: entered allmulticast mode [ 338.041180][T16861] bridge_slave_0: entered promiscuous mode [ 338.050294][T16861] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.057741][T16861] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.072955][T16861] bridge_slave_1: entered allmulticast mode [ 338.080777][T16861] bridge_slave_1: entered promiscuous mode [ 338.142107][T16861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 338.154687][T16905] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 338.169717][T16907] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3253'. [ 338.188278][T16861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 338.198787][T16907] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.206518][T16907] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.272559][T16861] team0: Port device team_slave_0 added [ 338.287140][T16861] team0: Port device team_slave_1 added [ 338.351376][T16861] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 338.364732][T16861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 338.395397][T16913] netlink: 232 bytes leftover after parsing attributes in process `syz.3.3255'. [ 338.435294][T16861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 338.477740][T16861] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 338.486587][T16861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 338.546008][T16861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 338.576086][T16932] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.583446][T16932] bridge0: port 2(bridge_slave_1) entered listening state [ 338.591054][T16932] bridge0: port 1(bridge_slave_0) entered blocking state [ 338.598344][T16932] bridge0: port 1(bridge_slave_0) entered listening state [ 338.608116][T16932] bridge0: entered allmulticast mode [ 338.634733][ T5152] Bluetooth: hci0: command tx timeout [ 338.762187][T16861] hsr_slave_0: entered promiscuous mode [ 338.773669][T16861] hsr_slave_1: entered promiscuous mode [ 338.780292][T16861] debugfs: 'hsr0' already exists in 'hsr' [ 338.787058][T16861] Cannot create hsr debugfs directory [ 338.946894][ T2951] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 338.955155][ T2951] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 338.964926][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 338.974941][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 339.352267][T16975] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3265'. [ 339.424537][ T5152] Bluetooth: hci1: command tx timeout [ 339.598874][T16986] netdevsim netdevsim1: Direct firmware load for failed with error -2 [ 339.621360][T16986] netdevsim netdevsim1: Falling back to sysfs fallback for: [ 339.765501][T16993] netlink: 'syz.3.3271': attribute type 29 has an invalid length. [ 339.888955][T16861] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 339.903951][T16861] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 339.927585][T16861] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 339.965414][T16861] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 340.168714][T17027] __nla_validate_parse: 3 callbacks suppressed [ 340.168732][T17027] netlink: 260 bytes leftover after parsing attributes in process `syz.3.3280'. [ 340.187385][T17026] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3281'. [ 340.202051][T17026] veth0_macvtap: left promiscuous mode [ 340.242380][T16861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 340.380444][T16861] 8021q: adding VLAN 0 to HW filter on device team0 [ 340.418369][ T1081] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.425589][ T1081] bridge0: port 1(bridge_slave_0) entered forwarding state [ 340.448446][T16007] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.455690][T16007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 340.479407][T17039] openvswitch: netlink: Unknown key attributes 2 [ 340.515570][T17039] openvswitch: netlink: Unknown key attributes 2 [ 340.585882][T17041] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3285'. [ 340.667983][T17055] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 340.684510][T17056] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 340.713318][ T5152] Bluetooth: hci0: command tx timeout [ 340.761071][T17063] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3291'. [ 340.856890][T17071] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.864194][T17071] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.941994][T16861] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 341.080341][T16861] veth0_vlan: entered promiscuous mode [ 341.132435][T16861] veth1_vlan: entered promiscuous mode [ 341.231795][T16861] veth0_macvtap: entered promiscuous mode [ 341.254924][T17096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3301'. [ 341.267018][T16861] veth1_macvtap: entered promiscuous mode [ 341.281118][T17096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3301'. [ 341.297591][T17098] xt_l2tp: v2 doesn't support IP mode [ 341.311168][T16861] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 341.368148][T16861] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 341.412700][T16007] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.446013][T16007] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.477964][T16007] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.505214][T17106] RDS: rds_bind could not find a transport for ::ffff:172.30.0.5, load rds_tcp or rds_rdma? [ 341.510933][ T5152] Bluetooth: hci1: command tx timeout [ 341.535421][T16007] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.734976][T17114] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 341.788503][T17118] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3311'. [ 341.810954][ T1006] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 341.836799][ T1006] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 341.855640][T17120] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3310'. [ 341.957636][T17114] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3308'. [ 342.000078][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 342.039244][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 342.042654][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 342.054660][ C1] lec:lec_tx_timeout: lec0 [ 342.059217][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 342.325154][T17135] netlink: 'syz.1.3316': attribute type 21 has an invalid length. [ 342.355944][T17136] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3233'. [ 342.650493][T17145] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 342.911195][T17167] openvswitch: netlink: Key type 182 is out of range max 32 [ 343.366780][T17193] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 343.545547][T17212] openvswitch: netlink: Missing valid actions attribute. [ 343.563281][T17212] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 343.584833][ T5152] Bluetooth: hci1: command tx timeout [ 343.610913][T17215] Cannot find add_set index 1 as target [ 343.633257][T17217] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 343.852048][T17234] veth0_to_bridge: entered promiscuous mode [ 343.868182][T17233] IPVS: set_ctl: invalid protocol: 255 0.0.0.0:20000 [ 343.908155][T17231] veth0_to_bridge: left promiscuous mode [ 344.002487][T17246] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 344.070150][ T1137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 344.078410][ T1137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 344.088975][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 344.099334][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 344.109948][T17251] netlink: 'syz.2.3348': attribute type 30 has an invalid length. [ 344.120066][T17251] netlink: 'syz.2.3348': attribute type 30 has an invalid length. [ 344.127934][T17256] : entered promiscuous mode [ 344.317399][T17271] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5 [ 345.219448][T17322] netlink: 'syz.4.3371': attribute type 4 has an invalid length. [ 345.238284][T17322] __nla_validate_parse: 14 callbacks suppressed [ 345.238305][T17322] netlink: 240 bytes leftover after parsing attributes in process `syz.4.3371'. [ 345.257121][T17324] Bluetooth: MGMT ver 1.23 [ 345.446110][T17337] xt_SECMARK: invalid mode: 9 [ 345.664613][ T5836] Bluetooth: hci1: command tx timeout [ 347.072662][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 347.080770][ C1] lec:lec_tx_timeout: lec0 [ 347.085491][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 347.294613][T17396] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3390'. [ 347.368253][T17399] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3391'. [ 347.457846][T17407] netlink: 'syz.1.3392': attribute type 21 has an invalid length. [ 347.488658][T17407] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3392'. [ 347.508210][T17407] netlink: 'syz.1.3392': attribute type 4 has an invalid length. [ 347.508942][T17398] netlink: 'syz.1.3392': attribute type 21 has an invalid length. [ 347.540382][T17407] netlink: 'syz.1.3392': attribute type 5 has an invalid length. [ 347.560575][T17407] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3392'. [ 347.588362][T17398] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3392'. [ 347.601379][T17394] netlink: 'syz.0.3391': attribute type 10 has an invalid length. [ 347.607065][T17398] netlink: 'syz.1.3392': attribute type 4 has an invalid length. [ 347.619430][T17398] netlink: 'syz.1.3392': attribute type 5 has an invalid length. [ 347.633383][T17398] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3392'. [ 347.643321][T17394] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 347.668229][T17394] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 347.704763][T17418] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3398'. [ 347.743835][ T5836] Bluetooth: hci1: command 0x0405 tx timeout [ 347.745546][T17420] netlink: 404 bytes leftover after parsing attributes in process `syz.1.3399'. [ 347.773535][T17420] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3399'. [ 347.903297][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 347.926040][T17433] netlink: 'syz.2.3404': attribute type 10 has an invalid length. [ 348.071849][T17439] netlink: 'syz.4.3406': attribute type 1 has an invalid length. [ 348.138289][T17439] bond4: entered promiscuous mode [ 348.144803][T17439] 8021q: adding VLAN 0 to HW filter on device bond4 [ 348.182471][T17443] bond4: (slave bridge2): making interface the new active one [ 348.190724][T17443] bridge2: entered promiscuous mode [ 348.197823][T17443] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 348.346257][T17456] bridge0: entered allmulticast mode [ 348.413651][T17461] xt_HMARK: spi-set and port-set can't be combined [ 348.446832][T17460] rdma_op ffff8880282889f0 conn xmit_rdma 0000000000000000 [ 348.512328][T17469] ip6t_srh: unknown srh invflags 4000 [ 348.637017][T17475] : entered promiscuous mode [ 348.695564][T17481] netlink: 'syz.4.3419': attribute type 1 has an invalid length. [ 348.972043][T17509] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 348.979350][T17509] IPv6: NLM_F_CREATE should be set when creating new route [ 348.986621][T17509] IPv6: NLM_F_CREATE should be set when creating new route [ 349.012478][T17512] bond5: (slave bridge3): making interface the new active one [ 349.028143][T17512] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 349.227450][T17525] syz.2.3435 uses old SIOCAX25GETINFO [ 349.278702][T17529] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 349.952162][T17588] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 349.959007][T17588] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 350.356807][T17616] __nla_validate_parse: 7 callbacks suppressed [ 350.356827][T17616] netlink: 1032 bytes leftover after parsing attributes in process `syz.3.3463'. [ 350.411896][T17616] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 350.588524][T17629] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 350.920145][T17653] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3477'. [ 350.962906][T17656] syzkaller0: entered promiscuous mode [ 350.968432][T17656] syzkaller0: entered allmulticast mode [ 351.011051][T17656] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3476'. [ 351.431218][T17688] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3489'. [ 351.463215][T17689] ipt_ECN: cannot use operation on non-tcp rule [ 351.463727][T17681] netlink: 212116 bytes leftover after parsing attributes in process `syz.2.3488'. [ 351.773745][T17713] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3497'. [ 352.088931][T17736] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3505'. [ 352.141882][T17743] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 352.475607][T17766] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3512'. [ 352.551553][T17768] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 352.575535][T17768] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 352.597944][T17779] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3516'. [ 352.764629][T17787] IPVS: Unknown mcast interface: nicvf0 [ 352.862636][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5780 ms [ 352.870724][ C1] lec:lec_tx_timeout: lec0 [ 352.875963][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 353.055011][T17812] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 353.174304][T17812] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.3525'. [ 353.319450][T17830] xt_TCPMSS: Only works on TCP SYN packets [ 353.668770][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 353.932424][T17870] validate_nla: 5 callbacks suppressed [ 353.932441][T17870] netlink: 'syz.1.3545': attribute type 6 has an invalid length. [ 355.092064][T17932] netlink: 'syz.0.3564': attribute type 11 has an invalid length. [ 355.147570][T17932] netlink: 'syz.0.3564': attribute type 11 has an invalid length. [ 355.470540][T17968] netlink: 'syz.3.3571': attribute type 9 has an invalid length. [ 355.471745][T17966] ip6t_srh: unknown srh invflags 4000 [ 355.499041][T17968] netlink: 'syz.3.3571': attribute type 11 has an invalid length. [ 355.533018][T17968] netlink: 'syz.3.3571': attribute type 12 has an invalid length. [ 355.540884][T17968] __nla_validate_parse: 7 callbacks suppressed [ 355.540898][T17968] netlink: 210020 bytes leftover after parsing attributes in process `syz.3.3571'. [ 355.612826][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.623606][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.633215][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.648088][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.657274][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.670658][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.680299][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.689777][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.699152][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3576'. [ 355.970542][T18005] netlink: 'syz.2.3584': attribute type 9 has an invalid length. [ 355.989339][T18005] netlink: 'syz.2.3584': attribute type 11 has an invalid length. [ 356.001705][T18005] netlink: 'syz.2.3584': attribute type 12 has an invalid length. [ 356.005877][T17999] syzkaller0: entered promiscuous mode [ 356.036952][T17999] syzkaller0: entered allmulticast mode [ 356.119122][T18012] sctp: [Deprecated]: syz.4.3588 (pid 18012) Use of int in maxseg socket option. [ 356.119122][T18012] Use struct sctp_assoc_value instead [ 356.125813][T17999] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 356.172033][T18012] sctp: [Deprecated]: syz.4.3588 (pid 18012) Use of int in max_burst socket option. [ 356.172033][T18012] Use struct sctp_assoc_value instead [ 356.279368][T18020] netlink: 'syz.1.3591': attribute type 2 has an invalid length. [ 356.476116][T18037] tipc: Started in network mode [ 356.481088][T18037] tipc: Node identity fe800000000000000000000000000014, cluster identity 4711 [ 356.499058][T18037] tipc: Enabled bearer , priority 10 [ 356.776207][T18051] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 357.007833][T18071] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 357.182009][T18078] ipt_REJECT: TCP_RESET invalid for non-tcp [ 357.218715][T18061] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 357.246557][T18064] bridge_slave_0: left allmulticast mode [ 357.254677][T18064] bridge_slave_0: left promiscuous mode [ 357.260558][T18064] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.275550][T18064] bridge_slave_1: left allmulticast mode [ 357.282462][T18064] bridge_slave_1: left promiscuous mode [ 357.289106][T18064] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.305623][T18064] bond0: (slave bond_slave_0): Releasing backup interface [ 357.321029][T18064] bond0: (slave bond_slave_1): Releasing backup interface [ 357.340001][T18064] team0: Port device team_slave_0 removed [ 357.350367][T18064] team0: Port device team_slave_1 removed [ 357.358635][T18064] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 357.366655][T18064] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 357.375614][T18064] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 357.383824][T18064] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 357.393416][T18064] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 357.636707][ T48] tipc: Node number set to 4269801492 [ 357.902675][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 357.910777][ C1] lec:lec_tx_timeout: lec0 [ 357.915574][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 358.095363][T18134] sctp: [Deprecated]: syz.4.3622 (pid 18134) Use of int in max_burst socket option. [ 358.095363][T18134] Use struct sctp_assoc_value instead [ 358.328975][T18151] veth0_to_bridge: entered promiscuous mode [ 358.358518][ T1006] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.402118][T18150] veth0_to_bridge: left promiscuous mode [ 358.414541][ T1006] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.428533][T18160] sctp: [Deprecated]: syz.3.3632 (pid 18160) Use of int in maxseg socket option. [ 358.428533][T18160] Use struct sctp_assoc_value instead [ 358.453260][T10067] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.462396][T18161] sctp: [Deprecated]: syz.3.3632 (pid 18161) Use of struct sctp_assoc_value in delayed_ack socket option. [ 358.462396][T18161] Use struct sctp_sack_info instead [ 358.465032][T10067] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.491335][T18160] sctp: [Deprecated]: syz.3.3632 (pid 18160) Use of int in maxseg socket option. [ 358.491335][T18160] Use struct sctp_assoc_value instead [ 358.517992][T18154] bond1: (slave ip6gretap1): making interface the new active one [ 358.527501][T18154] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 358.648038][T18175] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 358.724016][T18176] erspan0: entered promiscuous mode [ 358.745320][T18176] gretap0: entered promiscuous mode [ 358.984105][ T5966] IPVS: starting estimator thread 0... [ 359.055540][T18197] netlink: 'syz.1.3643': attribute type 11 has an invalid length. [ 359.085511][T18196] IPVS: using max 26 ests per chain, 62400 per kthread [ 359.196205][T18206] 8021q: adding VLAN 0 to HW filter on device bond3 [ 359.303121][T18217] tipc: Enabled bearer , priority 0 [ 359.311041][T18217] syzkaller0: entered promiscuous mode [ 359.318400][T18217] syzkaller0: entered allmulticast mode [ 359.351313][T18215] tipc: Resetting bearer [ 359.402244][T18215] tipc: Disabling bearer [ 359.478378][T18223] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 359.513296][T18223] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 359.533781][T18223] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 359.541389][T18223] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 359.866363][T18255] IPVS: length: 239 != 24 [ 360.072121][T18268] validate_nla: 7 callbacks suppressed [ 360.072137][T18268] netlink: 'syz.3.3666': attribute type 9 has an invalid length. [ 360.236454][T18281] netlink: 'syz.3.3671': attribute type 26 has an invalid length. [ 360.278318][T18283] syzkaller0: entered promiscuous mode [ 360.284867][T18283] syzkaller0: entered allmulticast mode [ 360.604714][T18294] pimreg3: entered allmulticast mode [ 360.676856][T18297] __nla_validate_parse: 34 callbacks suppressed [ 360.676876][T18297] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3677'. [ 360.720501][T18300] netlink: 27 bytes leftover after parsing attributes in process `syz.3.3678'. [ 360.966092][T18313] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 360.981161][T18313] bond1 (unregistering): Released all slaves [ 361.084006][T18326] netlink: 45 bytes leftover after parsing attributes in process `syz.0.3685'. [ 361.098323][T18326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3685'. [ 361.378343][T18347] netlink: 'syz.3.3692': attribute type 9 has an invalid length. [ 361.392927][T18347] netlink: 'syz.3.3692': attribute type 11 has an invalid length. [ 361.419458][T18349] : renamed from hsr0 (while UP) [ 361.423195][T18347] netlink: 'syz.3.3692': attribute type 12 has an invalid length. [ 361.437045][T18347] netlink: 210020 bytes leftover after parsing attributes in process `syz.3.3692'. [ 361.458449][T18352] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3692'. [ 361.468292][T18347] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3692'. [ 361.587039][T18356] netlink: 'syz.1.3696': attribute type 1 has an invalid length. [ 361.602834][T18356] netlink: 'syz.1.3696': attribute type 1 has an invalid length. [ 361.641422][T18364] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3699'. [ 361.651052][T18364] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3699'. [ 361.810585][T18371] netlink: 'syz.3.3697': attribute type 29 has an invalid length. [ 361.836946][T18376] netlink: 'syz.3.3697': attribute type 29 has an invalid length. [ 361.878700][T18362] netlink: 'syz.3.3697': attribute type 29 has an invalid length. [ 362.142423][T18397] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3703'. [ 362.210234][T18402] veth0_virt_wifi: entered allmulticast mode [ 362.401689][T18417] bond0: entered promiscuous mode [ 362.437050][T18417] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 362.482521][T18417] ip6gretap0: entered promiscuous mode [ 362.505720][T18417] debugfs: 'hsr1' already exists in 'hsr' [ 362.520454][T18417] Cannot create hsr debugfs directory [ 362.528148][T18417] hsr1: entered promiscuous mode [ 362.540910][T18425] block nbd0: NBD_DISCONNECT [ 362.553351][T18425] block nbd0: Send disconnect failed -32 [ 362.922643][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 362.930778][ C1] lec:lec_tx_timeout: lec0 [ 362.935613][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 362.964483][T18443] openvswitch: netlink: Flow key attr not present in new flow. [ 363.090774][T18454] bridge0: left allmulticast mode [ 363.102544][T18454] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 363.131823][T18454] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 363.270504][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 363.284311][T18468] syzkaller1: entered promiscuous mode [ 363.311623][T18468] syzkaller1: entered allmulticast mode [ 363.706517][T18491] sctp: [Deprecated]: syz.1.3734 (pid 18491) Use of struct sctp_assoc_value in delayed_ack socket option. [ 363.706517][T18491] Use struct sctp_sack_info instead [ 364.116868][T18516] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 364.308178][T18536] IPVS: stopping backup sync thread 17743 ... [ 364.419556][T18544] macvlan2: entered promiscuous mode [ 364.425797][T18544] macvlan2: entered allmulticast mode [ 364.432426][T18544] bond1: entered promiscuous mode [ 364.440189][T18544] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 364.451637][T18544] bond1: left promiscuous mode [ 365.198496][T18608] set match dimension is over the limit! [ 365.214053][T18610] openvswitch: netlink: Message has 592 unknown bytes. [ 365.243902][T18610] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 365.471151][T18621] ip6gre1: entered allmulticast mode [ 365.590196][T18632] x_tables: unsorted underflow at hook 1 [ 365.600836][T18633] x_tables: unsorted underflow at hook 1 [ 365.766036][T18640] __nla_validate_parse: 13 callbacks suppressed [ 365.766050][T18640] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3780'. [ 365.844453][T18652] sctp: [Deprecated]: syz.3.3781 (pid 18652) Use of struct sctp_assoc_value in delayed_ack socket option. [ 365.844453][T18652] Use struct sctp_sack_info instead [ 365.875969][T18642] bond2: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 365.903741][T18655] vxcan1: tx address claim with dlc 401 [ 366.102936][T18660] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3784'. [ 366.132795][T18660] validate_nla: 9 callbacks suppressed [ 366.132812][T18660] netlink: 'syz.0.3784': attribute type 3 has an invalid length. [ 366.237524][T18677] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3786'. [ 366.249886][T18678] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3788'. [ 366.288088][T18672] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3786'. [ 366.290321][T18668] bond4: Unable to set peer notification delay as MII monitoring is disabled [ 366.309888][T18668] bond4 (unregistering): Released all slaves [ 366.324782][T18682] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3788'. [ 366.818981][T18705] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3794'. [ 367.175774][ T5965] IPVS: starting estimator thread 0... [ 367.234553][T18741] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3803'. [ 367.239311][T18734] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3800'. [ 367.257545][T18741] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3803'. [ 367.272225][T18741] netlink: 'syz.3.3803': attribute type 6 has an invalid length. [ 367.280429][T18741] netlink: 'syz.3.3803': attribute type 5 has an invalid length. [ 367.313969][T18745] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 367.332835][T18739] IPVS: using max 31 ests per chain, 74400 per kthread [ 367.463261][T18753] ipt_REJECT: TCP_RESET invalid for non-tcp [ 367.699538][T18770] bond4: option min_links: invalid value (18446744073709551614) [ 367.736096][T18770] bond4: option min_links: allowed values 0 - 2147483647 [ 367.764227][T18770] bond4 (unregistering): Released all slaves [ 367.805544][T18769] vlan1: entered allmulticast mode [ 367.942642][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 367.950741][ C1] lec:lec_tx_timeout: lec0 [ 367.955849][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 368.261203][T18804] netlink: 'syz.4.3819': attribute type 1 has an invalid length. [ 368.350035][T18804] 8021q: adding VLAN 0 to HW filter on device bond6 [ 368.362125][T18807] bond0: entered promiscuous mode [ 368.388531][T18807] bond_slave_0: entered promiscuous mode [ 368.395062][T18807] bond_slave_1: entered promiscuous mode [ 368.412373][T18807] ip6gretap0: entered promiscuous mode [ 368.443855][T18807] hsr2: entered promiscuous mode [ 368.473832][T18809] bond6: (slave geneve2): making interface the new active one [ 368.495006][T18809] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 369.104700][T18839] netlink: 'syz.2.3829': attribute type 20 has an invalid length. [ 369.142221][T18839] netlink: 'syz.2.3829': attribute type 20 has an invalid length. [ 369.142287][ T61] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.201304][ T61] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.265413][ T61] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.295305][ T61] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.600385][T18872] netlink: 'syz.1.3840': attribute type 1 has an invalid length. [ 369.698768][T18880] Bluetooth: MGMT ver 1.23 [ 369.761452][T18889] Cannot find add_set index 0 as target [ 369.767571][T18875] hsr_slave_1 (unregistering): left promiscuous mode [ 369.995901][T18905] ipt_REJECT: TCP_RESET invalid for non-tcp [ 370.019730][T18906] openvswitch: netlink: Key type 65 is out of range max 32 [ 370.508341][T18947] netlink: 'syz.4.3863': attribute type 28 has an invalid length. [ 370.524316][T18949] team_slave_0: entered promiscuous mode [ 370.530345][T18949] team_slave_1: entered promiscuous mode [ 370.538591][T18949] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 370.548258][T18947] netlink: 'syz.4.3863': attribute type 3 has an invalid length. [ 370.581150][T18957] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 370.612967][T18950] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 370.721298][T18965] tipc: New replicast peer: 255.255.255.255 [ 370.729164][T18965] tipc: Enabled bearer , priority 10 [ 370.732888][T18963] netlink: 'syz.1.3865': attribute type 1 has an invalid length. [ 370.791434][T18969] __nla_validate_parse: 24 callbacks suppressed [ 370.791453][T18969] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3868'. [ 370.836470][T18957] bond3: (slave ip6gretap1): making interface the new active one [ 370.848299][T18957] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 370.918235][T18971] bond2 (unregistering): Released all slaves [ 371.230517][T18987] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3875'. [ 372.630163][T18981] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3872'. [ 372.644030][T18990] netlink: 'syz.2.3877': attribute type 12 has an invalid length. [ 372.651986][T18990] netlink: 'syz.2.3877': attribute type 29 has an invalid length. [ 372.661098][T18990] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3877'. [ 372.675140][T18990] netlink: 59 bytes leftover after parsing attributes in process `syz.2.3877'. [ 372.685598][T18995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3877'. [ 372.728732][T18996] pimreg: entered allmulticast mode [ 372.748989][T18998] pimreg: left allmulticast mode [ 372.801994][T19011] pim6reg1: entered promiscuous mode [ 372.822735][T19011] pim6reg1: entered allmulticast mode [ 372.830229][T19023] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3880'. [ 372.839555][ T5966] tipc: Node number set to 1638023922 [ 372.864604][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 372.919821][T19017] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3878'. [ 372.962642][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 372.970819][ C1] lec:lec_tx_timeout: lec0 [ 372.975788][T19024] syzkaller0: entered promiscuous mode [ 372.980524][T19033] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3882'. [ 372.981273][T19024] syzkaller0: entered allmulticast mode [ 373.082007][T19036] netlink: 'syz.3.3883': attribute type 10 has an invalid length. [ 373.156728][T19042] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3885'. [ 373.288013][T19054] netlink: 'syz.1.3887': attribute type 1 has an invalid length. [ 373.288013][T19047] netlink: 'syz.1.3887': attribute type 1 has an invalid length. [ 373.307499][T19052] bridge1: entered promiscuous mode [ 373.315888][T19052] bridge1: entered allmulticast mode [ 374.059852][T19100] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 374.269627][T19105] pim6reg527: entered allmulticast mode [ 374.356247][T19113] netlink: 'syz.0.3906': attribute type 7 has an invalid length. [ 374.369354][T19113] netlink: 'syz.0.3906': attribute type 9 has an invalid length. [ 374.381434][T19113] netlink: 'syz.0.3906': attribute type 7 has an invalid length. [ 374.390899][T19117] nbd: must specify a device to reconfigure [ 374.391483][T19119] netlink: 'syz.0.3906': attribute type 9 has an invalid length. [ 374.614299][T19132] netlink: 'syz.3.3914': attribute type 8 has an invalid length. [ 374.734818][T19137] 8021q: adding VLAN 0 to HW filter on device bond2 [ 374.844093][ T5152] block nbd0: Receive control failed (result -1) [ 374.862948][ T5152] Bluetooth: hci1: command 0x0405 tx timeout [ 375.053927][T19166] netlink: 'syz.3.3924': attribute type 11 has an invalid length. [ 375.084540][T19167] sctp: [Deprecated]: syz.2.3923 (pid 19167) Use of struct sctp_assoc_value in delayed_ack socket option. [ 375.084540][T19167] Use struct sctp_sack_info instead [ 375.125703][T19167] x_tables: duplicate underflow at hook 1 [ 375.246869][T19170] veth0: entered promiscuous mode [ 375.266077][T19170] veth0: left promiscuous mode [ 375.516777][T19173] bond1: option primary_reselect: invalid value (255) [ 375.568777][T19173] bond1 (unregistering): Released all slaves [ 375.818319][T19193] __nla_validate_parse: 13 callbacks suppressed [ 375.818339][T19193] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3931'. [ 375.900446][T19195] syzkaller0: entered promiscuous mode [ 375.912733][T19195] syzkaller0: entered allmulticast mode [ 375.930355][T19195] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 376.013454][T19195] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3932'. [ 376.081127][T19206] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3935'. [ 376.108296][T19200] Unsupported ieee802154 address type: 0 [ 376.420072][T19229] ksmbd: Unknown IPC event: 3, ignore. [ 376.467036][T19233] xt_CT: You must specify a L4 protocol and not use inversions on it [ 376.607820][T19252] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3945'. [ 376.629843][T19251] IPv6: NLM_F_CREATE should be specified when creating new route [ 376.652400][T19250] IPv6: NLM_F_CREATE should be specified when creating new route [ 376.914344][T19263] syzkaller1: entered promiscuous mode [ 376.919872][T19263] syzkaller1: entered allmulticast mode [ 376.961631][T19263] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 377.076115][T19269] bridge6: entered promiscuous mode [ 377.081865][T19269] bridge6: entered allmulticast mode [ 377.493824][T19305] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3963'. [ 377.545405][T19306] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3965'. [ 377.600422][T19295] syzkaller0: entered promiscuous mode [ 377.607306][T19295] syzkaller0: entered allmulticast mode [ 377.772319][T19318] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3969'. [ 377.794804][T19318] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3969'. [ 377.819726][T19318] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3969'. [ 377.844083][T19318] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3969'. [ 377.877974][T19323] syzkaller0: refused to change device tx_queue_len [ 378.063121][T19336] validate_nla: 1 callbacks suppressed [ 378.063143][T19336] netlink: 'syz.3.3973': attribute type 1 has an invalid length. [ 378.111212][T19336] netlink: 'syz.3.3973': attribute type 11 has an invalid length. [ 378.253951][T19355] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 378.272138][T19357] netlink: 'syz.3.3979': attribute type 10 has an invalid length. [ 378.299213][T19357] team0: Device veth1_macvtap failed to register rx_handler [ 378.327479][T19357] netlink: 'syz.3.3979': attribute type 1 has an invalid length. [ 378.391295][T19362] dummy0: left allmulticast mode [ 378.396995][T19362] dummy0: left promiscuous mode [ 378.402490][T19362] bridge0: port 3(dummy0) entered disabled state [ 378.420734][T19362] batman_adv: batadv0: Adding interface: dummy0 [ 378.432096][T19362] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 378.460492][T19362] batman_adv: batadv0: Interface activated: dummy0 [ 378.496931][T19367] batadv0: mtu less than device minimum [ 378.504280][T19367] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 378.516484][T19367] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 378.528261][T19367] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 378.540041][T19367] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 378.551915][T19367] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 378.563739][T19367] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 378.575744][T19367] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 378.630245][ T1303] lec:lec_start_xmit: lec0:No lecd attached [ 379.140925][T19407] netlink: 'syz.4.3993': attribute type 1 has an invalid length. [ 379.289280][T19417] netlink: 'syz.0.3998': attribute type 1 has an invalid length. [ 379.356487][T19417] bond4: entered promiscuous mode [ 379.374016][T19417] 8021q: adding VLAN 0 to HW filter on device bond4 [ 379.629473][T19434] bridge: RTM_NEWNEIGH with invalid ether address [ 379.676413][T19436] syzkaller1: entered promiscuous mode [ 379.682164][T19436] syzkaller1: entered allmulticast mode [ 379.838268][T19440] Bluetooth: hci1: too big key_count value 32778 [ 380.591371][T19477] netlink: 'syz.1.4018': attribute type 10 has an invalid length. [ 381.029427][ T5836] Bluetooth: hci0: command 0x0c1a tx timeout [ 381.039792][ T5152] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 381.130606][T19503] __nla_validate_parse: 37 callbacks suppressed [ 381.130625][T19503] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4027'. [ 381.305703][T19514] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4026'. [ 381.318850][T19513] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4027'. [ 381.464120][T19517] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4029'. [ 381.746193][T19539] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4037'. [ 381.999271][T19550] netlink: 88 bytes leftover after parsing attributes in process `syz.0.4041'. [ 382.013045][T19552] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4043'. [ 382.021961][T19550] netem: invalid attributes len -24 [ 382.037381][T19550] netem: change failed [ 382.466351][ T5965] net_ratelimit: 13 callbacks suppressed [ 382.466369][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 382.485124][T19568] ip6gre1: entered promiscuous mode [ 382.866429][T19583] netlink: 408 bytes leftover after parsing attributes in process `syz.4.4053'. [ 383.383513][T19595] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4056'. [ 383.483967][T19601] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4056'. [ 383.796070][T19628] netlink: 'syz.0.4066': attribute type 21 has an invalid length. [ 383.821441][T19628] workqueue: name exceeds WQ_NAME_LEN. Truncating to: “&˜%àï÷åQÍ0@æjÛÈÊ«–Óéôð} [ 383.875245][T19633] netlink: 'syz.1.4068': attribute type 1 has an invalid length. [ 383.892260][T19633] netlink: 'syz.1.4068': attribute type 2 has an invalid length. [ 383.902738][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5270 ms [ 383.910810][ C1] lec:lec_tx_timeout: lec0 [ 384.108747][T19650] netlink: 'syz.0.4073': attribute type 10 has an invalid length. [ 384.205317][T19650] team0: Port device dummy0 added [ 384.315496][T19669] netlink: 'syz.4.4080': attribute type 1 has an invalid length. [ 384.396781][T19669] bond7: entered promiscuous mode [ 384.408819][T19669] 8021q: adding VLAN 0 to HW filter on device bond7 [ 384.424747][T19670] veth0: entered promiscuous mode [ 384.439393][T19673] bond0: entered promiscuous mode [ 384.472795][T19673] bond_slave_0: entered promiscuous mode [ 384.478809][T19673] bond_slave_1: entered promiscuous mode [ 384.494958][T19673] ip6gretap0: entered promiscuous mode [ 384.507023][T19673] debugfs: 'hsr1' already exists in 'hsr' [ 384.513511][T19673] Cannot create hsr debugfs directory [ 384.519186][T19673] hsr1: entered promiscuous mode [ 384.747250][T19677] bond7: (slave bridge6): making interface the new active one [ 384.754986][T19677] bridge6: entered promiscuous mode [ 384.761825][T19677] bond7: (slave bridge6): Enslaving as an active interface with an up link [ 385.039867][T19687] IPv6: sit1: Disabled Multicast RS [ 385.055110][T19687] sit1: entered allmulticast mode [ 385.227385][T19697] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 385.405721][T19705] bond0: (slave caif0): Error: Device type is different from other slaves [ 385.488166][T19710] netlink: 'syz.3.4093': attribute type 6 has an invalid length. [ 385.805323][T19727] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 385.910396][T19730] bridge7: the hash_elasticity option has been deprecated and is always 16 [ 385.931410][T19696] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 386.074872][T19742] netlink: 'syz.4.4103': attribute type 12 has an invalid length. [ 386.076378][T19741] bridge7: entered promiscuous mode [ 386.088532][T19741] bridge7: entered allmulticast mode [ 386.097814][T19743] netlink: 'syz.1.4100': attribute type 4 has an invalid length. [ 386.127628][T19742] bond8: option primary_reselect: invalid value (255) [ 386.138890][T19742] bond8 (unregistering): Released all slaves [ 386.302219][T19761] netem: change failed [ 386.421758][T19772] netlink: 'syz.4.4111': attribute type 10 has an invalid length. [ 386.456527][T19772] dummy0: entered promiscuous mode [ 386.466866][T19772] team0: Failed to send options change via netlink (err -105) [ 386.475983][T19772] team0: Port device dummy0 added [ 386.483117][T19772] netlink: 'syz.4.4111': attribute type 10 has an invalid length. [ 386.498167][T19772] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 386.522198][T19772] team0: Failed to send options change via netlink (err -105) [ 386.541032][T19772] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 386.551543][T19772] team0: Port device dummy0 removed [ 386.555971][T19783] __nla_validate_parse: 14 callbacks suppressed [ 386.555989][T19783] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4115'. [ 386.558016][T19772] dummy0: left promiscuous mode [ 386.580461][T19772] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 386.813932][T19799] x_tables: unsorted underflow at hook 3 [ 387.058571][T19815] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4119'. [ 387.183528][ T5836] Bluetooth: hci0: command 0x0c1a tx timeout [ 387.387250][T19836] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 387.461469][T19840] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4131'. [ 387.588241][T19843] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4132'. [ 387.774933][T19852] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4138'. [ 387.793377][T19855] tipc: Enabled bearer , priority 0 [ 387.800791][T19856] sctp: [Deprecated]: syz.1.4137 (pid 19856) Use of int in max_burst socket option. [ 387.800791][T19856] Use struct sctp_assoc_value instead [ 387.801181][T19855] syzkaller0: entered promiscuous mode [ 387.830709][T19855] syzkaller0: entered allmulticast mode [ 387.837125][T19855] tipc: Resetting bearer [ 387.861788][T19856] bridge_slave_0: left allmulticast mode [ 387.871294][T19856] bridge_slave_0: left promiscuous mode [ 387.881359][T19856] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.914298][T19856] bridge_slave_1: left allmulticast mode [ 387.920223][T19856] bridge_slave_1: left promiscuous mode [ 387.926213][T19856] bridge0: port 2(bridge_slave_1) entered disabled state [ 388.012529][T19856] bond0: (slave bond_slave_0): Releasing backup interface [ 388.079512][T19856] bond0: (slave bond_slave_1): Releasing backup interface [ 388.101545][T19856] team0: Port device team_slave_0 removed [ 388.121786][T19856] team0: Port device team_slave_1 removed [ 388.134967][T19856] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 388.317181][T19868] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4140'. [ 388.921351][T19893] netlink: 'syz.1.4147': attribute type 13 has an invalid length. [ 389.643379][T19923] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4153'. [ 389.699495][T19929] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4155'. [ 389.736086][T19935] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4156'. [ 389.852252][T19935] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4156'. [ 389.889958][T19935] geneve3: entered promiscuous mode [ 389.950510][T19947] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 389.979897][T19948] bond0: entered promiscuous mode [ 389.996087][T19948] bond_slave_0: entered promiscuous mode [ 390.002200][T19948] bond_slave_1: entered promiscuous mode [ 390.008752][T19948] dummy0: entered promiscuous mode [ 390.033982][T19948] bond0: left promiscuous mode [ 390.038797][T19948] bond_slave_0: left promiscuous mode [ 390.046430][T19948] bond_slave_1: left promiscuous mode [ 390.052042][T19948] dummy0: left promiscuous mode [ 390.064288][T19947] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 390.251105][T19964] IPVS: set_ctl: invalid protocol: 9 172.20.20.11:21 [ 390.318639][T19968] hsr_slave_0: left promiscuous mode [ 390.404325][T19979] bond0: entered promiscuous mode [ 390.409555][T19979] bond_slave_0: entered promiscuous mode [ 390.419457][T19979] bond_slave_1: entered promiscuous mode [ 390.427998][T19979] dummy0: entered promiscuous mode [ 390.436859][T19979] bond0: left promiscuous mode [ 390.441727][T19979] bond_slave_0: left promiscuous mode [ 390.447584][T19979] bond_slave_1: left promiscuous mode [ 390.453429][T19979] dummy0: left promiscuous mode [ 390.821622][T20000] bond5: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 390.841861][T20000] bond5 (unregistering): Released all slaves [ 390.897671][T20004] bond5: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 390.919687][T20004] bond5 (unregistering): Released all slaves [ 390.946277][T20013] vlan3: entered allmulticast mode [ 391.147272][T20029] vxcan1: tx address claim with dlc 0 [ 391.164822][T20028] vxcan1: tx address claim with dlc 0 [ 391.311586][T20043] º: renamed from veth1_vlan (while UP) [ 391.473637][T20053] netlink: 'syz.2.4193': attribute type 1 has an invalid length. [ 391.483876][T20053] netlink: 'syz.2.4193': attribute type 2 has an invalid length. [ 391.509146][T20057] bridge8: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 391.560606][T20061] bridge9: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 391.658837][T20065] pim6reg: left allmulticast mode [ 391.787141][T20072] __nla_validate_parse: 14 callbacks suppressed [ 391.787160][T20072] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4200'. [ 391.803288][T20072] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4200'. [ 391.812345][T20072] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4200'. [ 391.939401][T20083] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4204'. [ 391.970151][T20088] xt_cgroup: xt_cgroup: no path or classid specified [ 391.988615][T20088] netlink: 228 bytes leftover after parsing attributes in process `syz.0.4206'. [ 392.016550][T20089] xt_cgroup: xt_cgroup: no path or classid specified [ 392.028862][T20088] netlink: 228 bytes leftover after parsing attributes in process `syz.0.4206'. [ 392.063299][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.178628][T20101] sctp: [Deprecated]: syz.0.4210 (pid 20101) Use of struct sctp_assoc_value in delayed_ack socket option. [ 392.178628][T20101] Use struct sctp_sack_info instead [ 392.218535][T20106] netlink: 'syz.3.4212': attribute type 13 has an invalid length. [ 392.227999][T20106] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4212'. [ 392.280313][T20106] netlink: 'syz.3.4212': attribute type 13 has an invalid length. [ 392.288366][T20106] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4212'. [ 392.309759][T20108] bond8: entered promiscuous mode [ 392.316565][T20108] bond8: entered allmulticast mode [ 392.326217][T20108] 8021q: adding VLAN 0 to HW filter on device bond8 [ 392.334806][ T6043] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 392.344025][ T6043] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 392.369582][T20114] macsec2: entered promiscuous mode [ 392.421507][ T6043] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 392.444495][T20117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4216'. [ 392.462094][ T1319] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 392.696349][T20137] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4223'. [ 392.749014][T20131] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.763380][T20131] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.829111][T20137] geneve2: entered promiscuous mode [ 392.964346][T20131] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.986099][T20131] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.052980][T20157] netlink: 'syz.1.4228': attribute type 3 has an invalid length. [ 393.215530][T20131] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 393.259584][T20131] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.392338][T20131] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 393.409339][T20131] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.611084][T16031] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.622754][T16031] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.706074][T16031] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.717167][T16031] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.006608][T20220] netlink: 'syz.2.4248': attribute type 21 has an invalid length. [ 394.226952][T20204] wg1: left promiscuous mode [ 394.237322][T20204] wg1: left allmulticast mode [ 394.617849][T20204] geneve2: left promiscuous mode [ 394.630886][T20204] geneve2: left allmulticast mode [ 394.645170][T20204] geneve3: left promiscuous mode [ 394.650399][T20204] geneve3: left allmulticast mode [ 394.665607][T20204] bridge1: left promiscuous mode [ 394.670682][T20204] bridge1: left allmulticast mode [ 394.680438][T20204] ip6gre1: left promiscuous mode [ 394.734918][T20204] hsr1: left promiscuous mode [ 394.749515][T20204] bridge6: left promiscuous mode [ 394.758852][T20204] bridge6: left allmulticast mode [ 394.771900][T20204] bond4: left promiscuous mode [ 394.788401][T20204] bridge7: left promiscuous mode [ 394.793501][T20204] bridge7: left allmulticast mode [ 394.816673][T13323] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 394.832952][T13323] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 394.842060][T13323] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 19999 - 0 [ 394.852538][T20218] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 394.904181][T13323] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 394.925700][T13323] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 394.950447][T20233] sctp: [Deprecated]: syz.2.4252 (pid 20233) Use of struct sctp_assoc_value in delayed_ack socket option. [ 394.950447][T20233] Use struct sctp_sack_info instead [ 394.973484][T13323] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 19999 - 0 [ 395.009102][T13323] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 395.029308][T13323] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.049386][T13323] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 19999 - 0 [ 395.073734][T13323] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 395.084119][T13323] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.099692][T13323] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 19999 - 0 [ 395.109384][T13323] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 395.118686][T13323] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 395.127739][T13323] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 395.138230][T13323] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.664767][ T107] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.263557][ T107] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.863741][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.078837][T20315] __nla_validate_parse: 7 callbacks suppressed [ 427.078854][T20315] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4280'. [ 427.131414][T20323] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 427.164113][T20323] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4279'. [ 427.164727][T20324] dvmrp0: entered allmulticast mode [ 427.190143][T20323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4279'. [ 427.229215][T20332] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.4283'. [ 427.230716][T20331] tipc: Resetting bearer [ 427.239751][T20332] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4283'. [ 427.323874][T20328] tipc: Resetting bearer [ 427.458703][T20351] netlink: 'syz.4.4286': attribute type 1 has an invalid length. [ 427.520678][T20351] 8021q: adding VLAN 0 to HW filter on device bond9 [ 427.631042][T20364] bond9: (slave geneve3): making interface the new active one [ 427.708788][T20364] bond9: (slave geneve3): Enslaving as an active interface with an up link [ 427.816408][T20376] batadv0: mtu less than device minimum [ 427.832439][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.844550][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.856310][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.868005][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.879615][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.890999][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.901946][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.913544][T20376] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 427.964761][T20378] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4296'. [ 428.087984][T20389] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4298'. [ 428.260702][T20405] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4302'. [ 428.361670][ T5961] tipc: Resetting bearer [ 428.379408][T20405] bond0: entered promiscuous mode [ 428.389198][T20405] ip6gretap0: entered promiscuous mode [ 428.397480][T20405] debugfs: 'hsr0' already exists in 'hsr' [ 428.403340][T20405] Cannot create hsr debugfs directory [ 428.413417][T20405] hsr0: entered promiscuous mode [ 428.650604][T20427] lo: entered promiscuous mode [ 429.745349][T20475] wg1 speed is unknown, defaulting to 1000 [ 429.772938][T20481] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4329'. [ 429.977069][T20495] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 429.984364][T20495] IPv6: NLM_F_CREATE should be set when creating new route [ 429.991665][T20495] IPv6: NLM_F_CREATE should be set when creating new route [ 430.364286][T20504] syzkaller1: entered promiscuous mode [ 430.379231][T20504] syzkaller1: entered allmulticast mode [ 430.501974][T20529] netlink: 'syz.3.4339': attribute type 1 has an invalid length. [ 430.643702][T20540] netlink: 156 bytes leftover after parsing attributes in process `syz.1.4343'. [ 430.903195][T20557] netlink: 'syz.3.4347': attribute type 8 has an invalid length. [ 431.418052][T20585] netlink: 'syz.2.4357': attribute type 1 has an invalid length. [ 431.515535][T20585] bond3 (unregistering): Released all slaves [ 431.627571][T20595] ip6tnl2: entered promiscuous mode [ 431.642680][T20595] ip6tnl2: entered allmulticast mode [ 431.785766][T20607] team0: Port device dummy0 removed [ 431.792101][T20607] batman_adv: batadv0: Adding interface: dummy0 [ 431.807961][T20607] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 431.863852][T20607] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 431.904911][ T5152] Bluetooth: hci5: command 0x0406 tx timeout [ 431.985754][T20622] tipc: Resetting bearer [ 432.031837][T20622] xt_CT: You must specify a L4 protocol and not use inversions on it [ 432.094746][T20619] tipc: Resetting bearer [ 432.228813][T20634] __nla_validate_parse: 4 callbacks suppressed [ 432.228830][T20634] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4373'. [ 432.257960][T20638] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4375'. [ 432.285404][T20638] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4375'. [ 432.387133][T20638] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4375'. [ 432.399438][T20644] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4377'. [ 432.502226][T20651] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4380'. [ 432.502962][T20653] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4379'. [ 432.524197][T20651] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4380'. [ 432.622911][ T5961] tipc: Resetting bearer [ 432.651213][T20658] netlink: 'syz.3.4382': attribute type 1 has an invalid length. [ 432.714787][T20658] 8021q: adding VLAN 0 to HW filter on device bond1 [ 432.809988][T20668] bond1: (slave veth1): Enslaving as an active interface with a down link [ 432.838839][T20676] net_ratelimit: 15 callbacks suppressed [ 432.838858][T20676] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 432.879234][T20668] bond1: (slave veth0_to_bond): making interface the new active one [ 432.890060][T20668] veth0_to_bond: entered promiscuous mode [ 432.900285][T20668] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 432.959451][T20668] bond1: entered promiscuous mode [ 432.983752][T20668] bond1: entered allmulticast mode [ 432.988965][T20668] veth0_to_bond: entered allmulticast mode [ 433.068039][T20686] tipc: Started in network mode [ 433.076686][T20686] tipc: Node identity e0000001, cluster identity 4711 [ 433.087368][T20686] tipc: Enabling of bearer rejected, failed to enable media [ 433.101025][T20690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4390'. [ 433.255937][T20702] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4394'. [ 433.277740][T20705] rdma_op ffff888051c0f1f0 conn xmit_rdma 0000000000000000 [ 433.419592][T20715] tunl0: entered promiscuous mode [ 433.442426][T20715] netlink: 'syz.1.4400': attribute type 3 has an invalid length. [ 433.492001][T20715] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 433.681033][T20733] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 433.713262][T20738] netlink: 'syz.4.4404': attribute type 1 has an invalid length. [ 434.258565][T20782] netlink: 'syz.2.4420': attribute type 1 has an invalid length. [ 434.291266][T20782] 8021q: adding VLAN 0 to HW filter on device bond3 [ 434.368770][T20784] bond3: entered promiscuous mode [ 434.373996][T20784] bond3: entered allmulticast mode [ 434.668487][T20814] set match dimension is over the limit! [ 434.702332][T20821] geneve4: entered promiscuous mode [ 434.795493][T20827] geneve4: entered promiscuous mode [ 434.864641][T20831] tipc: Resetting bearer [ 434.880497][T20829] tipc: Resetting bearer [ 435.063498][T20847] netlink: 'syz.3.4440': attribute type 1 has an invalid length. [ 435.140980][T20847] 8021q: adding VLAN 0 to HW filter on device bond2 [ 435.148714][T20841] tipc: Enabling of bearer rejected, failed to enable media [ 435.237316][T20847] bond2: (slave geneve3): making interface the new active one [ 435.249837][T20847] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 435.394974][T20868] netlink: 'syz.0.4448': attribute type 21 has an invalid length. [ 435.477383][T20868] bond5: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 435.495910][T20868] bond5 (unregistering): Released all slaves [ 435.897659][T16007] tipc: Resetting bearer [ 436.263184][T20930] netlink: 'syz.1.4466': attribute type 9 has an invalid length. [ 436.322191][T20933] tipc: Resetting bearer [ 436.554266][T20951] netlink: 'syz.2.4471': attribute type 1 has an invalid length. [ 436.671513][T20945] bond4 (unregistering): Released all slaves [ 436.723378][T20928] tipc: Resetting bearer [ 436.829914][ T4536] tipc: Resetting bearer [ 436.956448][T20970] vlan1: entered allmulticast mode [ 437.023363][ T5152] Bluetooth: hci2: command 0x0406 tx timeout [ 437.270656][T20999] sctp: [Deprecated]: syz.3.4488 (pid 20999) Use of int in max_burst socket option. [ 437.270656][T20999] Use struct sctp_assoc_value instead [ 437.305663][T20989] __nla_validate_parse: 15 callbacks suppressed [ 437.305683][T20989] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4483'. [ 437.361861][T21005] netlink: 'syz.2.4489': attribute type 2 has an invalid length. [ 437.403260][T21007] tipc: Resetting bearer [ 437.434551][T21004] tipc: Resetting bearer [ 437.834105][T16031] tipc: Resetting bearer [ 437.873512][T21023] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4495'. [ 438.099861][T21035] netlink: 'syz.4.4497': attribute type 17 has an invalid length. [ 438.125108][T21035] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4497'. [ 438.149756][T21035] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4497'. [ 438.209442][T21035] gretap0: entered promiscuous mode [ 438.246162][T21035] gretap0: left promiscuous mode [ 438.281204][T21038] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.317299][T21038] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.351197][T21041] netlink: 11 bytes leftover after parsing attributes in process `syz.1.4501'. [ 438.375611][T21041] netlink: 11 bytes leftover after parsing attributes in process `syz.1.4501'. [ 438.394901][T21041] netlink: 11 bytes leftover after parsing attributes in process `syz.1.4501'. [ 438.407422][T21041] netlink: 11 bytes leftover after parsing attributes in process `syz.1.4501'. [ 438.429649][T21054] x_tables: duplicate underflow at hook 1 [ 438.495712][T21055] sit1: entered promiscuous mode [ 438.520068][T21055] sit1: entered allmulticast mode [ 438.557343][T21059] netlink: 404 bytes leftover after parsing attributes in process `syz.4.4505'. [ 438.586220][T21059] netlink: 404 bytes leftover after parsing attributes in process `syz.4.4505'. [ 439.541231][T21115] sctp: [Deprecated]: syz.4.4522 (pid 21115) Use of struct sctp_assoc_value in delayed_ack socket option. [ 439.541231][T21115] Use struct sctp_sack_info instead [ 439.669534][T21123] netlink: 'syz.1.4525': attribute type 83 has an invalid length. [ 439.693415][T21119] netlink: 'syz.4.4524': attribute type 4 has an invalid length. [ 439.845591][T21137] tipc: Resetting bearer [ 439.903249][T21137] dvmrp6: entered allmulticast mode [ 439.933039][T21133] tipc: Resetting bearer [ 440.074807][ T1303] lec:lec_start_xmit: lec0:No lecd attached [ 440.082467][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 440.107868][T21146] netlink: 'syz.0.4532': attribute type 12 has an invalid length. [ 440.187657][T21148] delete_channel: no stack [ 440.335563][T21155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 440.465808][T21155] syzkaller0: entered promiscuous mode [ 440.473190][T21155] syzkaller0: entered allmulticast mode [ 440.516305][T19866] batadv1: left allmulticast mode [ 440.521742][T19866] batadv1: left promiscuous mode [ 440.538954][T19866] bridge0: port 1(batadv1) entered disabled state [ 441.002236][T19866] bond5 (unregistering): (slave gretap1): Releasing active interface [ 441.113708][T19866] dvmrp0 (unregistering): left allmulticast mode [ 441.144635][T19866] bond8 (unregistering): (slave geneve2): Releasing active interface [ 441.498136][T19866] bond1 (unregistering): Released all slaves [ 441.521855][T19866] bond0 (unregistering): Released all slaves [ 441.548099][T19866] bond2 (unregistering): Released all slaves [ 441.569970][T19866] bond3 (unregistering): Released all slaves [ 441.682436][T19866] bond4 (unregistering): Released all slaves [ 441.695826][T19866] bond5 (unregistering): Released all slaves [ 441.795620][T19866] bond6 (unregistering): Released all slaves [ 441.888761][T19866] bond7 (unregistering): Released all slaves [ 441.986898][T19866] bond8 (unregistering): Released all slaves [ 442.088901][T19866] bond9 (unregistering): Released all slaves [ 442.101429][T19866] bond10 (unregistering): Released all slaves [ 442.149126][ T5152] Bluetooth: hci4: command 0x0406 tx timeout [ 442.277388][T19866] bond4 (unregistering): (slave gretap3): Releasing active interface [ 442.805927][T19866] bond0 (unregistering): left promiscuous mode [ 442.820136][T19866] bond6 (unregistering): (slave macvlan0): Releasing backup interface [ 442.842016][T19866] bond0 (unregistering): Released all slaves [ 442.878791][T19866] bond1 (unregistering): Released all slaves [ 442.899677][T19866] bond2 (unregistering): Released all slaves [ 442.912485][T19866] bond3 (unregistering): Released all slaves [ 442.927744][T19866] bond4 (unregistering): Released all slaves [ 443.027328][T19866] bond5 (unregistering): (slave veth7): Releasing active interface [ 443.036846][T19866] bond5 (unregistering): Released all slaves [ 443.128622][T19866] bond6 (unregistering): Released all slaves [ 443.140594][T21165] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 443.152512][ T5961] tipc: Resetting bearer [ 444.685939][T21211] º: renamed from veth1_vlan (while UP) [ 444.693408][T19866] 9: left promiscuous mode [ 444.786103][T21222] netlink: 'syz.0.4555': attribute type 13 has an invalid length. [ 444.795431][T21222] gretap0: refused to change device tx_queue_len [ 444.804271][T21222] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 444.853216][T19866] tipc: Disabling bearer [ 444.908207][T19866] tipc: Left network mode [ 444.928254][T19866] tipc: Disabling bearer [ 444.953070][T19866] tipc: Left network mode [ 445.023239][T21238] netlink: 'syz.1.4562': attribute type 9 has an invalid length. [ 445.068514][T21241] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 445.082684][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 445.091767][ C1] lec:lec_tx_timeout: lec0 [ 445.379717][T21263] __nla_validate_parse: 49 callbacks suppressed [ 445.379733][T21263] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4568'. [ 445.578397][T21269] sctp: [Deprecated]: syz.0.4570 (pid 21269) Use of struct sctp_assoc_value in delayed_ack socket option. [ 445.578397][T21269] Use struct sctp_sack_info instead [ 445.613287][T21269] sctp: [Deprecated]: syz.0.4570 (pid 21269) Use of struct sctp_assoc_value in delayed_ack socket option. [ 445.613287][T21269] Use struct sctp_sack_info instead [ 445.649975][T21269] bridge9: entered promiscuous mode [ 445.656130][T21269] bridge9: entered allmulticast mode [ 445.905859][T19866] hsr_slave_0: left promiscuous mode [ 445.915896][T19866] hsr_slave_1: left promiscuous mode [ 445.944092][T19866] veth0_macvtap: left allmulticast mode [ 446.007393][T19866] pimreg3 (unregistering): left allmulticast mode [ 446.048829][T21292] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4575'. [ 446.117595][T21298] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 446.124893][T21298] IPv6: NLM_F_CREATE should be set when creating new route [ 446.132158][T21298] IPv6: NLM_F_CREATE should be set when creating new route [ 446.167720][T21300] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4578'. [ 446.198030][T21300] block nbd0: reconnected socket [ 446.213219][T21298] netlink: 288 bytes leftover after parsing attributes in process `syz.2.4575'. [ 446.495148][T21318] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4582'. [ 446.993652][ T5836] block nbd0: Receive control failed (result -32) [ 447.521961][T21309] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.556098][T21309] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.636909][T21309] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.660300][T21309] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.685448][T21330] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4585'. [ 447.749734][T21309] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.778535][T21309] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.856014][T21309] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.867357][T21309] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.001794][ T6043] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.010920][ T6043] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.076080][ T6043] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.086150][ T6043] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.115093][ T6043] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.123880][ T6043] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.132561][T21344] tipc: Enabled bearer , priority 0 [ 448.154142][ T6043] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.163226][ T6043] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.202516][T21344] syzkaller0: entered promiscuous mode [ 448.208848][T21344] syzkaller0: entered allmulticast mode [ 448.217565][T21344] tipc: Resetting bearer [ 448.245242][T21343] tipc: Resetting bearer [ 449.667943][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.949798][T21391] netlink: 'syz.4.4598': attribute type 1 has an invalid length. [ 449.958634][T21391] netlink: 212 bytes leftover after parsing attributes in process `syz.4.4598'. [ 450.212411][T21343] tipc: Disabling bearer [ 450.242281][T21363] tipc: Resetting bearer [ 450.253369][T21365] syzkaller0: left promiscuous mode [ 450.269286][T21365] syzkaller0: left allmulticast mode [ 450.284194][T21365] tipc: Resetting bearer [ 450.300478][ T5965] tipc: Node number set to 3758096385 [ 450.315337][T21394] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.323284][T21394] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.363257][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.376462][T21363] tipc: Resetting bearer [ 450.389724][ T49] tipc: Resetting bearer [ 450.566949][T21410] FAULT_INJECTION: forcing a failure. [ 450.566949][T21410] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 450.601658][T21404] tap0: tun_chr_ioctl cmd 1074025676 [ 450.609294][T21404] tap0: owner set to 0 [ 450.620253][T21404] netlink: 'syz.3.4603': attribute type 32 has an invalid length. [ 450.633976][T21404] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4603'. [ 450.639198][T21410] CPU: 1 UID: 0 PID: 21410 Comm: syz.2.4605 Not tainted syzkaller #0 PREEMPT(full) [ 450.639225][T21410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 450.639239][T21410] Call Trace: [ 450.639250][T21410] [ 450.639258][T21410] dump_stack_lvl+0x189/0x250 [ 450.639283][T21410] ? __pfx____ratelimit+0x10/0x10 [ 450.639304][T21410] ? __pfx_dump_stack_lvl+0x10/0x10 [ 450.639322][T21410] ? __pfx__printk+0x10/0x10 [ 450.639344][T21410] ? __might_fault+0xb0/0x130 [ 450.639374][T21410] should_fail_ex+0x414/0x560 [ 450.639399][T21410] _copy_from_iter+0x1cd/0x1630 [ 450.639423][T21410] ? __build_skb_around+0x22d/0x3c0 [ 450.639451][T21410] ? __pfx__copy_from_iter+0x10/0x10 [ 450.639468][T21410] ? __alloc_skb+0x2f1/0x430 [ 450.639492][T21410] ? __pfx___alloc_skb+0x10/0x10 [ 450.639515][T21410] ? netlink_sendmsg+0x642/0xb30 [ 450.639531][T21410] ? skb_put+0x11b/0x210 [ 450.639555][T21410] netlink_sendmsg+0x6b2/0xb30 [ 450.639580][T21410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 450.639601][T21410] ? aa_sock_msg_perm+0xf1/0x1b0 [ 450.639618][T21410] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 450.639637][T21410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 450.639653][T21410] __sock_sendmsg+0x21c/0x270 [ 450.639674][T21410] ____sys_sendmsg+0x505/0x820 [ 450.639706][T21410] ? __pfx_____sys_sendmsg+0x10/0x10 [ 450.639738][T21410] ? import_iovec+0x74/0xa0 [ 450.639763][T21410] ___sys_sendmsg+0x21f/0x2a0 [ 450.639789][T21410] ? __pfx____sys_sendmsg+0x10/0x10 [ 450.639819][T21410] ? rcu_read_lock_any_held+0xb3/0x120 [ 450.639864][T21410] ? __fget_files+0x2a/0x420 [ 450.639879][T21410] ? __fget_files+0x3a0/0x420 [ 450.639904][T21410] __x64_sys_sendmsg+0x19b/0x260 [ 450.639930][T21410] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 450.639963][T21410] ? __pfx_ksys_write+0x10/0x10 [ 450.639993][T21410] ? do_syscall_64+0xbe/0xf80 [ 450.640017][T21410] do_syscall_64+0xfa/0xf80 [ 450.640039][T21410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.640055][T21410] ? clear_bhb_loop+0x60/0xb0 [ 450.640075][T21410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.640091][T21410] RIP: 0033:0x7f771218f749 [ 450.640106][T21410] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 450.640120][T21410] RSP: 002b:00007f7712f7a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 450.640139][T21410] RAX: ffffffffffffffda RBX: 00007f77123e5fa0 RCX: 00007f771218f749 [ 450.640151][T21410] RDX: 0000000020040810 RSI: 0000200000000100 RDI: 0000000000000003 [ 450.640161][T21410] RBP: 00007f7712f7a090 R08: 0000000000000000 R09: 0000000000000000 [ 450.640172][T21410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 450.640181][T21410] R13: 00007f77123e6038 R14: 00007f77123e5fa0 R15: 00007ffcb2fcb1b8 [ 450.640205][T21410] [ 450.670735][T21407] mac80211_hwsim hwsim29 ÿ: renamed from wlan1 (while UP) [ 450.672673][T19866] IPVS: stop unused estimator thread 0... [ 450.726566][T21412] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4604'. [ 450.943627][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.970997][T19866] IPVS: stop unused estimator thread 0... [ 451.027702][T21424] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4608'. [ 451.100328][T21404] bond3: option coupled_control: invalid value (52) [ 451.185009][T21404] bond3 (unregistering): Released all slaves [ 451.312364][T21436] netlink: 'syz.4.4609': attribute type 7 has an invalid length. [ 451.321107][T21422] veth0_to_bond: entered allmulticast mode [ 451.403169][T21436] netlink: 'syz.4.4609': attribute type 7 has an invalid length. [ 451.439599][ T1159] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.460708][ T1159] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.483130][ T1159] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.496737][ T1159] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.571651][T21442] netlink: 116 bytes leftover after parsing attributes in process `syz.0.4611'. [ 451.625832][T21444] team0: No ports can be present during mode change [ 451.789398][T21457] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (0); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 451.839292][T21457] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (0); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 451.895407][T21457] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (0); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 451.939307][T21470] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4617'. [ 451.948732][T21457] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (0); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 451.963590][T21457] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (0); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 451.978395][T21457] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (0); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 451.993858][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.993868][T21457] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (0); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 452.211756][T21489] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4626'. [ 452.278047][T21492] netlink: 'syz.4.4628': attribute type 1 has an invalid length. [ 452.493578][T21505] netlink: 'syz.0.4632': attribute type 10 has an invalid length. [ 452.502064][T21505] bridge0: port 1(team0) entered blocking state [ 452.522365][T21505] bridge0: port 1(team0) entered disabled state [ 452.542408][T21505] team0: entered allmulticast mode [ 452.612526][T21510] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4634'. [ 452.680617][T21518] netlink: 'syz.1.4636': attribute type 3 has an invalid length. [ 452.795432][T21521] tunl0: entered promiscuous mode [ 452.819223][T21521] netlink: 'syz.4.4638': attribute type 3 has an invalid length. [ 452.827369][T21526] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4640'. [ 452.827393][T21521] netlink: 9 bytes leftover after parsing attributes in process `syz.4.4638'. [ 452.852467][T21523] FAULT_INJECTION: forcing a failure. [ 452.852467][T21523] name failslab, interval 1, probability 0, space 0, times 0 [ 452.870888][T21523] CPU: 0 UID: 0 PID: 21523 Comm: syz.3.4639 Not tainted syzkaller #0 PREEMPT(full) [ 452.870912][T21523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 452.870921][T21523] Call Trace: [ 452.870928][T21523] [ 452.870936][T21523] dump_stack_lvl+0x189/0x250 [ 452.870958][T21523] ? __pfx____ratelimit+0x10/0x10 [ 452.870979][T21523] ? __pfx_dump_stack_lvl+0x10/0x10 [ 452.870997][T21523] ? __pfx__printk+0x10/0x10 [ 452.871030][T21523] should_fail_ex+0x414/0x560 [ 452.871054][T21523] should_failslab+0xa8/0x100 [ 452.871086][T21523] kmem_cache_alloc_noprof+0x74/0x6f0 [ 452.871106][T21523] ? skb_clone+0x212/0x3a0 [ 452.871128][T21523] skb_clone+0x212/0x3a0 [ 452.871147][T21523] __netlink_deliver_tap+0x404/0x850 [ 452.871174][T21523] ? netlink_deliver_tap+0x2e/0x1b0 [ 452.871190][T21523] netlink_deliver_tap+0x19c/0x1b0 [ 452.871208][T21523] netlink_sendskb+0x68/0x140 [ 452.871233][T21523] netlink_unicast+0x397/0x9e0 [ 452.871253][T21523] ? __asan_memcpy+0x40/0x70 [ 452.871276][T21523] ? __pfx_netlink_unicast+0x10/0x10 [ 452.871307][T21523] netlink_rcv_skb+0x28c/0x470 [ 452.871324][T21523] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 452.871347][T21523] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 452.871372][T21523] ? netlink_deliver_tap+0x2e/0x1b0 [ 452.871396][T21523] netlink_unicast+0x82f/0x9e0 [ 452.871426][T21523] ? __pfx_netlink_unicast+0x10/0x10 [ 452.871449][T21523] ? netlink_sendmsg+0x642/0xb30 [ 452.871462][T21523] ? skb_put+0x11b/0x210 [ 452.871485][T21523] netlink_sendmsg+0x805/0xb30 [ 452.871508][T21523] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.871527][T21523] ? aa_sock_msg_perm+0xf1/0x1b0 [ 452.871550][T21523] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 452.871570][T21523] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.871588][T21523] __sock_sendmsg+0x21c/0x270 [ 452.871610][T21523] ____sys_sendmsg+0x505/0x820 [ 452.871638][T21523] ? __pfx_____sys_sendmsg+0x10/0x10 [ 452.871671][T21523] ? import_iovec+0x74/0xa0 [ 452.871696][T21523] ___sys_sendmsg+0x21f/0x2a0 [ 452.871722][T21523] ? __pfx____sys_sendmsg+0x10/0x10 [ 452.871752][T21523] ? rcu_read_lock_any_held+0xb3/0x120 [ 452.871804][T21523] ? __fget_files+0x2a/0x420 [ 452.871816][T21523] ? __fget_files+0x3a0/0x420 [ 452.871841][T21523] __x64_sys_sendmsg+0x19b/0x260 [ 452.871866][T21523] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 452.871898][T21523] ? __pfx_ksys_write+0x10/0x10 [ 452.871920][T21523] ? do_syscall_64+0xbe/0xf80 [ 452.871942][T21523] do_syscall_64+0xfa/0xf80 [ 452.871960][T21523] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.871974][T21523] ? clear_bhb_loop+0x60/0xb0 [ 452.871992][T21523] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.872006][T21523] RIP: 0033:0x7f639398f749 [ 452.872019][T21523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 452.872033][T21523] RSP: 002b:00007f63948ab038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 452.872051][T21523] RAX: ffffffffffffffda RBX: 00007f6393be5fa0 RCX: 00007f639398f749 [ 452.872063][T21523] RDX: 0000000020040810 RSI: 0000200000000100 RDI: 0000000000000003 [ 452.872073][T21523] RBP: 00007f63948ab090 R08: 0000000000000000 R09: 0000000000000000 [ 452.872082][T21523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.872092][T21523] R13: 00007f6393be6038 R14: 00007f6393be5fa0 R15: 00007ffdab30fbb8 [ 452.872120][T21523] [ 453.284502][T21536] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4642'. [ 453.527546][T21556] FAULT_INJECTION: forcing a failure. [ 453.527546][T21556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.541089][T21556] CPU: 0 UID: 0 PID: 21556 Comm: syz.2.4648 Not tainted syzkaller #0 PREEMPT(full) [ 453.541115][T21556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 453.541126][T21556] Call Trace: [ 453.541133][T21556] [ 453.541140][T21556] dump_stack_lvl+0x189/0x250 [ 453.541163][T21556] ? __pfx____ratelimit+0x10/0x10 [ 453.541183][T21556] ? __pfx_dump_stack_lvl+0x10/0x10 [ 453.541201][T21556] ? __pfx__printk+0x10/0x10 [ 453.541223][T21556] ? __might_fault+0xb0/0x130 [ 453.541254][T21556] should_fail_ex+0x414/0x560 [ 453.541278][T21556] _copy_from_iter+0x1cd/0x1630 [ 453.541302][T21556] ? __build_skb_around+0x22d/0x3c0 [ 453.541329][T21556] ? __pfx__copy_from_iter+0x10/0x10 [ 453.541344][T21556] ? __alloc_skb+0x2f1/0x430 [ 453.541366][T21556] ? __pfx___alloc_skb+0x10/0x10 [ 453.541389][T21556] ? netlink_sendmsg+0x642/0xb30 [ 453.541404][T21556] ? skb_put+0x11b/0x210 [ 453.541429][T21556] netlink_sendmsg+0x6b2/0xb30 [ 453.541455][T21556] ? __pfx_netlink_sendmsg+0x10/0x10 [ 453.541475][T21556] ? aa_sock_msg_perm+0xf1/0x1b0 [ 453.541502][T21556] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 453.541524][T21556] ? __pfx_netlink_sendmsg+0x10/0x10 [ 453.541542][T21556] __sock_sendmsg+0x21c/0x270 [ 453.541564][T21556] ____sys_sendmsg+0x505/0x820 [ 453.541592][T21556] ? __pfx_____sys_sendmsg+0x10/0x10 [ 453.541624][T21556] ? import_iovec+0x74/0xa0 [ 453.541649][T21556] ___sys_sendmsg+0x21f/0x2a0 [ 453.541674][T21556] ? __pfx____sys_sendmsg+0x10/0x10 [ 453.541704][T21556] ? rcu_read_lock_any_held+0xb3/0x120 [ 453.541747][T21556] ? __fget_files+0x2a/0x420 [ 453.541762][T21556] ? __fget_files+0x3a0/0x420 [ 453.541786][T21556] __x64_sys_sendmsg+0x19b/0x260 [ 453.541811][T21556] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 453.541843][T21556] ? __pfx_ksys_write+0x10/0x10 [ 453.541868][T21556] ? do_syscall_64+0xbe/0xf80 [ 453.541892][T21556] do_syscall_64+0xfa/0xf80 [ 453.541913][T21556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.541928][T21556] ? clear_bhb_loop+0x60/0xb0 [ 453.541946][T21556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.541960][T21556] RIP: 0033:0x7f771218f749 [ 453.541974][T21556] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 453.541986][T21556] RSP: 002b:00007f7712f7a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 453.542001][T21556] RAX: ffffffffffffffda RBX: 00007f77123e5fa0 RCX: 00007f771218f749 [ 453.542011][T21556] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 453.542018][T21556] RBP: 00007f7712f7a090 R08: 0000000000000000 R09: 0000000000000000 [ 453.542026][T21556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 453.542034][T21556] R13: 00007f77123e6038 R14: 00007f77123e5fa0 R15: 00007ffcb2fcb1b8 [ 453.542056][T21556] [ 455.199735][T21559] tipc: Resetting bearer [ 455.219736][T21570] tipc: Enabling of bearer rejected, failed to enable media [ 455.295584][T21566] tipc: Resetting bearer [ 455.389012][T21588] net_ratelimit: 252 callbacks suppressed [ 455.389030][T21588] netlink: ct family unspecified [ 455.428721][T21588] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 455.533216][T21596] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 455.557691][T21605] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 455.751999][T21621] __nla_validate_parse: 3 callbacks suppressed [ 455.752017][T21621] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4660'. [ 455.947130][T21628] xt_cluster: node mask cannot exceed total number of nodes [ 455.957005][T21628] netlink: 136 bytes leftover after parsing attributes in process `syz.3.4667'. [ 456.004319][T21631] netlink: 'syz.3.4668': attribute type 2 has an invalid length. [ 456.181448][T21637] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4671'. [ 456.196325][T21637] tipc: Resetting bearer [ 456.210477][T21636] tipc: Resetting bearer [ 456.224731][ T49] tipc: Resetting bearer [ 456.266935][T21644] netlink: 240 bytes leftover after parsing attributes in process `syz.1.4673'. [ 456.308825][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 456.357888][T21649] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4676'. [ 456.455485][T21654] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4678'. [ 456.469563][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 456.481736][T21656] netlink: 'syz.1.4679': attribute type 7 has an invalid length. [ 456.492764][T21656] netlink: 'syz.1.4679': attribute type 8 has an invalid length. [ 456.510880][T21658] netlink: 'syz.1.4679': attribute type 7 has an invalid length. [ 456.521138][T21658] netlink: 'syz.1.4679': attribute type 8 has an invalid length. [ 456.644522][T21666] netlink: 'syz.3.4681': attribute type 5 has an invalid length. [ 456.670181][T21672] netlink: 176 bytes leftover after parsing attributes in process `syz.4.4684'. [ 456.673075][T21674] netlink: 'syz.2.4683': attribute type 1 has an invalid length. [ 456.826923][T21675] bond4: (slave xfrm1): The slave device specified does not support setting the MAC address [ 456.838257][T21675] bond4: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 456.849962][T21675] bond4: (slave xfrm1): making interface the new active one [ 456.859164][T21675] bond4: (slave xfrm1): Enslaving as an active interface with an up link [ 456.952809][T21693] IPv6: sit1: Disabled Multicast RS [ 456.959073][T21693] sit1: entered allmulticast mode [ 456.962480][T21697] netlink: 'syz.1.4690': attribute type 21 has an invalid length. [ 457.006549][T21697] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4690'. [ 457.030415][T21697] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4690'. [ 457.041701][T21697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4690'. [ 457.349046][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.517667][T21735] FAULT_INJECTION: forcing a failure. [ 457.517667][T21735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 457.532081][T21735] CPU: 0 UID: 0 PID: 21735 Comm: syz.0.4702 Not tainted syzkaller #0 PREEMPT(full) [ 457.532107][T21735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 457.532127][T21735] Call Trace: [ 457.532134][T21735] [ 457.532141][T21735] dump_stack_lvl+0x189/0x250 [ 457.532165][T21735] ? __pfx____ratelimit+0x10/0x10 [ 457.532187][T21735] ? __pfx_dump_stack_lvl+0x10/0x10 [ 457.532204][T21735] ? __pfx__printk+0x10/0x10 [ 457.532226][T21735] ? __might_fault+0xb0/0x130 [ 457.532257][T21735] should_fail_ex+0x414/0x560 [ 457.532282][T21735] _copy_from_user+0x2d/0xb0 [ 457.532305][T21735] kstrtouint_from_user+0xc4/0x170 [ 457.532327][T21735] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 457.532363][T21735] proc_fail_nth_write+0x88/0x200 [ 457.532385][T21735] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 457.532412][T21735] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 457.532434][T21735] vfs_write+0x27e/0xb30 [ 457.532465][T21735] ? __pfx_vfs_write+0x10/0x10 [ 457.532486][T21735] ? __fget_files+0x2a/0x420 [ 457.532506][T21735] ? __fget_files+0x3a0/0x420 [ 457.532520][T21735] ? __fget_files+0x2a/0x420 [ 457.532544][T21735] ksys_write+0x145/0x250 [ 457.532567][T21735] ? __pfx_ksys_write+0x10/0x10 [ 457.532590][T21735] ? do_syscall_64+0xbe/0xf80 [ 457.532616][T21735] do_syscall_64+0xfa/0xf80 [ 457.532635][T21735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.532651][T21735] ? clear_bhb_loop+0x60/0xb0 [ 457.532669][T21735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.532683][T21735] RIP: 0033:0x7fa6f8d8e1ff [ 457.532697][T21735] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 457.532710][T21735] RSP: 002b:00007fa6f9cb1030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 457.532727][T21735] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa6f8d8e1ff [ 457.532738][T21735] RDX: 0000000000000001 RSI: 00007fa6f9cb10a0 RDI: 0000000000000004 [ 457.532749][T21735] RBP: 00007fa6f9cb1090 R08: 0000000000000000 R09: 0000000000000000 [ 457.532758][T21735] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 457.532768][T21735] R13: 00007fa6f8fe6038 R14: 00007fa6f8fe5fa0 R15: 00007ffdc87ef4a8 [ 457.532798][T21735] [ 458.219047][T21749] bridge0: port 3(vlan3) entered blocking state [ 458.226108][T21749] bridge0: port 3(vlan3) entered disabled state [ 458.232554][T21749] vlan3: entered allmulticast mode [ 458.333389][T21749] vlan3: left allmulticast mode [ 458.400439][T21750] bridge0: port 3(vlan3) entered blocking state [ 458.408261][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.408345][T21750] bridge0: port 3(vlan3) entered disabled state [ 458.423572][T21750] vlan3: entered allmulticast mode [ 458.484164][T21750] vlan3: left allmulticast mode [ 458.885127][T21771] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 459.103468][T21790] netem: invalid attributes len -24 [ 459.112689][T21790] netem: change failed [ 459.225233][T21796] netlink: 'syz.1.4716': attribute type 10 has an invalid length. [ 459.261144][T21796] team0: Port device dummy0 added [ 459.304817][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.370419][T21802] bridge0: port 3(ipvlan2) entered blocking state [ 459.377883][T21802] bridge0: port 3(ipvlan2) entered disabled state [ 459.386550][T21802] ipvlan2: entered allmulticast mode [ 459.393719][T21805] netlink: 'syz.4.4719': attribute type 8 has an invalid length. [ 459.394566][T21802] ipvlan2: left allmulticast mode [ 459.431528][ T107] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.895980][T21830] tipc: Resetting bearer [ 459.936329][T21829] tipc: Resetting bearer [ 460.469826][ T107] net_ratelimit: 3 callbacks suppressed [ 460.469845][ T107] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.625361][ T49] tipc: Resetting bearer [ 460.778320][T21898] bond0: entered promiscuous mode [ 460.791451][T21898] bond_slave_0: entered promiscuous mode [ 460.811952][T21898] bond_slave_1: entered promiscuous mode [ 460.823978][T21898] dummy0: entered promiscuous mode [ 460.841005][T21898] bond0: left promiscuous mode [ 460.857169][T21898] bond_slave_0: left promiscuous mode [ 460.880930][T21898] bond_slave_1: left promiscuous mode [ 460.886964][T21898] dummy0: left promiscuous mode [ 460.948551][T21904] syzkaller1: entered promiscuous mode [ 460.962760][T21904] syzkaller1: entered allmulticast mode [ 461.113228][T21918] __nla_validate_parse: 24 callbacks suppressed [ 461.113250][T21918] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4759'. [ 461.139449][T21920] validate_nla: 1 callbacks suppressed [ 461.139468][T21920] netlink: 'syz.1.4760': attribute type 33 has an invalid length. [ 461.198612][T21920] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4760'. [ 461.354657][T21921] tipc: Started in network mode [ 461.379845][T21921] tipc: Node identity 4e9d6afb47be, cluster identity 4711 [ 461.414080][T21921] tipc: Enabled bearer , priority 0 [ 461.433025][T21923] syzkaller0: entered promiscuous mode [ 461.438890][T21923] syzkaller0: entered allmulticast mode [ 461.465557][T21921] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 461.509056][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.520408][T21939] netlink: 87 bytes leftover after parsing attributes in process `syz.3.4764'. [ 461.537009][T21921] tipc: Resetting bearer [ 461.549801][T21921] netlink: 'syz.4.4758': attribute type 19 has an invalid length. [ 461.557911][T21921] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4758'. [ 461.567393][T21921] netlink: 'syz.4.4758': attribute type 19 has an invalid length. [ 461.585351][T21921] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4758'. [ 461.595952][T21943] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4765'. [ 461.615218][T21916] tipc: Resetting bearer [ 461.655481][T21916] tipc: Disabling bearer [ 461.676872][T21943] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4765'. [ 461.702058][T21949] syzkaller0: entered promiscuous mode [ 461.708170][T21949] syzkaller0: entered allmulticast mode [ 461.809377][T21952] netlink: 'syz.4.4769': attribute type 10 has an invalid length. [ 461.853453][T21950] bond3: Unable to set peer notification delay as MII monitoring is disabled [ 461.863722][T21958] netlink: 'syz.4.4769': attribute type 4 has an invalid length. [ 461.881875][T21958] netlink: 17 bytes leftover after parsing attributes in process `syz.4.4769'. [ 461.899379][T21950] bond3 (unregistering): Released all slaves [ 461.964404][T21964] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4772'. [ 462.231164][T21969] x_tables: unsorted entry at hook 2 [ 462.347792][T21977] bond3 (unregistering): Released all slaves [ 462.543183][ T5906] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.551362][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.637430][T21996] openvswitch: netlink: Actions may not be safe on all matching packets [ 462.745670][T22001] netlink: 'syz.3.4781': attribute type 2 has an invalid length. [ 462.769018][T22001] netlink: 244 bytes leftover after parsing attributes in process `syz.3.4781'. [ 463.594656][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.748473][ T9] IPVS: starting estimator thread 0... [ 463.757597][T22030] IPVS: set_ctl: invalid protocol: 137 172.20.20.187:20004 [ 463.849111][T22037] team0: mtu less than device minimum [ 463.863218][T22031] IPVS: using max 28 ests per chain, 67200 per kthread [ 464.651272][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.584027][ T5906] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.672249][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.817860][T22132] syzkaller0: entered promiscuous mode [ 465.828548][T22132] syzkaller0: entered allmulticast mode [ 465.842181][T22132] tipc: Resetting bearer [ 466.041050][T22142] netlink: 'syz.4.4829': attribute type 1 has an invalid length. [ 466.556665][T22170] netlink: 'syz.2.4838': attribute type 4 has an invalid length. [ 466.661862][T22179] __nla_validate_parse: 16 callbacks suppressed [ 466.661880][T22179] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4843'. [ 466.732306][T22188] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4842'. [ 466.748252][T22180] sctp: [Deprecated]: syz.0.4843 (pid 22180) Use of int in max_burst socket option. [ 466.748252][T22180] Use struct sctp_assoc_value instead [ 466.954363][T22200] Unsupported ieee802154 address type: 0 [ 466.970600][T22205] Unsupported ieee802154 address type: 0 [ 467.443889][T22241] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4859'. [ 467.934749][T22269] netlink: 112 bytes leftover after parsing attributes in process `syz.0.4868'. [ 468.031598][T22280] nbd: must specify a device to reconfigure [ 468.039421][T22278] x_tables: duplicate underflow at hook 1 [ 468.076314][T22284] netlink: 'syz.4.4873': attribute type 39 has an invalid length. [ 468.144592][T22280] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4872'. [ 468.233785][T22294] netlink: 'syz.3.4876': attribute type 21 has an invalid length. [ 468.241722][T22294] netlink: 128 bytes leftover after parsing attributes in process `syz.3.4876'. [ 468.252547][T22294] netlink: 3 bytes leftover after parsing attributes in process `syz.3.4876'. [ 468.488772][T22308] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4881'. [ 468.645740][T22315] vlan3: entered promiscuous mode [ 468.651367][T22315] bridge0: entered promiscuous mode [ 468.671736][T22314] syzkaller0: entered promiscuous mode [ 468.677438][T22314] syzkaller0: entered allmulticast mode [ 468.693739][T22318] syzkaller0: entered promiscuous mode [ 468.710047][T22318] syzkaller0: entered allmulticast mode [ 468.863522][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.916275][T22332] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4890'. [ 468.959425][T22338] FAULT_INJECTION: forcing a failure. [ 468.959425][T22338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 468.974068][T22338] CPU: 1 UID: 0 PID: 22338 Comm: syz.0.4891 Not tainted syzkaller #0 PREEMPT(full) [ 468.974085][T22338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 468.974091][T22338] Call Trace: [ 468.974096][T22338] [ 468.974101][T22338] dump_stack_lvl+0x189/0x250 [ 468.974117][T22338] ? __pfx____ratelimit+0x10/0x10 [ 468.974130][T22338] ? __pfx_dump_stack_lvl+0x10/0x10 [ 468.974140][T22338] ? __pfx__printk+0x10/0x10 [ 468.974153][T22338] ? __might_fault+0xb0/0x130 [ 468.974173][T22338] should_fail_ex+0x414/0x560 [ 468.974187][T22338] _copy_from_user+0x2d/0xb0 [ 468.974200][T22338] ___sys_sendmsg+0x158/0x2a0 [ 468.974231][T22338] ? __pfx____sys_sendmsg+0x10/0x10 [ 468.974258][T22338] ? rcu_read_lock_any_held+0xb3/0x120 [ 468.974297][T22338] ? __fget_files+0x2a/0x420 [ 468.974306][T22338] ? __fget_files+0x3a0/0x420 [ 468.974320][T22338] __x64_sys_sendmsg+0x19b/0x260 [ 468.974335][T22338] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 468.974354][T22338] ? __pfx_ksys_write+0x10/0x10 [ 468.974369][T22338] ? do_syscall_64+0xbe/0xf80 [ 468.974383][T22338] do_syscall_64+0xfa/0xf80 [ 468.974396][T22338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.974405][T22338] ? clear_bhb_loop+0x60/0xb0 [ 468.974416][T22338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.974425][T22338] RIP: 0033:0x7fa6f8d8f749 [ 468.974434][T22338] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 468.974442][T22338] RSP: 002b:00007fa6f9cb1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 468.974453][T22338] RAX: ffffffffffffffda RBX: 00007fa6f8fe5fa0 RCX: 00007fa6f8d8f749 [ 468.974460][T22338] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 468.974466][T22338] RBP: 00007fa6f9cb1090 R08: 0000000000000000 R09: 0000000000000000 [ 468.974472][T22338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 468.974477][T22338] R13: 00007fa6f8fe6038 R14: 00007fa6f8fe5fa0 R15: 00007ffdc87ef4a8 [ 468.974493][T22338] [ 469.269871][T22345] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4895'. [ 469.394728][T22346] netlink: 'syz.0.4895': attribute type 10 has an invalid length. [ 469.420676][T22344] team0: Port device team_slave_0 removed [ 469.717667][T22367] netlink: 'syz.2.4902': attribute type 1 has an invalid length. [ 469.742750][ T5152] Bluetooth: hci1: command 0x0405 tx timeout [ 469.862448][T22367] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 469.863638][T22385] tipc: Resetting bearer [ 469.882476][T22385] syzkaller0: left promiscuous mode [ 469.892131][T22385] syzkaller0: left allmulticast mode [ 470.007872][T22385] tipc: Resetting bearer [ 470.077111][T22401] bond5: (slave bridge5): Enslaving as an active interface with an up link [ 470.113414][T22400] bond6: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 470.161219][T22400] bond6 (unregistering): Released all slaves [ 470.454866][T19866] tipc: Resetting bearer [ 478.463193][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.063725][ T5966] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.664261][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.517372][ T1303] lec:lec_start_xmit: lec0:No lecd attached [ 502.406477][T22435] netlink: 'syz.0.4919': attribute type 4 has an invalid length. [ 502.576030][T22451] __nla_validate_parse: 5 callbacks suppressed [ 502.576048][T22451] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4923'. [ 502.911327][T22469] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4928'. [ 502.911543][T22471] netlink: 'syz.0.4929': attribute type 12 has an invalid length. [ 502.926485][T22469] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4928'. [ 502.930673][T22471] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4929'. [ 502.939956][T22469] netlink: 31 bytes leftover after parsing attributes in process `syz.3.4928'. [ 502.956450][T22469] netlink: 'syz.3.4928': attribute type 3 has an invalid length. [ 502.966132][T22469] netlink: 'syz.3.4928': attribute type 2 has an invalid length. [ 502.974340][T22469] netlink: 31 bytes leftover after parsing attributes in process `syz.3.4928'. [ 503.032362][T22476] netlink: 'syz.0.4931': attribute type 1 has an invalid length. [ 503.064902][T22476] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 503.151193][T22478] netlink: 356 bytes leftover after parsing attributes in process `syz.3.4932'. [ 503.281491][T22496] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 503.338633][T22500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4939'. [ 503.349316][T22500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4939'. [ 503.349454][T22501] netlink: 'syz.3.4938': attribute type 1 has an invalid length. [ 503.361880][T22500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4939'. [ 503.421958][T22502] macvlan2: entered promiscuous mode [ 503.473510][T22502] macvlan2: entered allmulticast mode [ 503.481017][T22502] bond3: entered promiscuous mode [ 503.489772][T22502] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 503.502010][T22502] bond3: left promiscuous mode [ 503.541303][T22518] netlink: 'syz.2.4943': attribute type 3 has an invalid length. [ 503.554765][T22511] macvtap1: entered promiscuous mode [ 503.560087][T22511] vlan0: entered promiscuous mode [ 503.565457][T22511] macvtap1: entered allmulticast mode [ 503.570845][T22511] vlan0: entered allmulticast mode [ 503.576047][T22511] veth0_vlan: entered allmulticast mode [ 503.653753][T22521] team0: Cannot enslave team device to itself [ 503.970195][T22540] wg1 speed is unknown, defaulting to 1000 [ 504.089118][T22551] IPVS: sync thread started: state = BACKUP, mcast_ifn = tunl0, syncid = 2, id = 0 [ 504.101093][T22549] sctp: [Deprecated]: syz.0.4955 (pid 22549) Use of struct sctp_assoc_value in delayed_ack socket option. [ 504.101093][T22549] Use struct sctp_sack_info instead [ 504.217623][T22558] netlink: 'syz.2.4959': attribute type 1 has an invalid length. [ 504.518549][T22576] netlink: 'syz.0.4964': attribute type 1 has an invalid length. [ 504.549019][T22577] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 504.561501][T22576] netlink: 'syz.0.4964': attribute type 4 has an invalid length. [ 504.809571][T22586] bridge14: entered allmulticast mode [ 504.869572][T22593] ip6gre2: entered promiscuous mode [ 505.348484][T22624] 8021q: adding VLAN 0 to HW filter on device bond5 [ 505.372536][T22624] bond5: (slave veth5): Enslaving as an active interface with a down link [ 505.381297][T22625] veth0_to_bond: left allmulticast mode [ 505.390808][T22625] bond5: (slave veth0_to_bond): making interface the new active one [ 505.400259][T22625] veth0_to_bond: entered promiscuous mode [ 505.406369][T22625] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 505.458867][T22629] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 505.963297][T22654] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 506.193322][T22670] netem: incorrect ge model size [ 506.199248][T22670] netem: change failed [ 506.266410][T22676] syzkaller0: entered promiscuous mode [ 506.272148][T22676] syzkaller0: entered allmulticast mode [ 506.281185][T22676] tipc: Enabled bearer , priority 0 [ 506.863933][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5340 ms [ 506.871966][ C1] lec:lec_tx_timeout: lec0 [ 507.172292][T22676] tipc: Resetting bearer [ 507.246893][T22676] tipc: Disabling bearer [ 507.270059][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.566493][T22722] tipc: Resetting bearer [ 507.592923][T22721] syzkaller0: entered promiscuous mode [ 507.601403][T22721] syzkaller0: entered allmulticast mode [ 507.655664][T22719] tipc: Resetting bearer [ 507.655706][T22710] __nla_validate_parse: 17 callbacks suppressed [ 507.655715][T22710] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5005'. [ 507.681888][T22710] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5005'. [ 507.758012][T22726] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5010'. [ 507.794890][T22734] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5014'. [ 507.812230][T22734] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5014'. [ 507.977249][T22751] netlink: 108 bytes leftover after parsing attributes in process `syz.1.5020'. [ 507.987648][T22748] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5018'. [ 508.065063][T22762] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5020'. [ 508.141578][T22748] geneve4: entered promiscuous mode [ 508.197685][T22767] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.5024'. [ 508.269948][T19866] tipc: Resetting bearer [ 508.638082][T22793] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5035'. [ 509.135954][T22819] validate_nla: 4 callbacks suppressed [ 509.135973][T22819] netlink: 'syz.0.5045': attribute type 1 has an invalid length. [ 509.318458][T22838] blkio.reset_stats is deprecated [ 509.478259][T22850] netlink: 'syz.4.5053': attribute type 7 has an invalid length. [ 509.639050][T22866] tipc: Enabling of bearer rejected, already enabled [ 509.678910][T22869] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 509.760784][T22866] netlink: 'syz.0.5057': attribute type 7 has an invalid length. [ 509.777224][T22879] sctp: [Deprecated]: syz.3.5062 (pid 22879) Use of struct sctp_assoc_value in delayed_ack socket option. [ 509.777224][T22879] Use struct sctp_sack_info instead [ 509.915663][T22888] netlink: 'syz.1.5067': attribute type 17 has an invalid length. [ 509.978966][T22888] bond6 (unregistering): Released all slaves [ 510.014651][T22894] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 510.114460][T22900] nbd: must specify a device to reconfigure [ 510.278588][T22911] syzkaller0: entered promiscuous mode [ 510.287182][T22911] syzkaller0: entered allmulticast mode [ 510.544029][T22930] netlink: 'syz.4.5081': attribute type 1 has an invalid length. [ 510.560568][T22932] netlink: 'syz.4.5081': attribute type 1 has an invalid length. [ 510.614553][T22937] netlink: 'syz.1.5083': attribute type 3 has an invalid length. [ 510.624460][T22939] netlink: 'syz.1.5083': attribute type 3 has an invalid length. [ 510.823799][T22951] netlink: 'syz.4.5089': attribute type 1 has an invalid length. [ 511.034302][T22964] tipc: Enabling of bearer rejected, already enabled [ 511.051044][T22964] syzkaller0: entered promiscuous mode [ 511.073378][T22964] syzkaller0: entered allmulticast mode [ 511.079299][T22964] tipc: Resetting bearer [ 511.112749][T22964] tipc: Resetting bearer [ 511.597852][T22995] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 512.019867][T23035] netlink: 'syz.4.5116': attribute type 1 has an invalid length. [ 512.203048][T23039] nbd4: detected capacity change from 0 to 63 [ 512.209752][T23041] block nbd4: NBD_DISCONNECT [ 512.218196][T23041] block nbd4: Disconnected due to user request. [ 512.225931][T23041] block nbd4: shutting down sockets [ 512.239673][ C0] blk_print_req_error: 138 callbacks suppressed [ 512.239695][ C0] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.255132][ C0] buffer_io_error: 138 callbacks suppressed [ 512.255151][ C0] Buffer I/O error on dev nbd4, logical block 0, async page read [ 512.270295][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.279373][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 512.279564][ C1] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.296197][ C1] Buffer I/O error on dev nbd4, logical block 2, async page read [ 512.307496][ C1] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.316638][ C1] Buffer I/O error on dev nbd4, logical block 3, async page read [ 512.333162][T23021] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.352709][T23021] Buffer I/O error on dev nbd4, logical block 0, async page read [ 512.360669][T23021] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.390884][T23021] Buffer I/O error on dev nbd4, logical block 1, async page read [ 512.399728][T23021] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.409489][T23021] Buffer I/O error on dev nbd4, logical block 2, async page read [ 512.417587][T23021] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.427078][T23021] Buffer I/O error on dev nbd4, logical block 3, async page read [ 512.435495][T23048] syzkaller0: entered promiscuous mode [ 512.440463][T23021] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.444335][T23048] syzkaller0: entered allmulticast mode [ 512.450517][T23021] Buffer I/O error on dev nbd4, logical block 0, async page read [ 512.469361][T23021] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 512.480769][T23021] Buffer I/O error on dev nbd4, logical block 1, async page read [ 512.492792][T23021] ldm_validate_partition_table(): Disk read failed. [ 512.501698][T23021] Dev nbd4: unable to read RDB block 0 [ 512.551063][T23021] nbd4: unable to read partition table [ 512.602258][T23021] ldm_validate_partition_table(): Disk read failed. [ 512.618744][T23021] Dev nbd4: unable to read RDB block 0 [ 512.627864][T23021] nbd4: unable to read partition table [ 512.747880][T23063] __nla_validate_parse: 34 callbacks suppressed [ 512.747898][T23063] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5125'. [ 512.936996][T23078] bond7: (slave geneve4): making interface the new active one [ 512.946279][T23078] bond7: (slave geneve4): Enslaving as an active interface with an up link [ 512.955321][T16031] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 512.965789][T23080] tipc: Resetting bearer [ 513.011769][T16031] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 513.062193][T23080] tipc: Resetting bearer [ 513.082588][T16031] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 513.134808][T16031] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 513.181037][T23094] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5132'. [ 513.195838][T23096] netlink: 212 bytes leftover after parsing attributes in process `syz.0.5134'. [ 513.205860][T23094] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5132'. [ 513.217601][T23096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5134'. [ 513.227349][T23094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5132'. [ 513.267410][T23102] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.321573][T23102] 8021q: VLANs not supported on ipvlan1 [ 513.425567][T23113] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5137'. [ 513.565777][T16007] tipc: Resetting bearer [ 513.605658][T23123] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5141'. [ 513.676657][T23127] tipc: Resetting bearer [ 513.687737][T23127] tipc: Enabling of bearer rejected, already enabled [ 513.727555][T23129] tipc: Resetting bearer [ 513.817085][T23136] netem: change failed [ 513.823767][T23007] Bluetooth: hci5: Opcode 0x0c1a failed: -110 [ 513.825897][ T5152] Bluetooth: hci5: command 0x0406 tx timeout [ 513.833597][T23007] Bluetooth: hci5: Error when powering off device on rfkill (-110) [ 513.960657][T23142] tipc: Resetting bearer [ 513.976690][T23142] tipc: Resetting bearer [ 514.190298][T23157] validate_nla: 3 callbacks suppressed [ 514.190317][T23157] netlink: 'syz.3.5153': attribute type 1 has an invalid length. [ 514.262142][T23157] bond4: (slave bridge7): making interface the new active one [ 514.274244][T23157] bond4: (slave bridge7): Enslaving as an active interface with an up link [ 514.284727][T23163] netem: change failed [ 514.285953][T23157] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5153'. [ 514.425135][T23169] tipc: Enabled bearer , priority 0 [ 514.454069][T23169] syzkaller0: entered promiscuous mode [ 514.459631][T23169] syzkaller0: entered allmulticast mode [ 514.498480][T23166] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 514.567505][T23166] tipc: Resetting bearer [ 514.577947][T23165] tipc: Resetting bearer [ 514.599085][T23165] tipc: Disabling bearer [ 514.631325][ T6043] tipc: Resetting bearer [ 514.649024][T23007] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 514.655259][T23007] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 514.765889][T23007] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 514.790163][T23007] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 515.014931][T23007] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 515.054070][T23007] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 515.220733][T23190] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5160'. [ 515.254449][T23190] netlink: 'syz.2.5160': attribute type 3 has an invalid length. [ 515.335102][T23199] netlink: 'syz.2.5163': attribute type 10 has an invalid length. [ 515.350464][T23200] netlink: 'syz.2.5163': attribute type 10 has an invalid length. [ 515.683283][T23220] netlink: 'syz.0.5168': attribute type 2 has an invalid length. [ 515.891083][T23215] netlink: 'syz.3.5167': attribute type 29 has an invalid length. [ 515.899739][T23215] netlink: 'syz.3.5167': attribute type 29 has an invalid length. [ 516.615500][T16031] veth0_to_bond: left promiscuous mode [ 516.636380][T23240] netlink: 'syz.4.5174': attribute type 10 has an invalid length. [ 516.866246][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.875035][ T1081] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.883301][ T1081] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.892264][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.903377][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.006512][T23271] batadv_slave_1: entered promiscuous mode [ 517.015848][T23270] batadv_slave_1: left promiscuous mode [ 522.623359][T19866] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.631534][T19866] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.640389][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.649508][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.241824][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 541.823464][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.424688][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.024393][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.949720][ T1303] lec:lec_start_xmit: lec0:No lecd attached [ 562.950018][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 567.962747][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 567.971122][ C1] lec:lec_tx_timeout: lec0 [ 572.544928][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.186105][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 582.783179][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.383753][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 593.674965][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.263256][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.863009][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 622.463309][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.387727][ T1303] lec:lec_start_xmit: lec0:No lecd attached [ 629.505722][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.902727][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5510 ms [ 629.910744][ C1] lec:lec_tx_timeout: lec0 [ 632.067005][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.664224][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.265312][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.583392][ T31] INFO: task kworker/1:4:5906 blocked for more than 143 seconds. [ 659.591158][ T31] Not tainted syzkaller #0 [ 659.596281][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 659.605117][ T31] task:kworker/1:4 state:D stack:23416 pid:5906 tgid:5906 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 659.617126][ T31] Workqueue: events rfkill_global_led_trigger_worker [ 659.624031][ T31] Call Trace: [ 659.627395][ T31] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 659.630313][ T31] __schedule+0x14bc/0x5000 [ 659.635136][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 659.641581][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 659.648719][ T31] ? preempt_schedule+0xae/0xc0 [ 659.654954][ T31] ? preempt_schedule+0xae/0xc0 [ 659.684256][ T31] ? __pfx___schedule+0x10/0x10 [ 659.702764][ T31] ? schedule+0x91/0x360 [ 659.711362][ T31] schedule+0x165/0x360 [ 659.715913][ T31] schedule_preempt_disabled+0x13/0x30 [ 659.721489][ T31] __mutex_lock+0x7e6/0x1350 [ 659.726294][ T31] ? __mutex_lock+0x5bb/0x1350 [ 659.731565][ T31] ? rfkill_global_led_trigger_worker+0x27/0xd0 [ 659.737998][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 659.743291][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 659.749050][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 659.754875][ T31] rfkill_global_led_trigger_worker+0x27/0xd0 [ 659.760944][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 659.767097][ T31] process_scheduled_works+0xad1/0x1770 [ 659.772765][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 659.778761][ T31] worker_thread+0x8a0/0xda0 [ 659.783447][ T31] kthread+0x711/0x8a0 [ 659.787544][ T31] ? __pfx_worker_thread+0x10/0x10 [ 659.792882][ T31] ? __pfx_kthread+0x10/0x10 [ 659.797497][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 659.802836][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 659.808052][ T31] ? __pfx_kthread+0x10/0x10 [ 659.812774][ T31] ret_from_fork+0x599/0xb30 [ 659.817355][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 659.822454][ T31] ? __switch_to_asm+0x39/0x70 [ 659.827324][ T31] ? __switch_to_asm+0x33/0x70 [ 659.832091][ T31] ? __pfx_kthread+0x10/0x10 [ 659.836716][ T31] ret_from_fork_asm+0x1a/0x30 [ 659.841570][ T31] [ 659.844746][ T31] INFO: task syz.1.5109:23006 blocked for more than 143 seconds. [ 659.852470][ T31] Not tainted syzkaller #0 [ 659.857429][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 659.866170][ T31] task:syz.1.5109 state:D stack:25432 pid:23006 tgid:23006 ppid:16547 task_flags:0x400040 flags:0x00080002 [ 659.878194][ T31] Call Trace: [ 659.881481][ T31] [ 659.884480][ T31] __schedule+0x14bc/0x5000 [ 659.888979][ T31] ? __pfx_preempt_schedule_notrace+0x10/0x10 [ 659.895179][ T31] ? irqentry_exit+0x5dd/0x660 [ 659.899934][ T31] ? trace_irq_disable+0x37/0x100 [ 659.905533][ T31] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 659.911632][ T31] ? __pfx___schedule+0x10/0x10 [ 659.916627][ T31] ? schedule+0x91/0x360 [ 659.920863][ T31] schedule+0x165/0x360 [ 659.925495][ T31] schedule_preempt_disabled+0x13/0x30 [ 659.930950][ T31] __mutex_lock+0x7e6/0x1350 [ 659.935599][ T31] ? __mutex_lock+0x5bb/0x1350 [ 659.940391][ T31] ? rfkill_unregister+0xc8/0x220 [ 659.945549][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 659.950579][ T31] ? __pfx_device_del+0x10/0x10 [ 659.955490][ T31] ? __cancel_work_sync+0x5c/0x110 [ 659.960618][ T31] rfkill_unregister+0xc8/0x220 [ 659.965593][ T31] nfc_unregister_device+0x96/0x2a0 [ 659.970891][ T31] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 659.976652][ T31] virtual_ncidev_close+0x56/0x90 [ 659.981681][ T31] __fput+0x44c/0xa70 [ 659.985836][ T31] task_work_run+0x1d4/0x260 [ 659.990438][ T31] ? __pfx_task_work_run+0x10/0x10 [ 659.995648][ T31] ? __se_sys_close_range+0x4ed/0x650 [ 660.001029][ T31] ? exit_to_user_mode_loop+0x55/0x4f0 [ 660.006630][ T31] exit_to_user_mode_loop+0xff/0x4f0 [ 660.011915][ T31] ? rcu_is_watching+0x15/0xb0 [ 660.016859][ T31] do_syscall_64+0x2e3/0xf80 [ 660.021479][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.028068][ T31] ? clear_bhb_loop+0x60/0xb0 [ 660.033015][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.039072][ T31] RIP: 0033:0x7f1232b8f749 [ 660.043841][ T31] RSP: 002b:00007ffc18d0acd8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 660.052360][ T31] RAX: 0000000000000000 RBX: 00007f1232de7da0 RCX: 00007f1232b8f749 [ 660.060408][ T31] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 660.068520][ T31] RBP: 00007f1232de7da0 R08: 000000000000014c R09: 0000001318d0afcf [ 660.076564][ T31] R10: 00007f1232de7cb0 R11: 0000000000000246 R12: 000000000007d1c0 [ 660.084621][ T31] R13: 00007f1232de6090 R14: ffffffffffffffff R15: 00007ffc18d0adf0 [ 660.092601][ T31] [ 660.096058][ T31] INFO: task syz.1.5109:23007 blocked for more than 143 seconds. [ 660.103856][ T31] Not tainted syzkaller #0 [ 660.108794][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 660.117627][ T31] task:syz.1.5109 state:D stack:24096 pid:23007 tgid:23006 ppid:16547 task_flags:0x400140 flags:0x00080002 [ 660.129678][ T31] Call Trace: [ 660.133074][ T31] [ 660.136030][ T31] __schedule+0x14bc/0x5000 [ 660.140566][ T31] ? __pfx___schedule+0x10/0x10 [ 660.145848][ T31] ? schedule+0x91/0x360 [ 660.150465][ T31] schedule+0x165/0x360 [ 660.154867][ T31] schedule_preempt_disabled+0x13/0x30 [ 660.160431][ T31] __mutex_lock+0x7e6/0x1350 [ 660.165085][ T31] ? __mutex_lock+0x5bb/0x1350 [ 660.169843][ T31] ? nfc_rfkill_set_block+0x50/0x2e0 [ 660.175224][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 660.180243][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 660.185497][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 660.191378][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 660.197801][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 660.203537][ T31] nfc_rfkill_set_block+0x50/0x2e0 [ 660.208724][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 660.214533][ T31] rfkill_set_block+0x1d2/0x440 [ 660.219380][ T31] rfkill_fop_write+0x44b/0x570 [ 660.231040][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 660.236623][ T31] ? security_kernfs_init_security+0x270/0x290 [ 660.242835][ T31] ? rw_verify_area+0x255/0x4d0 [ 660.247681][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 660.253308][ T31] vfs_write+0x27e/0xb30 [ 660.257584][ T31] ? __pfx_vfs_write+0x10/0x10 [ 660.262456][ T31] ? __fget_files+0x2a/0x420 [ 660.267279][ T31] ? __fget_files+0x2a/0x420 [ 660.272141][ T31] ? __fget_files+0x3a0/0x420 [ 660.277339][ T31] ? __fget_files+0x2a/0x420 [ 660.281921][ T31] ksys_write+0x145/0x250 [ 660.286291][ T31] ? __pfx_ksys_write+0x10/0x10 [ 660.291390][ T31] ? do_syscall_64+0xbe/0xf80 [ 660.296167][ T31] do_syscall_64+0xfa/0xf80 [ 660.300984][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.307186][ T31] ? clear_bhb_loop+0x60/0xb0 [ 660.311863][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.317873][ T31] RIP: 0033:0x7f1232b8f749 [ 660.322274][ T31] RSP: 002b:00007f1233943038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 660.330718][ T31] RAX: ffffffffffffffda RBX: 00007f1232de5fa0 RCX: 00007f1232b8f749 [ 660.338967][ T31] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000003 [ 660.347075][ T31] RBP: 00007f1232c13f91 R08: 0000000000000000 R09: 0000000000000000 [ 660.355132][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 660.363213][ T31] R13: 00007f1232de6038 R14: 00007f1232de5fa0 R15: 00007ffc18d0ab78 [ 660.371195][ T31] [ 660.374329][ T31] INFO: task syz.2.5166:23211 blocked for more than 144 seconds. [ 660.382038][ T31] Not tainted syzkaller #0 [ 660.389585][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 660.398359][ T31] task:syz.2.5166 state:D stack:23128 pid:23211 tgid:23208 ppid:16861 task_flags:0x400140 flags:0x00080002 [ 660.410302][ T31] Call Trace: [ 660.413710][ T31] [ 660.416646][ T31] __schedule+0x14bc/0x5000 [ 660.421152][ T31] ? __pfx___schedule+0x10/0x10 [ 660.426030][ T31] ? schedule+0x91/0x360 [ 660.430295][ T31] schedule+0x165/0x360 [ 660.434603][ T31] schedule_preempt_disabled+0x13/0x30 [ 660.440325][ T31] __mutex_lock+0x7e6/0x1350 [ 660.444946][ T31] ? __mutex_lock+0x5bb/0x1350 [ 660.449701][ T31] ? rfkill_fop_open+0x12d/0x820 [ 660.454816][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 660.459855][ T31] ? __raw_spin_lock_init+0x45/0x100 [ 660.465259][ T31] ? __init_waitqueue_head+0xa9/0x150 [ 660.470650][ T31] rfkill_fop_open+0x12d/0x820 [ 660.475612][ T31] ? __pfx_rfkill_fop_open+0x10/0x10 [ 660.480892][ T31] misc_open+0x2d5/0x350 [ 660.485160][ T31] chrdev_open+0x4cc/0x5e0 [ 660.489657][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 660.494690][ T31] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 660.501009][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 660.506057][ T31] do_dentry_open+0x7ce/0x1420 [ 660.510817][ T31] vfs_open+0x3b/0x340 [ 660.514968][ T31] ? path_openat+0x33f3/0x3dd0 [ 660.519811][ T31] path_openat+0x340e/0x3dd0 [ 660.524469][ T31] ? do_sys_openat2+0xbc/0x200 [ 660.529299][ T31] ? __x64_sys_openat+0x138/0x170 [ 660.534454][ T31] ? __pfx_path_openat+0x10/0x10 [ 660.539395][ T31] ? __lock_acquire+0x6b6/0x2cf0 [ 660.544491][ T31] do_filp_open+0x1fa/0x410 [ 660.549014][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 660.554148][ T31] ? _raw_spin_unlock+0x28/0x50 [ 660.558986][ T31] ? alloc_fd+0x64c/0x6c0 [ 660.563488][ T31] do_sys_openat2+0x121/0x200 [ 660.568159][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 660.573522][ T31] ? rcu_is_watching+0x15/0xb0 [ 660.578287][ T31] __x64_sys_openat+0x138/0x170 [ 660.583307][ T31] do_syscall_64+0xfa/0xf80 [ 660.587891][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.594106][ T31] ? clear_bhb_loop+0x60/0xb0 [ 660.598794][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.604893][ T31] RIP: 0033:0x7f771218f749 [ 660.609299][ T31] RSP: 002b:00007f7712f7a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 660.617833][ T31] RAX: ffffffffffffffda RBX: 00007f77123e5fa0 RCX: 00007f771218f749 [ 660.625830][ T31] RDX: 0000000000000801 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 660.633919][ T31] RBP: 00007f7712213f91 R08: 0000000000000000 R09: 0000000000000000 [ 660.641910][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 660.649963][ T31] R13: 00007f77123e6038 R14: 00007f77123e5fa0 R15: 00007ffcb2fcb1b8 [ 660.658232][ T31] [ 660.661315][ T31] [ 660.661315][ T31] Showing all locks held in the system: [ 660.669093][ T31] 1 lock held by khungtaskd/31: [ 660.674218][ T31] #0: ffffffff8df41cc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 660.684209][ T31] 2 locks held by getty/5582: [ 660.689037][ T31] #0: ffff8880301f60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 660.699060][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 660.709228][ T31] 3 locks held by kworker/1:4/5906: [ 660.714522][ T31] #0: ffff88801a055948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 660.725516][ T31] #1: ffffc9000b547b80 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 660.739095][ T31] #2: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 [ 660.750448][ T31] 2 locks held by syz.1.5109/23006: [ 660.755712][ T31] #0: ffff888077bec100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 [ 660.765521][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 660.775693][ T31] 2 locks held by syz.1.5109/23007: [ 660.780870][ T31] #0: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_write+0x191/0x570 [ 660.791165][ T31] #1: ffff888077bec100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 [ 660.801030][ T31] 2 locks held by syz.2.5166/23211: [ 660.806355][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.814933][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_open+0x12d/0x820 [ 660.825073][ T31] 1 lock held by syz.3.5175/23243: [ 660.830170][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.838708][ T31] 1 lock held by syz.3.5175/23252: [ 660.843855][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.852279][ T31] 1 lock held by syz.4.5181/23264: [ 660.857500][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.866439][ T31] 3 locks held by syz.0.5185/23276: [ 660.871645][ T31] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 660.874253][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.879955][ T31] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 660.897102][ T31] #2: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 660.907089][ T31] 1 lock held by syz-executor/23279: [ 660.912355][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.920916][ T31] 1 lock held by syz-executor/23281: [ 660.926250][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.934928][ T31] 1 lock held by syz-executor/23285: [ 660.940211][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.948914][ T31] 1 lock held by syz-executor/23286: [ 660.954413][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.962924][ T31] 1 lock held by syz-executor/23287: [ 660.968182][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.976723][ T31] 1 lock held by syz-executor/23289: [ 660.981990][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 660.990459][ T31] 1 lock held by syz-executor/23291: [ 660.995858][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.004436][ T31] 1 lock held by syz-executor/23295: [ 661.009703][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.018208][ T31] 1 lock held by syz-executor/23296: [ 661.023543][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.031999][ T31] 1 lock held by syz-executor/23297: [ 661.037376][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.045829][ T31] 1 lock held by syz-executor/23299: [ 661.051097][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.059724][ T31] 1 lock held by syz-executor/23301: [ 661.065115][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.073702][ T31] 1 lock held by syz-executor/23305: [ 661.078989][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.087449][ T31] 1 lock held by syz-executor/23306: [ 661.092886][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.101411][ T31] 1 lock held by syz-executor/23307: [ 661.107027][ T31] #0: ffffffff8e78ce48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x350 [ 661.115657][ T31] [ 661.117989][ T31] ============================================= [ 661.117989][ T31] [ 661.126590][ T31] NMI backtrace for cpu 1 [ 661.126603][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 661.126614][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 661.126620][ T31] Call Trace: [ 661.126624][ T31] [ 661.126628][ T31] dump_stack_lvl+0x189/0x250 [ 661.126645][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 661.126655][ T31] ? __pfx__printk+0x10/0x10 [ 661.126674][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 661.126687][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 661.126698][ T31] ? __pfx__printk+0x10/0x10 [ 661.126712][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 661.126727][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 661.126738][ T31] watchdog+0xf3c/0xf80 [ 661.126752][ T31] ? watchdog+0x1e2/0xf80 [ 661.126766][ T31] kthread+0x711/0x8a0 [ 661.126780][ T31] ? __pfx_watchdog+0x10/0x10 [ 661.126791][ T31] ? __pfx_kthread+0x10/0x10 [ 661.126802][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 661.126813][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 661.126824][ T31] ? __pfx_kthread+0x10/0x10 [ 661.126836][ T31] ret_from_fork+0x599/0xb30 [ 661.126852][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 661.126870][ T31] ? __switch_to_asm+0x39/0x70 [ 661.126880][ T31] ? __switch_to_asm+0x33/0x70 [ 661.126890][ T31] ? __pfx_kthread+0x10/0x10 [ 661.126901][ T31] ret_from_fork_asm+0x1a/0x30 [ 661.126920][ T31] [ 661.126923][ T31] Sending NMI from CPU 1 to CPUs 0: [ 661.273104][ C0] NMI backtrace for cpu 0 [ 661.273121][ C0] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) [ 661.273140][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 661.273151][ C0] Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet [ 661.273178][ C0] RIP: 0010:trace_netif_rx_exit+0x5d/0x1d0 [ 661.273198][ C0] Code: f8 41 89 de c1 eb 06 48 8d 3c dd 70 5a 80 8f be 08 00 00 00 e8 b4 69 fd f8 31 f6 4c 0f a3 35 3a 93 56 06 0f 92 c3 40 0f 92 c6 02 00 00 00 e8 19 86 97 f8 84 db 74 10 e8 c0 7d 7d f8 84 c0 74 [ 661.273212][ C0] RSP: 0018:ffffc900001174c0 EFLAGS: 00000247 [ 661.273225][ C0] RAX: ffffffff8929c701 RBX: 0000000000000001 RCX: ffffffff8929c72c [ 661.273237][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff8f805a70 [ 661.273247][ C0] RBP: 0000000000000200 R08: ffffffff8f805a77 R09: 1ffffffff1f00b4e [ 661.273259][ C0] R10: dffffc0000000000 R11: fffffbfff1f00b4f R12: ffff8880541b52c3 [ 661.273271][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88804cd373c0 [ 661.273283][ C0] FS: 0000000000000000(0000) GS:ffff8881260b1000(0000) knlGS:0000000000000000 [ 661.273296][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 661.273308][ C0] CR2: 0000560a515f1000 CR3: 000000000dd3a000 CR4: 00000000003526f0 [ 661.273323][ C0] Call Trace: [ 661.273329][ C0] [ 661.273337][ C0] __netif_rx+0x81/0xc0 [ 661.273353][ C0] veth_xmit+0x57a/0xd50 [ 661.273373][ C0] ? veth_xmit+0x61/0xd50 [ 661.273396][ C0] dev_hard_start_xmit+0x2cd/0x800 [ 661.273420][ C0] __dev_queue_xmit+0x1493/0x3140 [ 661.273439][ C0] ? __dev_queue_xmit+0x289/0x3140 [ 661.273458][ C0] ? pskb_expand_head+0x19d/0x1160 [ 661.273477][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 661.273492][ C0] ? trace_kmalloc+0x1f/0xb0 [ 661.273509][ C0] ? __kmalloc_node_track_caller_noprof+0x58b/0x810 [ 661.273531][ C0] ? skb_release_data+0x2b6/0x7c0 [ 661.273567][ C0] ? batadv_skb_head_push+0x187/0x200 [ 661.273588][ C0] batadv_send_skb_packet+0x418/0x690 [ 661.273614][ C0] batadv_iv_send_outstanding_bat_ogm_packet+0x62f/0x7e0 [ 661.273639][ C0] ? process_scheduled_works+0x9ef/0x1770 [ 661.273664][ C0] process_scheduled_works+0xad1/0x1770 [ 661.273708][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 661.273739][ C0] worker_thread+0x8a0/0xda0 [ 661.273766][ C0] kthread+0x711/0x8a0 [ 661.273786][ C0] ? __pfx_worker_thread+0x10/0x10 [ 661.273801][ C0] ? __pfx_kthread+0x10/0x10 [ 661.273819][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 661.273837][ C0] ? lockdep_hardirqs_on+0x98/0x140 [ 661.273856][ C0] ? __pfx_kthread+0x10/0x10 [ 661.273875][ C0] ret_from_fork+0x599/0xb30 [ 661.273898][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 661.273925][ C0] ? __switch_to_asm+0x39/0x70 [ 661.273943][ C0] ? __switch_to_asm+0x33/0x70 [ 661.273959][ C0] ? __pfx_kthread+0x10/0x10 [ 661.273978][ C0] ret_from_fork_asm+0x1a/0x30 [ 661.274004][ C0]