last executing test programs: 9.55583428s ago: executing program 3 (id=5004): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockname(r0, 0x0, &(0x7f00000001c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x2e}, @call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f0000000000)='syzkaller\x00'}, 0x94) 9.44591524s ago: executing program 3 (id=5005): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x7, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x80}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) (async, rerun: 64) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdffffde18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r4, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_NG_MODULUS={0x8}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0xc}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}}, 0x4) (async, rerun: 64) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x274, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x23c, 0x4, 0x0, 0x1, [{0x238, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x228, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x214, 0x3, "d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452032d5f166334739d1719a5778bd4f724ee4ca57f2527aeeb0c75755d68fc6fa55f4825682ee95e581039823e5963beedcf65b8b005623d90772b8b6ebd2498b0aff725a3eabb6c99cb2edfe10b9c33be8a971e08401bc0807e75a2ff376b7934473bc1f02bb512b77414daf260c9c7d4e1f0758b56ec5823892af310e6252fcfb1d9dbaddefdaa26f43f12f831fd221926d6536eeff641db46920ae0e48f3ff5de599714ba6510ce479d4116a519792281736f39c9fc0e10ef557392c43389271cebcf36543fcf6f83bf74b93ee4eb5e8c82e35bb4784cc1ed0ad291b16e8368487589f7590bf5896f340a36555a1cf69736da230a809176dbdfba3d47efb9a6932e5503d277532b7d4e6f7c7373a298e5843a9f74d5fd07fbc6ad22bc644ba9b3c94ec3c8f0b9321b16e5826b1f058f781760a5d4b6a8880202b41689139c37cd51f65a92d883f8901add03b650c9ec182fb565a4d657ebba9d6a5eb426b22d5933b72362e6ec327fb679aa8034b8b3b6680ad138be47652a3e77981187d2921cebfc1639aa280e3d38dba9b1af49ceded79c78a2d656b3a3e946e17e6257def6679f70f11aa01a2d906aecf4dbc7d1a332a8932ed719ce7eecb5450f494f944b3f6b637502ddba609c6e45dcfad1db7c7dda3e2c755ddcf27132985442e9b8df16f96c82e72e3e2491856d07756b9f"}, @NFTA_MATCH_NAME={0x8, 0x1, 'bpf\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x88}]}]}], {0x14}}, 0x29c}}, 0x4048010) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f00000005c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000004c0)={0xc4, 0x0, 0x1, 0x201, 0x0, 0x0, {0x7, 0x0, 0x7}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x7fffffff}, @CTA_SEQ_ADJ_ORIG={0x3c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x95}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x88}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x7}]}, @CTA_TUPLE_REPLY={0x6c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x38}}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x11}}, {0x8, 0x2, @remote}}}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x1890}, 0x20004850) (async) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="9902000012006b9c9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d24460bc24eab556a705251e6182949a36c2151fef08d8cdbf9367b41ad206000000f408000300040100000800050000000000", 0x5c}, {&(0x7f0000000700)="d557fc16674b56c0a96a733c232d6790c63ca969a688b06e3da58f3c4568bf0a77bdff6f41d7890e18defe94ef1a392dc00dea94a1bee64982de7cf1c91e1103cc1840210cbb57222bc2bfa30369992a6bc5156c00aeadd359a7991ad1de01feec401dba6d7694a14785839d3c2d67188cd07827c934897de4676743c192c4a4b24f7f8747141a1325d29da89694574c32eba56e5bbc8f80376f3325dd89937e990089294183a4829e21849004c538378d41066cb7de399450b3544067", 0xbd}, {&(0x7f0000000500)="5e191aea3468a5eab1c3d6024b43dece099475c81c53aa9244d866f68b8e31e93b41b432fb0454234620a25706bfb6f01ce01093b7ff634785d8b345ef8f7a928034820bbd37467d1049ac7a724c153c358d6f7efd919bb918734e846598b03733a6f4bbce06471d3a440e14dae67170cbfea76bc33481c28ec2cfad1f3d83ddece3006d5bb30dc4288dd40bd476cc7f94d143c56e54ed4d84b9c1ecc87fc035c7c992767edcfe2218bc6542a6a3a9b879e8aa6d652d277ee640cc15d2e9efe30584ed57ab208ca4db6cf63381804a5ee5", 0xd1}, {&(0x7f00000008c0)="fd7617adb877574c4a4489fcaccde0c97bdb2d9d89dba8ab9fc9ebbdcedc770661e1971989a787890de32eebe4008ac8bfafa034add91f6ea4acc741521abecc6cbb4fcfeb61d7d08a8911e59550055d00897194afc1ffd04c18c2506d41bec374a6e5b1ed5fd07db55483fef2dc9ad8ae7c6044b08a303f256ff7e7dd720c72fc0d513110468d44e31a8fcd833d521b95c3b04378ca1c67b4faca350009045628c7f7196510f14ebdc68ba7", 0xac}, {&(0x7f0000001880)="1439ea", 0x3}], 0x5, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) setsockopt$packet_int(r4, 0x107, 0x15, &(0x7f0000000040)=0xdef, 0x4) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) (rerun: 32) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x2710, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x6, 0xffffffff}]}}]}, 0x38}}, 0x0) 9.221291079s ago: executing program 3 (id=5008): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x30, r0, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r3, @ANYBLOB="14005a801000018004000100"], 0x30}}, 0x40000) sendmsg$NL80211_CMD_NEW_KEY(r2, &(0x7f0000000100)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000040)={&(0x7f0000000080)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x3, 0x68}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x2000c080) 9.095877313s ago: executing program 3 (id=5009): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000540)={@random="14082ca4e234", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ni={0x8b, 0x0, 0x0, 0xe, 0x5, 0x800}}}}}}, 0x0) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r1) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r2, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8814}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000440), 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002900), r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000100)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='contention_end\x00', r6, 0x0, 0x4}, 0x18) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f00000032c0)={0x0, 0x0, &(0x7f0000003280)={&(0x7f0000000300)=ANY=[@ANYBLOB="0081690085b7e1fb11e0c0bd150bfee838fcb5338250c33f80a8a595c50d3bec29b2c7fb1fce0b1f9902db571a6761f871fb3a0d61fdc5cd37017093d2f68fc70fced557ffdc8fb72f3b7eb41f64491024e2698bb9cfd21ff6cb5ef88857de28c1109c2971d53d7cc5eda8ceaaea05a29d5385c9983f5309d3c66249d5d03b26bd07358156b6e80e37532c230df24c15d5e0817ca7ccc645e3304f09efcfab327ff998b86da43e20e3cb0ddd8477086361fad1e9c56d037d27867d815d66ebe99ef7ce190dd501f914672bf84391bb39394a408ace7a000000000000", @ANYRES16=r4, @ANYBLOB="010028bd7000fddbdf2521000000050020000000000009001f0070687931000000000c0005000000000000000001"], 0x34}, 0x1, 0x0, 0x0, 0x880}, 0x40c4) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000080)={0x0, &(0x7f0000000100)}) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f00000000c0)=0x7) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmsg$alg(r8, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x200}], 0x18}, 0x28000054) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$kcm(r8, 0xfffffffffffffffe, 0x30008080) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$nl_route_sched_retired(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r8, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/216, 0xd8}, {&(0x7f0000000840)=""/127, 0x7f}, {&(0x7f0000000600)=""/134, 0x86}, {&(0x7f0000000480)=""/21, 0x15}, {&(0x7f00000006c0)=""/21, 0x15}], 0x5}, 0x4}], 0x2, 0x60, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) write$ppp(r0, 0x0, 0x0) shutdown(r7, 0x1) 8.827996801s ago: executing program 3 (id=5014): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x48}, {0x6, 0x37, 0x0, 0x9}]}, 0x10) (async) syz_emit_ethernet(0x14d, &(0x7f0000000380)=ANY=[@ANYRESHEX=r0, @ANYRES32=r0, @ANYRESDEC=0x0, @ANYRESDEC, @ANYRESOCT=r0, @ANYRES8=r0], 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async) setsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x8a, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$bt_BT_POWER(r4, 0x112, 0x9, 0x0, &(0x7f00000001c0)) (async) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) socket$kcm(0x11, 0xa, 0x300) (async, rerun: 64) r5 = socket$vsock_stream(0x28, 0x1, 0x0) (rerun: 64) bind$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) r6 = socket$kcm(0x10, 0x2, 0x0) (async, rerun: 64) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) (rerun: 64) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) (async) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="043900002000ef"], 0x33fe0) (async) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000080)={0x28, 0x0, 0x0, @host}, 0x10) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x0) (async) syz_emit_ethernet(0x96, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000208004118008800000000002f90787f000001ac1e0101442c212300000000a4b85c57e0000002ca8000007f00000100001000ac1414bb000000040000000000000007940400000420880b0000000100000800000086dd080088be00000000100000000100000000000000080022eb000000002000c0000200000000000000000000000800655800000000"], 0x0) 2.612925257s ago: executing program 4 (id=5083): pipe(&(0x7f0000000340)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x20000000000000ee, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x26, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_opts(r2, 0x0, 0x6, 0x0, 0x0) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r3, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRES8=r1, @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r4}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b00)=@bpf_ext={0x1c, 0xf, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x54000000}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x42}}}, 0x0, 0x3, 0x0, 0x0, 0x40f00, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2e131, r4, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 2.52665852s ago: executing program 4 (id=5086): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c000000287e490ffdffffff0000000002000000010000070000000008000b004700000008000100ac1414aa"], 0x2c}, 0x1, 0x0, 0x0, 0x42812}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000000)="f76119abc125e48efd143e571709add88f41f0595765d822729d0fff8123a67e469926df418e1b212a72780550a78d5f76ddbb5bc60aaf3613b6b07f05978f212992b4bf0edd289b4e0a6d9047d7664ba1a6da892ab5343786be87b81307e7e76a2deab4872f5c718092239cd9702b3b0ca3561386d1569d23436bd565e7b9796d66b2fb29350eb1e19f4b413a22fb38e43ed0051c7515818a0cf52b6dcca63562f2749f", 0xa4}], 0x1) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000100)={r1, 0x6, 0x9, 0xf7}) epoll_pwait(r2, &(0x7f0000000140)=[{}], 0x1, 0x5a8, &(0x7f0000000180)={[0xc0c6]}, 0x8) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c000000287e490ffdffffff0000000002000000010000070000000008000b004700000008000100ac1414aa"], 0x2c}, 0x1, 0x0, 0x0, 0x42812}, 0x0) (async) socket$netlink(0x10, 0x3, 0x8000000004) (async) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000000)="f76119abc125e48efd143e571709add88f41f0595765d822729d0fff8123a67e469926df418e1b212a72780550a78d5f76ddbb5bc60aaf3613b6b07f05978f212992b4bf0edd289b4e0a6d9047d7664ba1a6da892ab5343786be87b81307e7e76a2deab4872f5c718092239cd9702b3b0ca3561386d1569d23436bd565e7b9796d66b2fb29350eb1e19f4b413a22fb38e43ed0051c7515818a0cf52b6dcca63562f2749f", 0xa4}], 0x1) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000100)={r1, 0x6, 0x9, 0xf7}) (async) epoll_pwait(r2, &(0x7f0000000140)=[{}], 0x1, 0x5a8, &(0x7f0000000180)={[0xc0c6]}, 0x8) (async) 2.403423553s ago: executing program 4 (id=5089): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) close(0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet_sctp(0x2, 0x5, 0x84) socket$xdp(0x2c, 0x3, 0x0) write$tun(0xffffffffffffffff, 0x0, 0xfdef) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @private=0xa010101, 0x4e20, 0x3, 'sed\x00', 0x30, 0x4, 0x68}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000540)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x11, 0x3240, 0x3a}, {@local, 0x4e24, 0x4, 0xc3, 0x12d60, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0xe}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e26, 0x10000, 0xc24, 0x9, 0xfffffffb}}, 0x44) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{}, 0x0, &(0x7f00000000c0)}, 0x20) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9400000034000900000000000008000003000000680004"], 0x94}}, 0x0) 2.272061859s ago: executing program 4 (id=5091): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) socket(0x27, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000300)=@ethtool_rxfh={0x1}}) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x400000, 0x1, 0x3}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x6180, 0x0) unshare(0x2c060000) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x44884) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r5, {0x6}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x8, 0x2, [@TCA_BASIC_EMATCHES={0x4}]}}]}, 0x38}}, 0x2000c800) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000000180)={0x1, 0x1, 0xc, 0x5, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x1e}, @rand_addr=0x64010102}, 0x10) setsockopt$MRT_FLUSH(r7, 0x0, 0xd4, &(0x7f0000000040)=0x8, 0x4) sendfile(r0, r3, 0x0, 0xffffffff004) 1.708021033s ago: executing program 1 (id=5094): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x0) close(0x3) close(0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r2, 0x65, 0x8, &(0x7f00000000c0), &(0x7f0000002140)=0x4) r3 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000a40)=[{0x0, 0x0, 0x0}], 0x1, 0x45800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)=@newtclass={0x68, 0x28, 0x300, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xfff2}, {0x8fcbcfd2fdbdadf7, 0x6}, {0x5, 0x1}}, [@tclass_kind_options=@c_clsact={0xb}, @tclass_kind_options=@c_hfsc={{0x9}, {0x24, 0x2, [@TCA_HFSC_USC={0x10, 0x3, {0x8, 0x1000, 0x6}}, @TCA_HFSC_USC={0x10, 0x3, {0x9, 0x0, 0x1}}]}}, @TCA_RATE={0x6, 0x5, {0x2c, 0x4}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000841}, 0x4000080) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f0000001d80)={&(0x7f00000128c0)=@newtaction={0x18, 0x58, 0x284f, 0x0, 0x25dfdc00, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1.580923056s ago: executing program 1 (id=5096): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="82", 0x1}, {0x0}], 0x2}}], 0x1, 0x6404c880) r1 = socket(0x10, 0x803, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@auth={{{0x0, 0x0, 0xb, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x8}, @device_b, @device_a, @initial, {0x6, 0xff}}, 0x0, 0x1, 0x1a, @void, [{0xdd, 0x24, "0f220f0033f2af102eb85048f65f350a0db47fae3add8974330abba599f7820c4af3baa2"}, {0xdd, 0x2e, "b2e7dbe78f46dbfea83ddc785313f9958d9a962c3021764acbb298fb01fd3c296230400da046c90425f90c260d69"}]}, 0x74) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x28000600) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140), 0xc) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="500000001e00210129bd7000fcdbdf2500000000000000000000000000000000000004d40200e80000000000000000000000000000000000ff7f0000023d000010000a002cbd70002abd700000000000"], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x8000) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="04020000030000000085008000200000009500"/32], &(0x7f0000000000)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="04020000030000000085008000200000009500"/32], &(0x7f0000000000)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) gettid() (async) r6 = gettid() sendmsg$AUDIT_SET(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x3e9, 0x300, 0x70bd27, 0x25dfdbfd, {0x10, 0x1, 0x1, r6, 0x0, 0x10001, 0x81, 0x1, 0x0, 0x3, 0x9}, ["", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x40400}, 0x4000) (async) sendmsg$AUDIT_SET(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x3e9, 0x300, 0x70bd27, 0x25dfdbfd, {0x10, 0x1, 0x1, r6, 0x0, 0x10001, 0x81, 0x1, 0x0, 0x3, 0x9}, ["", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x40400}, 0x4000) r7 = socket(0x10, 0x803, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) (async) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x3, &(0x7f00000001c0)=0x1, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010000304f9fffffffedbdf2500007400", @ANYRES32=r4, @ANYBLOB="049c01000750050008001300", @ANYRES32=r6, @ANYBLOB="0000000000000000fd93ffffffff3d4d69e66900"], 0x3c}, 0x1, 0x0, 0x0, 0x4802}, 0x0) 1.393695724s ago: executing program 4 (id=5098): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x2e}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x28, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x2, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x30, 0x5, 0x1, 0xfffff034}, {0x6, 0x1, 0x6, 0x6}]}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r6, {0xa, 0x9}, {}, {0xc, 0xe}}, [@filter_kind_options=@f_flow={{0x9}, {0x1c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_XOR={0x8, 0x7, 0x5}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18934}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x200008c2) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0xd0, 0x2, 0x7, 0x201, 0x0, 0x0, {0x4, 0x0, 0x1}, [@NFACCT_FILTER={0x1c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x800}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x4}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x7}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x4}, @NFACCT_FILTER={0xc, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xffff}]}, @NFACCT_FILTER={0x24, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x8}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x6}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x3}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x6}]}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_FILTER={0x3c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x100}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x8}, @NFACCT_FILTER_VALUE={0x8}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x974}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x8}]}, @NFACCT_FILTER={0xc, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x4}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0xc000}, 0x4000040) 1.224838378s ago: executing program 2 (id=5100): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000600)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="150626bd7000ffdbdf252a00000008001200", @ANYRES32=r2, @ANYBLOB="08002f00000000000c0005000000000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0xc040) syz_emit_ethernet(0x6a, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffffff0180c200000308004503005c00000000002f907800000000e0002101248088a80000000000ff000010000800000086dd86dd88be00000000100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000c92fe96c876a9abb606445b1a9b16aa1670f4c8d28"], 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000020000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0x4, 0xc}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xc, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0xd1}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) 946.277263ms ago: executing program 0 (id=5102): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @broadcast}, &(0x7f0000000100)=0xc) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x49920d862a92153b, 0x800, 0x0, {0x0, 0x0, 0x0, r1, 0x1000a, 0x1b400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x21, 0x4}]}}}, @IFLA_TARGET_NETNSID={0x8, 0x2e, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x0) 879.673184ms ago: executing program 2 (id=5103): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}}}, &(0x7f0000000140)=0xe8) r2 = accept$netrom(0xffffffffffffffff, &(0x7f0000000180)={{0x3, @bcast}, [@default, @remote, @null, @default, @rose, @default, @rose, @netrom]}, &(0x7f0000000200)=0x48) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001880)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$netlink(r0, &(0x7f0000001e00)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001d80)=[{&(0x7f0000000240)={0x1a8, 0x11, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="7fadd0a9667eb5e62981ed19f09ed9c64563fcb12b46fbffa158dce7a1a61ce304126c39eb3d6f4a3208ec2bfcf8687dbd6f3cd0c3e6efcb1c8e5e21435547e2664110fc8a0d3554f1496762651ce55c58f643e1ef0321c30bfb23db98f7955a0ab02603c8e63c3e41b05c9d4129a81b88efd8512d8efabb91541539b5629b5e71c55c03372ebb45bfbf360bc582a712daeeac9de20f829aef4fbd4e3756f181fec5605c2410e9447f84cc4b6fe703c54443f783e262a48bd9501ce0b7a47f7ea23c2230273945a5af52a8727463abd59529212ecf853ef1224d41f2c0058f5e32a2149b", @nested={0x10, 0x73, 0x0, 0x1, [@nested={0x4, 0x53}, @nested={0x4, 0x13f}, @nested={0x4, 0xc3}]}, @typed={0x8, 0x24, 0x0, 0x0, @uid=r1}, @typed={0x4, 0x131}, @typed={0x8, 0x74, 0x0, 0x0, @fd=r2}, @typed={0x5, 0x10f, 0x0, 0x0, @str='\x00'}, @nested={0x10, 0x1f, 0x0, 0x1, [@nested={0x4, 0x50}, @typed={0x5, 0x10b, 0x0, 0x0, @str='\x00'}]}, @typed={0x14, 0xf2, 0x0, 0x0, @ipv6=@loopback}, @generic="baf24a194960b2d2343f5a823eda11849c1b0400ebf623fa8b8a2896732a89504552d72187de84a6ea03df03e0ae9c16364f6f1a91ea24ac1c14b4f062d6640ec0268bb12956ace3180920be15f53dba33f5f911d48025eee897da", @typed={0x8, 0xe3, 0x0, 0x0, @ipv4=@loopback}]}, 0x1a8}, {&(0x7f0000000400)={0x1450, 0x32, 0x4, 0x70bd27, 0x25dfdbfe, "", [@nested={0x1138, 0x3e, 0x0, 0x1, [@generic="023884736409bb147704b606eacf2cc9e7605ca3dd22c907cd1c917d5cda7bd3cdfeeebd0e141a2b653b33cc69eb8310977fe5a454897d06b01919331e53e7f1b470ea3c06d27485b21e7bdc65aa11d4dec5ad19f8b209c320311ff2b30ef7cd6abfd0e637e614bda4732a69f3a217de5ac860ac62a30cc6ec1dcfb33caaf56cdc555cd5aecc37f0dc488b37886502403e2da67f98ccb4d0b2fc1a61a173e1d1dc18339ae0a0657a625274f9196d7d2b5f50a95bb8e1965c033dc411aba3350e4c18a66a314f5f113f14bb9e", @nested={0x4, 0x13f}, @nested={0x4, 0x24}, @nested={0x4, 0x139}, @nested={0x4, 0xaa}, @generic="0d10cc2c22a8bb0b77bbef310aabf8c6d43cfee3f7b728b272409e21c73222b4292aa854c3e93e4fa52b9fcc352c66d82173e0a1f7615a8c6040dd423b239d6932df5b3ed6dbbd03e3cf3e91b9f8cd830f4317450423d2d1a12a8c97022bca81d2eb3b3d725c378cd576173cd4a12f15973bccd198fad741c743103717334367d043a033ae6e4f536d421202fa8b8e8ee07c238bf754335fc4fe3c738ca2179b51594b734a0aedf995e56bfa5c90f36f288069de65737f128414642ed65957627264bb498c02c3745442a550e74a99715b3472987f03f6bc7e6efeebdaaa8cd19eec509857ba1b59f1d8794e907c61eef3089be12959cabe733c9b865eee59b125f04d81cf2d459c7b913a68a015f6ecc6e375daec48346d34cd68d24a13cbb6dbca7ab817edb03a86f2668d095e0c6e00ca39180e4da2c854c9f938c2d5ef98a17e2e86fba8c3ca979199adca3b85d8a035e0d52a5b1487d0c798f6c97a3dab4f51263273a4e89fd3d9aefffb0be6def8d7a241284189007435d3bb1af66a37e2b3cd492d7376aa0fc531ce462b4e6ecd0c776c9c99f15feaec28b7568409953ffa9557a94a3b241335e9787a5e169d4e6fd527d9f51bc1d85b9285f30f9ab790599f5c91746b4d7c43e54b65bc6e1407e58e243d2e1aa1ce1ca352b38b575f5d790326d529f96298d4cad39aa7e27daee6778720bdbd5c971e7ff8e75d3132a1ef23fd829c3a9c9a8c703566ff54d4147765469b3dab71fccc3b952081ac53f004a886868f7e42b94c73d3049a73dcf6f08519cf70f39290daf758c761dee98091ad3f0bab3900df333de3b1701a31480c170d5c7d926adf53159bf0c69f93e96d61037de6678c42bff9a2a2c14012e84e341ee99b565adf72fb75311dc01009a12b652b66902e2b130108e880cf8caac355c4ab88ffd6ebec086df1e395804e284a4d485a9dd42f287de2af230719d8563f9a7a7c1cdc4f9fcceba345e0e98989ad48841081f137f0976627232531f25d2a385768b632918d7bfd7fa8233f58a7183d928d8187e4e11f9edd421938db8004fa7a0888be61d4485776b24333d7f95ac2920eb653410319dc89dacc59b20ace887002afbeb1ffba468fbd61c638cfc1f1495eb1ffb3a11d22e0b9f20787639c288a7d4bfdb1b8384e7d916b12c84788ddd3eac9e56b092887d5294fd2f21b72d699d669ad3c7ab99cd20b224022968ee63aa1190dfc1abbb5b1e7b266775e474d4cb1539b59aa9243b66d781cdc63074c0b9ad5dd4c450004d43d8cc0da42b93ab3cd2fe5f7244bc4ddd818710ad849506c6e529767859ad2a977bc35b52efe75a95de16e9cc81f465ceccf576aff88b23e621bf0b6fd9fc8f78a24d9c02bcbd58a0e10f6260aabb25c925a07e5c0a658abcd13c5f8c35bc128ce17f04ccf14b5d783ec6b740d987522e7d7583271d8ae45b52d9cf34a4cc2b58d4f91a3ad2133b7aecf8faed3890ceb23925db352675ffddb4f2c02974b1f03fed269acc6f3ff1f6300801c57f3d0ad371950818a89725283e0e4d17c8bd2f55f0e19f840cfa99a90466103eb020fe4065bf0c11519f573d3730439adb0209b26df37b887dc2924e61315d937afdb375e3aa36a20e5ceddcaf30de8cd7e97dd2a496f0c627cd6bcfe2c65b7449ec765b3270c528782c5e6edcd0e193508fd35f80a617d21e5a5cefed932ea7d208a99480ba6a317327b5b10e9232d956bc1089cffb8a59f1d724e95bdfb63b173d0e6b79a2d7aec91f73b1b3c3c0a281394322c1e04ca3a8451e1aaa3ffb201304da5bd4e6519961d5c0f75581c94f1ef47992a00b0af720b522a61927c3cbf36f0079577d91b50f5a643399f077f4639b12f115585badd8abec8b30ee0b97e94cbc8263d2b11c404868ca1ebe5613bf5d112c770f5d18585047bdb4141b819d302853993e513520262b751e488641cc78beab1600dfb909e89f723922504f3f340defdec170679792588d5e6c7b7f65a90952a66c10607496f4b28c7a5c5201bfb28493c12b6954050c185e4986fdfcb73f0b5851a28c45e1b9c509a0a89d3d1da0957382cf70c082047e70cd54da533d2724baf8304ea647e2cafab43cec0d9212e81b8dc1baceb290c24720a4163b6480e7278746f342744c46a01346056ecf06c4b9d29dd148bf1c033420b844cd4d9c561f30494170cc6baf0e3f4e4b4384c3468816aaf37254ab54652487adb882d7a2c6e3805e72680b4542fc6112bf8964489183a456136358bdc7806a4143fbc99e0178afa257adb09790d5ff2f9b018b8e920a266a933cab9a877358c05db898fd5ca37923585b91087e0925bee29b3af7d0f135f62ef9b65474f94bc4f13f73eb16698defa7999898955021eaac608c8ae7ae74c8f7a9bf22b0d982251f3115b37633552863edbe108e7e78371efb07a4ba6472f41b9d1ef0f54d3b739f46d00e88ff0b4d4362c075afde60dfc816b30acef19a4eab8414820bc94104c57b74c78f0c53e9883a828398a294ee02a1cfb367fcbfcf1f90d3192791a69695322e976ac1b4ac2b959f099662c89a5d76d22d107961bc69267d6a414118a4f7541e83321260acdaa74df7341b5faeeac6ee51559e92496de619bf19039ee24bf2ac3638ee374c9b318e02fdb2b07d462e57ae7463020178289516196a151e2414a42b999cf1572fc5e2b4c25b3f4c2f6e31f06aee58888dcc8f2af8e60d995a058c40402c9f1ea21b74e74280813511adc1d7cdc785de380063a746eb63d147cd9d038a34c6dd194f576346cc6b2f553784aef1c778754e8f62cc5904c044afcda62da58a1d7cdcbb1f4813458c6ab79d26aed00956a2efabe02ed21b4dd688d1695966df521ed59046a10c582b52b488001898ba75a7fe8442e0cd1f9091a541ad28050a78f5a0d955dcb9c02ee3a435d7a21a3a42753e30040fc6eb3d2bc7749b9d1540c818044bf1782e7e3d16371a4c2a10f3cd3f5f7b698527d8318b136bbe05e8ac91d4cdba2cc9c25f18fdb152c76608c6bf7ffbb734b223a5f77dbad27476decda482dde3c7a34567a558a2e75b3c32449073abcb2a47e95a08e7df0710f8e3fb3ccae08911c22759f8cd22ce4e2dc3f472a281fad94c77acc1d520eb3bd3506d79dd7bf8a8048d461b0ee2c34c2f0db0af5a09c4e9ded69f9cc8d7fe34d1426afad0d0ef87d0d58ec3a2dfdac5771edb804c66831f84416f1a8daa2b884d186df8fe4c7834757ef405fa47055c5107eba859b884c2f77a9e8d3a93ca4b765bedd2d985aca4d15f4546af9cbce6678c880e9492cfca5b29f533ce2a84446091258795e80ea5b3ee27cb05427a8f6a8ebf8f73ac18ddfd417f730291bbe1db2664ed4569e1fef227ccb6342cd31f2602986ba175a0c3446b78e5ae3fdffa2227cd72eb158ab0cb24fc3044f48cff84f0408a1db94b5e08f45e0cacbcc17a9d4ea2e17b1ae9c25e633908e3bebd6866978634aab10a483ad5b64c44cfdef4870c0b311dd4000dc6ff282a08038889b036627ef1f6110eb16ea2643f1386fee5cc0f07cf1ffc89ac3a15ebbc2719feafcfaaf378ad600a80b6e3181da86c1b15a3bdfa2267eb7a5214d2942c2b6c0356049e3c210ea02f8b60e2c54db7d408e695ceb8c1990fe819c3e5bdd27218693d4dc4632158f878fdd61f89f67d32da9be1a9f4db4fa217ed90a66feb6b51331469e7d86731c82d77cf2c0e43e6bbd3f649d0de5503e2c9ea556cc2379a91c48a859c0cebd9bcc2bc01b85e5b75d9fb24207b9e1c7acb7d8d148a5c99e40772046c7a42a11b299a87b6622807c9901a14d5c8588e69aac38c87316443c708eb8b910bd240e6847efa26a4b41c4f6cc34103295b0254ddd41a89eeb3fda787350d4dcb7b3cc518b2317cf6a5e4ea87ff688deae55cd5cdc44429040b17167eb3212a5c72b39a3a3462f632fdbac33812e29b0c75d401bf3221eabfa03aebf689ef0a16607c2d3137e1fed6b7c507673f53c38e7bb819a6a4acd17be1b811040316974528b28672eeceb950ae95d0b6f9bba838a53400e0d95e7c99c269d132b9f97771f66b6e5f36594cbb240a06e39e5b8262e614ef764d9c7bc5264559430cdbd1e23a86e9d6ea4478d2a75601d6181078587592987e8e21f15867eb086c3187ac3f1020ec4526a7724848871e28780339e4102aafc0dd88bf71676a72490aa8d4653bf4a747a804fbfa4405ffa8d411f08e514c22d57696b6dcd8e0ff6e82c5e97edac0a328223f836f8cf3cd91b96cdac0a690c775d3e73dbd3b9a71ea0cefb907f8ae9833d6c89225b0b7d8910c01d40bc79d9d6c98a79c0f16ac782b9eaa68dfa726de59fa07e827046009e07d95fa3b34447c3af8270a28eebb4d811775b6427071d91868134f45bb053f0fe9cf15af1438bf002f18d4951cc5bfdf56c9669bb142a41b61804184b77ac5fc485da761945e56d8b15b2be0d75f760a4992f9be83e4c50ef1be8f4112ee196229a2aa8ab3c396c1f0ae2a36b5197e7b1365e4db89ce8b016c64318b4ed52de2f82321a10a6fd30422b75de233a3d8414cd1fb025b41f2dd48acb4bdc54e16463f4479a2ca4fe771220d61be31dea7c42369bdfd6a2af8f591885f05385ecaea92b341779b559c20a546b9e009610b4fa615d71d71c1ba620d8a4955b5053a9bfee2a8019662596bb05dfa066977c0c41cad0da64cbe121c56bf4c501b66193b7ca1d3c3d1fc04b26473e69c24bbe73efdcb517577f95d3e6c752da01dc9334cf9a550ab9f563f9d6c81175a5cd173f231042b9852ae72f373255bd25fe00dc2b1f1c5dc7fc301d64d5c4fe1cfa3615fdb527407ddc18f8ebaa021d3b5deb6b56e0d116576ad8b79bbc32a60f923e21c78c0e7c34d3a467590aa0ec8cc95c07826cbae8a1f9abf646fe90e03e52017d7dc7f95181c78cf195d7f7281fc4a9766accf34d1273ab83069c461daf31e8123220136a429a426c1b5aae0091433b4bfe49bc2239ff2a9871782d0c6f040bb0c724ee251a8779ab2c8278f026727997342e009f738219287eabd0bb0c0374e3534c347e4064da9f160ac583e1c591094d60d2b6ef26f8388a30d9c25410ad49c016610ae94851436e1f7e3639fe25da09bc89c08064f7f2115aa22694a8fa3403ca2ad594a378a16660ea6c80235628ff4051ff325f00b0b9b0f24728ec80bac7d1ac17d035e1cfbde25835451d983eef5d59da84c59fc87b5c4d9009f036fde3b245f91d74fc5f38d0b18e5763823dbdb8e6ffc0bfc4a659e753f2b9e7c6527318d575fdcb3a620f4a17db57ebb1c603573e1396673417064896049d16244d109968dc8c5ec39b9fef90584b90c70bac5cc9bea77c076177fefe1a52282aed825c9774bf22b0415eb591e2f9c1e23b32f93effcc18b7bbd7a1619c2a63f78d6553de255392afedb249f6ac10ed67d8d89be661223fdbedc0ed26a8a1cb42d43fe840a9599eb6515110202d4840bf5675f42edabf420a5c97d9bd7ecd49b21f3c672d60dc9b0a17cbb6effe76e851b9222e4b443cba3934a645015104fd2f97f2d01bb5ca1380c61cae75f3fe89803884e40eea3790800816fb4c1a800490871ba574b05a1998868fce364e6d9c25069738bcfeee816ed2274a45575b6ea2a64eff716b2aa7eefbd8aea479f0bac4f27190769c722de89e37d34933d58e01af7b2a97bbf0af5f20c20966d16289827b2ee2afbf4664155e58d2969fea8ab18f97bbd8fd914be3606b18ea8ae3ae2fac593c45396d6a18f73fee95d034fb3f5f022c4ac0c6", @nested={0x4, 0x11d}, @nested={0x4, 0xcd}, @typed={0x4c, 0x151, 0x0, 0x0, @binary="6eedb7ecdd17401efb0b7aa8833727ca7f1c903153f0867a631a486238ee36df10cae3f046e0e74d3c07a0e2f5c489c39b71fb01eacba50657ac8ba917594f3e6cc9e21795067df8"}, @typed={0x4, 0x114}]}, @nested={0xf8, 0xdf, 0x0, 0x1, [@generic="14520caae032f4cbf667d028d0c20e51a16722d43212b7c67ab196a2e69ffea4ca2b58a8accaf6cc6571748bc41ea846d154fda6818f098e506ecdf10cd4051c818f77db7c0f9a70c29987652d73dbcd3442c44e2e0960ed036dc76f487dbb99bc56f23d47bf0aa472a901a3c52eb14305a7cc274156caecbbe5c242b74140e127fa6f109629d367978522eafac3352d4f5c9bb5a51a51b335a504acf6c1a9ada502c523f5468840df16ca999db670ca9c59c495dd5b611651148f237fb962e6611af4c5d840acf547e8d4453a2c615a3391e376d3b94882e969c3a440edb8cecb8504193c64156bae596a4666396ee0a992149e"]}, @generic="0248357cc1ae3a3ce56bc8e413ffcfcbc51a02710541901f6ad760d0306ab34821f3561c074a0bdb9bc81a3364bbc3aa4989730254c9b84bf1755622bef456e6a9f96fd208dfd7525c14a1ceaa8a92e1f5e99680855f35191606a9b35e070ce79f1e9eea72ca4ea315eb987460bb5ca613156fbae9e640ab52cbecec38fb5e369b72343bcb2471ee4604fb8b8aa07bbd943e6d4ffd3190871b3219fdfb35f0190050ccaa827c9265bbf3873bba3c3de7359c68cfbf3bf98963313be0d16bef0fc323d5", @nested={0x96, 0x94, 0x0, 0x1, [@generic="50ca7a283f6a688894a2c00cc921492f9edb1dfa5a49476c703a5e267be903bb8f4616b433767c4d882a1c0148c599894271b41764e0badf1d38a7550dfb497dab4fc524e62873c57b92c80446afb313560911e73754a82d73d2cc32557fed284b02a7b061652bda35e4167b51ca28424efa0c318c0457e86bc8ecc29f2926f8df5ec93a68ab4083a9d454c330717c398efb"]}, @nested={0xb1, 0xbc, 0x0, 0x1, [@typed={0x8, 0x87, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @typed={0x4, 0x118}, @generic="786e94c8940419da0e48aea113726b7ec108639841b36dbece777f2dc4a777b7bf56b3eafce829bda904577d1924687b91ebc7abf046844415f0b389528726f58501dc925a4f5fe77cd4d42bd391aca123af7bffb167095791eb0b44f2d3086c56f5ffed87c2ed94cb8096f97d38f4bcb6f99a7294106afc18135f373fb23c50702976983b7f4ff96a9c1ec9360e36263edbee4b0528870fed1bf4ed3f", @nested={0x4, 0x15}]}]}, 0x1450}, {&(0x7f00000018c0)={0x490, 0x27, 0x2, 0x70bd27, 0x25dfdbff, "", [@nested={0x1c6, 0x7f, 0x0, 0x1, [@nested={0x4, 0x111}, @typed={0x8, 0x9c, 0x0, 0x0, @ipv4=@remote}, @generic="668ce8f747efcd39927b620bfe86b67cbcfd093716ff030eaa2154d70e8416cb323298bb58efd48336973e8eacbc0431442198d2a197d70f0c4b9fbb79a56e961d183772c55ad4414c5e5da38563bd1ac637020aa926e3b6b3972842e37bb162e7c41dac97e4cc06d81de5efdaa51113417bd0c23c293ee195fcad9cfa71913cd8ee75509ad111e9872941fe2a7b011cffc93d73ed451a2ad553657c5a0bdc3635192f907106c12dfa0b6715618ade2e6f93b1367691a76482edc6345130364b92c95cb2bf8fc1873bb644e1d09f9fd4b2", @generic="04e9b2b307925b4c988a6f4553ff30d43f967e80c0aca7e48ff2cf1f1dab3ac4f32ceb13939b30c21ad34209e288bc7b755a614a8cf6929c5db18bb81c68349958ad1ba76e7692de5cc8aef8cab70a3ac31b56eb79720d177738ab0fab90fbd3230430582c0aec01bf1d383dbf40973285e25acd48aacaf42957b5de78ca544ca435d21c409b98391078acb8cf3595b61c427ae24c9650c6aeb63d11f3c346bb240678959add37c0fe2353b226b4e64e83458cd7234869", @typed={0x8, 0x108, 0x0, 0x0, @ipv4=@rand_addr=0x64010102}, @nested={0x4, 0xdb}, @typed={0x8, 0x120, 0x0, 0x0, @fd}, @nested={0x4, 0xf0}, @generic="e9f71ec53d3c7a3d66d2c909b48eaf0efda3d8ad5036"]}, @nested={0x180, 0x14, 0x0, 0x1, [@generic="aceaa684053b8145690c16bb3ffba14f2b1098562be26103cf1a3719bb233faf36c730499aec01f48f25dd30474a483876d5bacd2039a7cfbf2d83e6b9c657b318d93d748792c0fe64bdc9eb08f4049c19a907844b9dff4b711b39c0eade1091b5a9b7e853", @generic="a1fc7e94b2b3fc92ba281b6a60c19c3c716e6598a2a796c0c7f468b5d96cabb620502403a16d5f4bc58270438c7f9fabf989af2cd96ce37c025498d4bf8787e55a549822c304e311d9080ed839f22a87e333d15a4313d761654a9ab5382fdbdfe88fc05d425ebb2544ada62aa769d709e179bb716d3945f3a34aa086d2c27c7c9907a1a2c386f18f57791468b2b66d9a1b9d16d84ffbce54ae6c35628f5e562e89285978ad95576342e21fc0b495ac870696072122555d2c2e5a802b076258f2aa339c25dfef7470e6815af9a64dab90b616619375281ae7d74a872ff9d83e908272351641065fe1225d2c", @typed={0x8, 0xf3, 0x0, 0x0, @fd=r3}, @typed={0x8, 0xf8, 0x0, 0x0, @u32=0x9d7}, @typed={0x14, 0x2e, 0x0, 0x0, @ipv6=@private1}, @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}]}, @typed={0x6, 0x124, 0x0, 0x0, @str='{\x00'}, @generic="d82c85965f5a00736df37d244f0d1d1acf4bef4b1d59cadc56ad090d716256a06a71628ede82771498a92d3769475670556c2046c108702aea0c2ff16380177b94cedfc65e201783852a4da3fe272ca2599448632f3a4f4276515728a222a76cdd00daab206a5a1f518c71e7948a385b806b5abc7dff5149861cfeb5b1ac60bfc1", @generic="601f65255e374ed56b1d709d7298e1473c14a7ba4e14996c0bccc8e1317826a13b63939fbd71343caf07038ef295211460456e9e69f72f5b2fab0307262ba5c3831c2a1cd0bf6e878784d84064bd46c9d977dafe97a282", @typed={0x4, 0xa8}, @nested={0x54, 0x98, 0x0, 0x1, [@nested={0x4, 0x142}, @typed={0x14, 0x7e, 0x0, 0x0, @ipv6=@loopback}, @typed={0x7, 0x4a, 0x0, 0x0, @str='*@\x00'}, @nested={0x4, 0xef}, @generic="e9110d886731a3ed048caa39bde02b30dcf406a016a193edeef040cb6c8eefb486f867a991f171c79901af09"]}]}, 0x490}], 0x3, &(0x7f0000001dc0)=[@rights={{0x14, 0x1, 0x1, [r5]}}], 0x18}, 0x1000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000001e40)={'batadv_slave_0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001e80)={'vxcan1\x00'}) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, &(0x7f0000001f80)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001f40)={&(0x7f0000001f00)={0x14, 0x3, 0x2, 0x201, 0x0, 0x0, {0x7, 0x0, 0x4}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x40000) r6 = socket(0x1d, 0x80807, 0x729) sendto$netrom(r2, &(0x7f0000001fc0)="0e0cc03508b01a8a2f6be29a6ee8024c900c409e36abcc354bff2b9aef34e39d0799695aa865c1dbb4131820ac9bc39717e9acac029592066bbdb3783814df36a8a44ca821d4d98c8cb5e8d91deabcc9308e5f7ad2b99722e95e47c9b2e480a51c2a0683ed671c3a1c58c1a9055f6445be50bc2763912dcbd48c82169c525a8ee17edfc2ef334475d5b66604aebf75bac13bace24f802b4e89aadec6af8c003cfe720e25a65498513e982a8981bb67c2fe04cbb07aad6674341f4a1fa6e471c0", 0xc0, 0x8850, &(0x7f0000002080)={{0x3, @bcast, 0x8}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) getsockopt$inet_buf(r6, 0x0, 0x2c, &(0x7f0000002100)=""/132, &(0x7f00000021c0)=0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000002200), &(0x7f0000002240)=0x4) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000002280)) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r2, 0xf505, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f00000022c0)={0x81, 0x201, 0x3d, 0x0, 0x0}, &(0x7f0000002300)=0x10) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000002340)={r7, 0x5}, 0x8) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000002380), 0x4) write(r8, &(0x7f00000023c0)="55835d1e98a89cc30264fbf98c0d7f5c1f542ac07f599c7bf07cc9de9d", 0x1d) sendmsg$NFT_BATCH(r6, &(0x7f0000002500)={&(0x7f0000002400), 0xc, &(0x7f00000024c0)={&(0x7f0000002440)={{0x14}, [@NFT_MSG_NEWSETELEM={0x24, 0xc, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x4c}, 0x1, 0x0, 0x0, 0x4405c}, 0x44000) ioctl$IMCTRLREQ(r6, 0x80044945, &(0x7f0000002540)={0x4004, 0xffff, 0xe88d, 0xffffdd7a}) r9 = openat$cgroup(0xffffffffffffffff, &(0x7f00000026c0)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000002680)={@cgroup=r9, 0x6, 0x1, 0xffffff7d, &(0x7f0000002580)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f00000025c0)=[0x0, 0x0, 0x0], &(0x7f0000002600)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000002640)=[0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) socket$inet_udplite(0x2, 0x2, 0x88) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002840)={0x0, 0x6}, 0xc) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000002800)={@map=r10, 0x15, 0x0, 0x7fffffff, &(0x7f0000002700)=[0x0], 0x1, 0x0, &(0x7f0000002740)=[0x0], &(0x7f0000002780)=[0x0, 0x0], &(0x7f00000027c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002b00)={0x6, 0x17, &(0x7f0000002880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r10}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xa80, 0x0, 0x0, 0x0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x4}, @map_fd={0x18, 0xb, 0x1, 0x0, r11}, @ldst={0x2, 0x1, 0x1, 0xa, 0x1, 0x4, 0xfffffffffffffff0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000002940)='GPL\x00', 0x700, 0xce, &(0x7f0000002980)=""/206, 0x40f00, 0x20, '\x00', 0x0, 0x25, r8, 0x8, &(0x7f0000002a80)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002ac0)=[r10, r11, r10, r10], 0x0, 0x10, 0x6}, 0x94) ioctl$PPPIOCSMAXCID(0xffffffffffffffff, 0x40047451, &(0x7f0000002c00)=0x8) 828.720262ms ago: executing program 1 (id=5104): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000740)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12, 0xa}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "0058a4", 0x160, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x3a, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}], @time_exceed={0x3, 0x1, 0x0, 0x20, '\x00', {0x1, 0x6, "efbdd7", 0x4, 0x3c, 0x0, @private1, @mcast2, [@routing={0x84, 0xe, 0x0, 0x9, 0x0, [@local, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote]}, @routing={0x67, 0xa, 0x1, 0xf, 0x0, [@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast2, @empty, @local]}, @srh={0x0, 0xa, 0x4, 0x5, 0xbe, 0x70, 0xc7a, [@empty, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast1}, @loopback]}]}}}}}}, 0x196) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0xcb) ioctl$SIOCAX25ADDUID(r2, 0x89e1, &(0x7f0000000300)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x4, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000800000000000000080000008111620000000000d71f2a2dcf98b0427d1ebada1f3f3d1d04e95d2e5f4b9062421a99a7fdd831564a9b391d110b604cf2c826de5ed34a18591a82c83b7b3ded8c60df6939857d201740996ef465e48c8294f09058b80c1663c29e82be9b67eaa3d321c5d6b09c9108c7077888d1a3c1a09ea04cd510fd9781a3f433bf13076c5840c9e335d3bcee337fafe4ea7655682fd2b6650de31edac3361da8d676f2ee715ee48539c510c16b1fd1f7c87ca8e496e307075676f4561cb130942abc1ccb2bdb7c4d42a2525c91d6b69d1bbff1571aeb530f07c687788ace44f057806f4afe166985749b0933e95b1a207874c60853dc454fc15c6a881fdcf649cac5dc9975e8b7"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) 814.630034ms ago: executing program 4 (id=5105): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xb}, @multicast1}}}], 0x20}, 0x4008804) sendmsg$kcm(r0, &(0x7f0000000480)={&(0x7f00000002c0)=@l2tp={0x2, 0x0, @remote}, 0x80, &(0x7f0000000180)=[{&(0x7f0000002800)="3282db78e0ea55c52d87bc2a166b9e46818f5faca0b3a411e056b7928ccacd30019d925e47ecd2f92675d1d80000000000000004007d002ae359e2b5d768e71db355cf220bb96b7a64e1d2629c3e21c5decd0e2e6f107e35a8081587d3dc42a0bc0d0c5e85c355c9cbadd6e8f8014acb52d24b961a3989d5102d540829ad660fdca299e7e74a71ed264d75a3e1dfb8331f1b441972bc5941fa418cfee6139c15eda91b1ecf8887e108b15c4c7505c31efe205c875a7c854aa65bcc2e04ea6739f968547df4ae455ecd6b0566ef52705630df27d81e2a544ecc09f8c73cec559d206644acdc56c717e19f04613456b8d7a386c0a700c032d0165c3b3f5716aa7f24e6fca522f91350793d13ba7f887e7b48cd3e6e41139d0deb8de9aeac59bf750ce0000000000000000000000000f18d233cdc36efdead60d008963851bc819e1b4551b3f13bbf6c18ea0165c66f5261c9ec61f0914c6ffb8506596b61392aa5d906994608b36096a2f5c0f3fef95bf6ddb78c8d07eee5e815c9a2a3d21a054e6fd032be118e9a3f4d016db35b5048e20f1859680e5571822934769e6f9361babb4766dc073d1dabfb220daa1cf4e7206b2b8aa7b55d1396273690ec7a8d36ffbfe2a68a9547758d3ece744be07d320147c0e92e0b63f9b86ec19670ea43b7f596b347d8b9116506356d0279d21f6a0cab3056c27dec074e8dac12c1d99afcd84f82a47a0cb5093c7a221f7fb624e2f6e9eeca4e5050fc3be50bbdc62d41333b4243336a5590e49658a10b5c8624eb2410d68e64f230fdcf4689495c0bf62403c2eaad20d1d8fb185ebefac64aa0eb1d36ccacf61ec28b4ec24dba53b21ed5c5f727cccb0d614884908957138d2c30560e88f128af21ccc9fd64d229f35b2f76d0ee9e25f9e4390a55a8600449774ca116e3ba523c9c5d39abcf09a36127c17fc6194711f20307ead0d5bbbe2aa3f677156b8856411a8045159df771ac3e3d5828e359c24a59d65e92f4112fb6825536751f82e9d55e89853a03c693d418c4d2cccb61c6f60ad304a68d15fc20edaec9af4725f47c8e1724cffbd1716a7873716d278ee6f150", 0x306}, {&(0x7f0000002b40)="da752f575198baaac222d34e85893d37a6bd281687872ed9151c56f415698f3fecf56eebf5edb42ed5d54e0419b2a13128d3ad19b6eed6b450aad46baaa57203e0d4f567d8d79fe07e7b3142de43e55cf69c65db2469175cf60c82f49d0f9dc4c4dde733a14d57f4117ed2f46aea5950ff0176d73349c2808eee62ce1c7d846ffdf65211f3192dabe5b3ac1516ad90e618d0ca9e4ac2778acabeac244f2f90af2616647e5cf8ab5e2ac404ebf2a866c8a73f68ae2cc4523e63e3a1aa5ab60a23e4c47534bda546042120c5333d91fefc68226bc9149d282937797a2fe036a58c9ecd19e54bcfb85d3f75ec7c74d86be94ef6b9191e0fa86d2a9330af3f592e24bc30b84632e5121bf04abc0e12f4073f6678ad97b786cc73b8175e35eda542e3631d283a3ca6fef91607ec7dee1b4a62bae169cc8fb64e8bdef95474f0b3c526f69ce55281e18016a4785875ba99e313fd63f66cfd36234bcc6048f25bce8cce39cf709eb10e1ea88497ff7401aae0d4a7e07f14691b6c4b75dc16e2586744317ffbb9966d8bfb16efcdf6ab308426e5c1aec6a6636122ffaca89af3b03834612b93989d0bbb251a42c1b48b86ac7162ad8d5cbf3d6cfccdc590724ff6caa85320f9d5beea2370b8c0533c19422c9097a7164651ad9d8f9cca4ea7815e53fd9c42eab1cb76b451cd3b18cf31c16d01731efd1506b844f52d2f173c825a7f8814ada5f6361a48f20250df6b98965d0c85f3df3b72b2ac49f3ed52e6fa30d7d3d54d95e8bd13ec2ed4883feb3b778d624ff0c1a3ec900671acd0ff00edc7b96d1cad51fba25565c67ce0e62302dbff8f68c0de8330c44704b2f019a7afc753538ed61f3744f286735af18a8f5e7ae3fd66e4562565b31a9e5d947a06ea69ee5f0ea97d2e832e1bbc9e74498a2f99473ef8822ad0254013fefff6c4c35d84072307633de00985a6477ff6480e75171a", 0x2ae}], 0x2}, 0x8400) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x0, @local}, 0x10, &(0x7f0000000000)=[{&(0x7f00000000c0)="9d", 0x1}], 0x1}, 0x0) unshare(0x80) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)={0x14, 0x38, 0x701, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x4044840}, 0x4000000) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000040)={r4, 0xf}, 0x8) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) unshare(0x2000080) 707.836639ms ago: executing program 0 (id=5106): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbff, {{@in=@broadcast, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0, 0x80, 0x3a}, {0x0, 0x0, 0x101, 0x0, 0x0, 0x4, 0xb}, {0x2, 0x800000000008}, 0x4, 0x6e6bb8, 0x0, 0x0, 0x0, 0x3}}, 0xb8}, 0x1, 0x0, 0x0, 0x44}, 0x40) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb00148008000b"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x3a, &(0x7f0000000580)={&(0x7f0000000680)=ANY=[@ANYBLOB="8c00000010000304000009000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e0000000040000280060001000000000004000480280003800c00010040000000060000000c0001000004000000000000d8fd010006000000090000000600050088a8000008000a00", @ANYRES32=r2, @ANYBLOB="08000500", @ANYRES32=r2], 0x8c}, 0x1, 0xba01, 0x0, 0x4004001}, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'vlan0\x00', &(0x7f0000000040)=@ethtool_gstrings={0x1b, 0x6, 0xb, "b5084e808e567b410d6424"}}) 700.893993ms ago: executing program 2 (id=5107): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000280)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x3, 0x52, 0x9, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x20, 0x0, @in={0x2, 0x0, @loopback}}, @sadb_address={0x3, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e24, @dev}}, @sadb_sa={0x2}, @sadb_x_sa2={0x2, 0x13, 0x1}]}, 0x60}, 0x1, 0x7}, 0x0) 609.690653ms ago: executing program 2 (id=5108): r0 = socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000ff0f000007"], 0x48) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2d, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000af8000000060a09040000000000000000020000010900020073797a32000000000900010073797a30000000002400048020000180080001006c6f670014000280070002405c270000060001400000000040000480100001800c0001006e6f747261636b002c0001800b0001006e756d67656e00001c00028008000240000000060800034000000001080001"], 0x120}, 0x1, 0x0, 0x0, 0x4048000}, 0x8800) r4 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={0x0, 0x12f4}}, 0x0) recvmsg$unix(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)=""/44, 0x2c}], 0x1}, 0x0) r5 = accept4$unix(r4, &(0x7f00000006c0)=@abs, &(0x7f00000000c0)=0x6e, 0x800) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x2, 0xe, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x2, @local}}, @sadb_address={0x3, 0x6}, @sadb_x_policy={0x8, 0x12, 0x4, 0x2, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@mcast2, @in6=@dev={0xfe, 0x80, '\x00', 0x41}}}]}, 0x80}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r7) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)={0x44, r8, 0x1, 0x80000, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x41}}]}]}, 0x44}}, 0x40000) recvmsg$unix(r5, &(0x7f0000000400)={&(0x7f00000001c0)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/140, 0x8c}, {&(0x7f0000000300)=""/121, 0x79}, {&(0x7f0000000140)=""/54, 0x36}, {&(0x7f0000000380)=""/5, 0x5}], 0x4, &(0x7f0000000580)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x120}, 0x10000) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x47, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000010000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x4cf68d79c8eac253, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x800) sendmmsg$alg(r10, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x3}, {&(0x7f0000000300)='l3', 0x7fffef80}], 0x3}], 0x1, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r11, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) 472.038668ms ago: executing program 0 (id=5109): r0 = socket$alg(0x26, 0x5, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000000)) (async) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002880)=[{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="fc4406008e199ae0898c7a8988823619badd4fe626289574f86d0809dc46543a7397ceafd65272d07668", 0x2a}, {&(0x7f00000048c0)="4aa6ebbaadac821a088be79aff597e399b67d0e0d8b16af93d4078939730787afd7ca85bd5aa74fab362b0585f095ee8c513e864ee7783500a577bfbf648389284cb6744ba7d2e73d9d618702e712ecd6a199286326ff22d59544afc715f8eccf9b851691d3b14dac31434bfec34c03dce1c596738e7f8a4ac186af40bad817595723a21c333b257df41c2a304d5f8d5315fd712508ae16bdaf38e6393b3937971c39c171b44fc2e9ec39572aed0bd04469e4ae3a79961", 0xb7}], 0x2, 0x0, 0x0, 0x800}], 0x1, 0x4815) (async) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000980)=""/87, 0x57}], 0x1}, 0xffffff0b}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x2, 0x2101, 0x0) 450.474063ms ago: executing program 1 (id=5110): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000005000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b70300000000000085000000720000008500000011000400950000000000000006aa57cce45589f3f5ad5e0dbd6d70f841ee0a82e3abd0e3212f1a2888083a75275ca1728a3a9ae90d99ada8be6d7992e6a9610f9ee574a3d988f29bd79b9b7892e2f86dc076455d7f62af4fb108a82407ace43cd98b268072fa186c8aa97715aabe72610593a06ef42086852690e464abe81312f1879af08e9e1aae799729b003be8a7d21530dbb71ce9a"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@bridge_delneigh={0x24, 0x1e, 0x1, 0x70bd2d, 0x6, {0xa}, [@NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x24}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_route(0x10, 0x3, 0x0) 415.492442ms ago: executing program 0 (id=5111): r0 = socket(0x10, 0x3, 0x0) (async) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f00000003c0)=@newqdisc={0x80, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x50, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x6}, @TCA_CAKE_MPU={0x8, 0xe, 0x102}, @TCA_CAKE_WASH={0x8, 0xd, 0x1}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x800000}, @TCA_CAKE_AUTORATE={0x8}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_INGRESS={0xfffffead, 0xf, 0x1}]}}]}, 0x80}}, 0x4090) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180000000000000000008000540000000000500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000280)={0x24, 0x1, 0x4, 0x5, 0x0, 0x0, {}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x3}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x24}}, 0x0) (async) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) ioctl$SIOCAX25OPTRT(r5, 0x89e7, &(0x7f00000000c0)={@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, 0x56}) (async) r6 = socket(0x10, 0x803, 0x0) sendto(r6, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) recvmmsg(r6, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) (async) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x61, &(0x7f0000000100)={'filter\x00', 0x4}, 0x68) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000"], 0x7c}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae8000000000a01010000000000000000050000000900010073797a3000000000ba000600e9eec003775c64e64f439fc0b5fb34bcd039590bba579a25436e11f718b64e3e01796b9e930a3d8eefa0bccf8429a311f3ce5ec5a0a7bb9e08c60e03cbcdd726725fb9b1bd1000cf2a77ab6ab91f2294632773ea59b8de2361cdd8045c5fdb81611e843cb814e4cfe672542287ebd3b2ed48dca1a08690b05bb9bbbcc05551bd05e4c6e0625fcae04323e0f29dbad3c57456d2ca020462188e1236ebe6da1442c71ab0a8ebfaacef2710111417370a0f8cd19c5f9e1a00000900010073797a300000000014010000030a01030000000000000000050000000900010073797a30000000000800054000000000af000c008451bef8928cf9ec5c3c0fca5cedf6b9ae811484cd4abbaec9eba3118a64f7b105ab0e5c8e377ddaf98490703415da6a50c72a1434c93ef4daa32cd2b643c4ab99e8adc29f67b58cd27b71b30213e6acd60b8fa2190c3fd64f382e41b97f4b12379ce9470cbfdb02cc2a2d8e0e7aec144e2df705b37b99cafc9b141b0f3176897eba9802e14cc423ecff994b4ff320f5786bd4fba343449446d922b94ac3f8621197db4c2dc061e9278f5a000900030073797a32000000000b00070066696c746572000024000480080002406b10a6210800014000000004080002404e73b858080001400000000014000000020a030000000000000000000500000014000000110001"], 0x238}}, 0x0) close(r8) 402.421337ms ago: executing program 2 (id=5112): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x13) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0xf, &(0x7f0000000000)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @exit, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map_val={0x18, 0x3, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff}, @func={0x85, 0x0, 0x1, 0x0, 0x2}, @jmp={0x5, 0x1, 0x1, 0x3, 0x8, 0xffffffffffffffe0, 0xffffffffffffffff}, @map_fd={0x18, 0x3}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7}], &(0x7f0000000080)='syzkaller\x00', 0x8001, 0xc4, &(0x7f00000000c0)=""/196, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x3, 0x6, 0x75, 0x7}, 0x10, 0x0, 0x0, 0x4, &(0x7f00000002c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff], &(0x7f0000000300)=[{0x0, 0x1, 0xb}, {0x3, 0x1, 0x10, 0xb}, {0x5, 0x1, 0xf, 0xa}, {0x4, 0x5, 0x9, 0x1}], 0x10, 0x8}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000400)={r2, r3}, 0xc) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xff05, 0x8000000, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0x157f}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x20000840) 329.672013ms ago: executing program 1 (id=5113): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000040)={0x0, 0x1000, "32fb1cb5910c55865cc09a519d14a0b21f1ceba811a3d2fdd180a7488e605d086ca166e9a18eea4599dab331f168b745edfaa9d28260eb1f143713f7c7ee3d79885a2c4e3f3b2613211b6abaea6e82d6ecdcb0c9f2ed858c2b136cb9aa3f015519368a750a0921cddb573e449912671844ed1197178b4e0e679c8155b59111212ddaccf9ebfb47dc5734f8afa9a2f5bf810e21f61ad0652d408cac5dc427c686de43f4a0bf79c716b8473ab7c1167b74e20662cef23aa99479e615b49fc5eef5ee8793c946fbf2f819d0e51ba417c40a8c547efc66131be60245080585dbcc8f8047fd596d333c2b92fe12d3b01ad815684d197b57bb8216b6ff7ea973cbdac54fdfbbeaf2029d24e4031f328bac4d7640381c07ad6e17fc8d3fcc1a7821ea969adc0d707933a3211d391629485469be1109cd24c696ee4c9be563ab6758ef5c694108b47f08a7120f0b8d6ada15cd11a9794551272aefea48297adea84ac430694ce5b5f13270298e6fd28e87d3b84382180aa0c88e2b8d756310c06ca69f5c18018b20cde7e767e29727ed9d8a967e754863d02f8f18c2e64a282d00d64daf83d8317ce5680474081aad5590011d9cedaa692c12a5daa4630c5466dee82a48f505f297a65484cb44814d2daee0bc10dc99e130736f94adae664df5bbbc24376ca2b97b7393c3ce3a871c02d0878aab6a8b701ef6105e3f83971a9b3605b81cb0430cb2d05777c7485a327eb5b22bc1e173754bdcd8fc89629b23590116a5c910a2d7381099f61cf64f4bddbd29c483fab5f4582c1b10b4cbc1fbeb9de1af929983a97b1f2773481a077366664c65566914c860fbd1f3886d101dbb0f4dd6000dc62ed65e7db14baae27b18f249fce44d54f5f758c33042a936b860efe4dc25e5e902ab2eb2d4c4672995012824eb8d57c2d40e80b807fc9ef68eefdcda041fd8a196a30b55a239de5004129b82ad3a8b34a1246a6af52f8774d35794925736d2772074353472b5fba250ed7946006f36079c0923f563eb67c5d702bfbf01e9eba892cd2cba4bece2a615f797b17ba6458e99d44bd9c0035ae7e5e02a960d69ee5e2b2f98be271687be4fdbb1b2799a221212feec7aebf0ad5e0ed243a4a71a49753dbb46ced0165947b6c871c521321e8e9e3d4b2b7ff861fe55d1b98ab944cbf80f628c6947a2b3de94ac0575f618dfb2ff0136a13d2a4798b0e7324112b53525ffbb6399f5d78c8c43a9675cc316382acedb44757a3e8a77fdf339dce097c05ac46e2afbe54e7cbf5f01b459a3ed2eb30ec8411cfe6faacbd5fd5a188055ce5f77531628ca16082c616804aaecad981df3becefa40eb63592ead5c60b2168770e99356db93849e5a035a2a4dd6da4fdd18e80360c2e8190c63bd9319a31971c2276af10a5c46838fb2748d553e77314f78c15c447d32370ad316cde560ff7e770b7f3d4f4dc81d073c76e24733fb13588b3ed572638a23db252dc3dcfa6f9f14aab95370452f71fb8cbdb200b583b32aa6b02bdb7c7e7da73c728496fd8dd4d70a12d00ffaba807e012559443623d03c160672eaa8cb3acd79cbb1be91a75beb64cf58ad6986847a1666995d02f429aa70db9360225773afe645bf0d26d4b91062de743b91708ed655bb1dfe60da4cb5b3f18a3ab0b01077abfde263ec3c71d82e2df0b56519761e323c49c06eea6a97c0722509b0372725e770b5daaaf974c7f3513c7f46ebcede7121f75944006b7c674256871e3dbb57baf33f0673bbc35188469bd7252a12ae0e8be17ea6fadb45d0a822f807fa3c117e8e4f91751619c8f28316ff7e5b823b1c6f987a1feb33209b75e9327ed53df15fd108397d067333cdc07348285f2d73c89e73c44c30763c1ecdafb75cadf449fd4b7cb4eaa02b45f8d26b76c75e25929ed423003d431c6eac56eb911354a1655e2bbc66ad2482fc6cafc49901308989a92b7d2a58b4b96eea5149449e16e5934d5a0b41774b696666b6aa63767c9f2a77570ae03f4463574eae09f434f36fe3a70e45d6432cd25b173f5ad1dd638ea423b172d97ccbef71da64ce2edfacb12705647d5b75a4106952240b1ae13cc46bce4fcd79f1e32442a238c6b6bed162cbd2abfdd7f1055a30ea923e3bd59afc1a586e4ce3f4a16ed11aca639946cff5e7ab69a462d4755a5399e7d0ed0f0f279d7a83393b3f0d330c87c17e57eae1b5b1e979cf4b91a65c1db4f2517db71d2f404c891ede14cde38b1cd0213631416b90315cb816debdf29ea610d80bfde03ca7bd8ba1ba2c1cefa4065516e8a8fe69f9a86cb983ffbcba27ede9a6395a305cdedc4072ef62c17d0d3b41212724240baeb66c07789af8c864273ec28f7310117150005ac0c42a760f17919126e2f424db9cfcee076e141c6e6a1fbe04afb471710801527bfa1368e961892a039c17310770d56f0480d8b75440321237b46327c88e9fc27f509f4f8045e5842d7255ecaab08e5cf34eaaf38620177458274da7b786efa95eb13dba0d2175cceeece512a8183bd23820667a9dfe0a7fc8b3bced2723f529134d3e0c1ac5bef0812537350e0d305ee335b3d4275dc441c442b8c026d2e0d3134bfc23c4600a796fba7275ea338b909299d81e6cd1b7a7466043f07a1b13da5e11b903c347c908df0639f1bb360d1d16d145e4e2271d5494432b3a856841e6d96f33dc569dd71c250f9722bcafe47af0f5d5f54aceaf8949865198d44d2a3153a91134e731d6f51f3c68590fbccdb44561f0706fe1820859840886c2b0bffc2b4a8a82c8c456b0d159501acf9cc467ffa07c0fd49826232c3326a0da33eeffc8b83a46a1a58a76b14e99f6742399e039cbb905b537ef49fbaa127f6402bb6e9b38b10241352a0ba84c97304fc5ccc6ed8a8499d14d7c46a9527a8a36598a154e040fd75402cd385f7464e4f38ca0519fb75ea75e3fd0d9d2beeaa2035ddba94fc659f57760247a0096a48493d2d0b8c419a62c0d579e464f09b78dce58806f853408a939363451ed15552a9be3c076afd46b0c9caa18b617ee2dd66c3e6f495c2304526ca3a6743e76f9dc24ff388c7880cc509148ee54d4423fd86e46cec28ebdd860121aefe5ba8bf2e1ca3005410f119cafdaf70ae2f2ff7910179a5d88e161509476c4f76ab158ee012f2f6943fce705b270b26a8f0a02b52ef7100fb4cac11e8a4b16b94e47513fd457473a669ac0819f6edf6819eac1600a47747e59a56442c81c47c9152cefceed1c60f1c3ddaf541f6d61f42ebb5dbd0839501848c000f36dfb5b787fe3c08382fb0bc88f9626bb6418871405edc29b2d72924e20a13e06deed44c3fe4c27ab945391b9cff7fabae0168ed47da24d3d5c0a827c2e6a02d3b44e83238d32341c5fa50a2bb98febaea6a843b6fc04aa037d4e910dd3c4ede086d25b9b9adc4f233ce49c9c537e10f82caf30e56ab7f73620af05d34cd874a391b19bc15d0e46b8290cfad6605c67dc4432c9c23545fe7b6cfddd0b6452c9145ff7a3ffe9e92cf1344624b87359264533bc94188caedc92746a711643b32fc45b4f47cf8f9fa22472dedb8bffa99fb66959faa003d499ea142181798e0fabf468d045d58756531a70c71429c3bb95d4b1aa9e50229a3476919edc5d1c0d68311de3c311c5870b788da4feb818e93d10c805217fa5b309615eb5e90b9047d16d5d09a3fec55486b910500c7288ec5a44bb16dc8ebfa95ea70f970f005508a9fdfc16409a7dc9397e8d22d74869b9ee9ba501cacacddfadbf52b8301f7abe9fc303a8767c1671698ff60aefe2ac8a22953fc5a3356d58c6f1279ac046ec19d806708cd4abe5005c7bc9f27fbd98657ea1b1e84fe21167c5d386828d695b946510157b671baf4b9b291750bd54ba38bdd6b0090f5a17d817025d73b56d14975e78b2d762085702a7b9b773a2fd8ec37f8055a43e9ba3d2de7b93b8ac9e1abd8200c88348df5b8ec77ab44526c2889fab5bce60db28c786cf63320b249c0a240c294b75a209017b8836a6c0071f5904131aa2d04e521cc83d3a6f9eb3b283d907c85bdebe6fc7f6f3deb8a6f04fa550c970db3d71bde987b5910085ce6618ed2f236003dff2baae774cc37088d2dd045cc86a5d0a6f55db8741b7de3a1f096aac5b97017a4aad8e6330ba5d81bfb5a07a03db8abd7b69d80d960188591083eb9000828389a18295035b45b9538f3ee7d4b91cfe61514d323eb8864c6ead279a3932f0340cdd154583247991ad46f847430bb9583264205a4e1977a85d9018a81943a80ca5aa3766fc53e7f91008ec25908a28e3bccdc04e39c768bc47eed602661031f1669ca9e98b08878d8e0cfb8199c73392457e245909347892508b1452b30b527260c411f37804aa56c398f6316a3fe6df8d2eb7de0dfda017d64ad289c86e6ae99fdef2bfedaf194a29b35c23907021557fc24460e107ff391f7f5f514531412112f9133ca2255915ae9221adc1e0ceff53018def2508ea9fcda5e045367aac2d6ed0f7615314e6b6975208477b7460b8801ffdb7f0c2e6a3691207870ed70c7e8882d0f0921ee70dfbe2fcde2f4c165e11484be13c13f354baa997e7e5d0d05d99df1a87b0ccda5d95d8661536df34bafedabdc205d6dda9b02805970a46b42fd548d689e94423678a0a1b3a3d58094c421202fe5824eda83ffd22c52b0017fc8fa2ce1cca02bae779df5454a417f981d477036fbd118a14f6eaa16091af439baef5c9bf82208435e60bc3d229641562cc779d28f6d5785fc3d83054aa1d1748e8e5315f97c5704315640d52091e12a98442b1d13a8067c5e94370de2459f46935da500cdb964c26fba81f0aac13911c49da7fe3a0d4307eb2b9b62dd70c567008547c1525cbc9f2bf27a9f360d84afb808b99359cc2b39a691a2c100fd6531f284716f095a868d6f30e63d0f7e9157e3b710a858293a3b67413cf2c01904ff651ccf6c22d00837c2698adf4b04f2ddbcdefbaa1c968ab157d9e421371cde0ae04ac6821f3bf345e6966c87f9ae5d171ab3e21e320ebcd7d770df5ac3bbfdb92edc4a8065a9edd41387de5f77e48ff784edcd40dd4514f2995a17a8d87944c055ee9bc879437a3385bef31e56c4b087600ce5018d8fac8e1c6ffb4dc16d271ba0c03de997cdecf8968b0fdc0dfd200d315a8346a260081b832eb6774633b0f78452e2c3cd9c20ef6d2e4c40aa657ec3ae859335a4053289db210fad316fe86f1e15acef7e84a2af416a8eb216cbdece49fc0328a13c6e29f3d92b07162cbc1e9d9724a86e4b50ddc4dc53dbc81302cd2e16ca8f7f895e28856525fa802380a27774faeacaadba9524895c1900dcf90a3f8debb1bcb18a0502106dee46f5d7d9cacc4500db6af1e436786e5be88d18661ce026459e3d9639d7071edd757a7645af47b2eb40207f9c95f74eb25f8521eedda38a5e4194df398ead065cac74fa69958686485d9afafe401fbb6b16cbc4e4adf1bacc25d71e0536060863b2b207bddbed658395dfc6153ebe139f1341f1eb3cd0f0137be69860e868b7529c1f6cf8f76e4c4fe6de0e7fb9786400b8c5cbce3ef499ee94e64d704e1744556b9e9f39a30b219b67ac5880fa975e223382b6152697e83c5cd60aaeecc47fd953e8305d4c9d01fca508409f8044be4ba907574462c8b4385074c7bf720bea46115759a62ad3279838d45bcde30755d0cbc94545402f7324e80db595b0cffc2989d634099f875f4e1e7940b5f78cbfa3ebdb959fd2845f9edd0694a875d9396f595dbf1afa9e4f3f9014caf56acd341e4c06c"}, &(0x7f0000001080)=0x1008) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x8, 0xdd, 0xff}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000d40)={{r2}, &(0x7f0000000b80), &(0x7f0000000d00)=r3}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r4}, 0x10) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1, 0x6, 0x5, 0x7, 0xc1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000100), 0x3f, r5}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r5, &(0x7f0000000340), 0x0}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x75}]}, &(0x7f0000000380)='syzkaller\x00', 0x4}, 0x94) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000010c0)=@assoc_value={r1, 0xc}, 0x8) 232.608099ms ago: executing program 0 (id=5114): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800), 0x6}, 0x80) unshare(0x20000400) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x6, &(0x7f0000000000)=0x1, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000080)={'syztnl0\x00', 0x0, 0x29, 0x6, 0x6, 0xd, 0x20, @empty, @private1, 0x10, 0x8, 0x71c}}) bind$xdp(r2, &(0x7f0000000040)={0x2c, 0x4, r4, 0x3d, r3}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="4400000010000304000000000000000000000400", @ANYRES32=0x0, @ANYRES8, @ANYRESHEX=r2, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT=r3, @ANYRESDEC=0x0], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x8044) syz_extract_tcp_res(&(0x7f0000000100), 0x9, 0x0) 229.134506ms ago: executing program 2 (id=5115): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x7c}}, 0x0) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='nr0\x00', 0x10) sendmmsg$inet(r0, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)='\f', 0x1}], 0x1, 0x0, 0x0, 0x2000000}}], 0xfdef, 0x0) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x149a40, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f2800800180004ac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000140)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000013b80)=ANY=[@ANYBLOB="280000001b1401"], 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x10) write(r3, &(0x7f00000000c0)="510003000000", 0x6) r4 = socket$kcm(0x2, 0x8, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, 0x0) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r5, 0x8) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000080)=ANY=[], 0x10448) socket$rds(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r6, 0x0) r7 = accept4(r5, 0x0, 0x0, 0x80000) setsockopt(r7, 0x84, 0x81, &(0x7f00000001c0)="020000000980ffff", 0x8) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="0000000002034a94030008000400ffffffffffffaaaaaaaaaabb080045f0002c00000000002f9078ac1e0001e0000001000065580018907804e700000000000086ddffff000000009821d9f02f84492bbbd4be4a7a07f7270fbaebe2e58bf3bdde78b12eb4751b464bae68804e044ea798fa712ba4216e80c8c72337f678"], 0x48) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000080)={'syzkaller1\x00'}) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) 224.282202ms ago: executing program 1 (id=5116): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0xf) socket$phonet_pipe(0x23, 0x5, 0x2) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_VALIDATION={0x5}, @IFLA_MACSEC_INC_SCI={0x5, 0x9, 0x1}]}}}]}, 0x44}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000440)="ea61", 0x2}], 0x1, &(0x7f00000002c0)=ANY=[], 0x18}, 0xc800) setsockopt$sock_int(r3, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r3, &(0x7f0000001140), 0x700, 0x2, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) r5 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r6) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x12, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000005c0)=ANY=[@ANYRES32=r8, @ANYRES32=r7, @ANYBLOB="05"], 0x10) close(r7) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r9, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r8, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000540)=r7}, 0x20) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/26], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r11}, &(0x7f0000000100), 0x0}, 0x20) close(r6) ioctl$EXT4_IOC_MIGRATE(r5, 0x6609) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r12, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001800010000000000fddbdf251d01040008000a00", @ANYRES32=r13, @ANYBLOB='\b\x00\t\x00', @ANYRES32=r13, @ANYBLOB="51bf06cba8d514b295ab1656f203401b229307e319f5b624f1b582aae79060f3b41af4258c88c0ec72a788d2ad7a27287a9e45b5bee5a57550d785eb1e9dae1709fd7e725e5a0c4b12a5c603c0eed42bf9bfec5e7648e50f01a0af1d244ebea506385b7c2099d48c01d4ca470c296091dd4fed0c6e85d5e0a045f259f9ef7a846c170a69b75896fc6da6f34396f303d2d3a0ffe8b450400b6ac541b660df3117885be80b0b98b87580e23d7a32140c26ec2d97e2"], 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61123c00000000006113500000000000bf200000000000001500000008ffffffbd03010000000000cf300000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f2d4301000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9755ba08554bb4f2278af6d71d79a5e12810a089dc1d4681d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a6538b89dc6c60bf70d742a81b72bab8395fa64810b5b1bfd3782519518c51231422bb8fab4d4d897db2c544c0ec50b8eac8c63d2b1cd06a39702bd547f5ebaa6954f01cef3c9bacec15e2e3b2bd352e93a22adfe8efe33ff2f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564b8f8a621483fb2a5ff221e0d831d64759d17b8c59d0f2b0727f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d54574164bbea3e7b7f8a13cce7014137f250370b8a70ae3eaf6d6f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf4b1be6f29358d4f5dfec405bde000000000000000000000000000000902e647cc5962eccaad64429335f3ce2a10ce72da82875427c1d16db24dca08487ba41a3fb337f8432d8176a515229e32ee11a1dd23dac038f989eafdd67f60b63f7be4d1bf325b57335b9973c73bfa89517a98b1fc15f8a2713718feb01059d8b570a0000e3b2a93bd745a74f9bf7f7abc5d15d56331055cc0820c5c9d676d92557c4e47cfbe27f91f0eb18e21dfdab3c84ec11377fbbfd1e000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) 139.998754ms ago: executing program 0 (id=5117): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000200)={@private0, 0x0, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0xff, 0x9}, 0x20) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, &(0x7f0000000280)=0x6, 0x4) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000300)={@local, 0x0, 0x0, 0x1}, &(0x7f00000004c0)=0x20) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000002c0)='bic\x00', 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r2, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="00000000080000000100"/21, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000066090100000003e71600000006000000180100002020702500000000002020207b9af8ff00000000ad9100000000000037010000f8ffffffb702000008000000b70300000400000056000000060000003c30000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x94) socket$inet6(0xa, 0x1, 0x0) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000200)={@private0, 0x0, 0x0, 0x1, 0x1}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0xff, 0x9}, 0x20) (async) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, &(0x7f0000000280)=0x6, 0x4) (async) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000300)={@local, 0x0, 0x0, 0x1}, &(0x7f00000004c0)=0x20) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) (async) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000002c0)='bic\x00', 0x4) (async) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) (async) sendmsg$inet(r2, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) (async) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="00000000080000000100"/21, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000066090100000003e71600000006000000180100002020702500000000002020207b9af8ff00000000ad9100000000000037010000f8ffffffb702000008000000b70300000400000056000000060000003c30000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x94) (async) 0s ago: executing program 3 (id=5118): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair(0x1f, 0x3, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, r2, 0x91837b213d495847, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x48800}, 0x20040080) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000023000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000009b000000850000002300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0x14, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r4 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in=@multicast1, 0xfffd, 0x0, 0x4e20, 0x0, 0x2}, {0xfffffffffffffffe, 0x4, 0x1, 0x0, 0x0, 0x9, 0xf0e}, {0x3, 0xb, 0x4053e5, 0x20}, 0xa, 0x1, 0x1, 0x0, 0x1, 0x2}, {{@in6=@loopback, 0x1, 0x32}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x3502, 0x1, 0x0, 0x0, 0x2, 0x1}}, 0xe8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) kernel console output (not intermixed with test programs): .056474][T18039] __nla_validate_parse: 1 callbacks suppressed [ 456.056495][T18039] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3341'. [ 456.453147][T17709] veth0_macvtap: entered promiscuous mode [ 456.469693][T17709] veth1_macvtap: entered promiscuous mode [ 456.723219][T18051] veth1_to_batadv: entered promiscuous mode [ 456.787904][T18053] netlink: 'syz.1.3346': attribute type 1 has an invalid length. [ 456.910060][T18062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3346'. [ 456.915251][T18053] 8021q: adding VLAN 0 to HW filter on device bond1 [ 456.919900][T18062] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3346'. [ 457.017003][T18059] 8021q: adding VLAN 0 to HW filter on device bond1 [ 457.048211][T18059] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 457.065130][T18059] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 457.117940][T18060] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3348'. [ 457.134347][T18060] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3348'. [ 457.157759][T17709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 457.295532][T18060] gretap0: entered promiscuous mode [ 457.338549][T17709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 457.503966][ T8109] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.523836][ T8109] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.606816][ T8109] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.694918][ T8109] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.779495][T18085] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3352'. [ 458.050876][T18094] netlink: 196 bytes leftover after parsing attributes in process `syz.3.3355'. [ 458.064665][T18094] netlink: 'syz.3.3355': attribute type 10 has an invalid length. [ 458.133235][T18094] syz_tun: entered promiscuous mode [ 458.183498][T18098] netlink: 'syz.0.3357': attribute type 11 has an invalid length. [ 458.188907][T18096] pim6reg1: entered promiscuous mode [ 458.196668][T18096] pim6reg1: entered allmulticast mode [ 458.239046][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.267540][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.325066][ T73] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.341243][ T73] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.350595][T18103] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3356'. [ 458.378712][T18100] IPv4: Oversized IP packet from 127.202.26.0 [ 458.461556][T18103] bond2 (unregistering): Released all slaves [ 458.500734][T18110] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3360'. [ 458.836018][T18124] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3365'. [ 458.844784][T18129] netlink: 'syz.0.3369': attribute type 2 has an invalid length. [ 459.129276][T18139] syzkaller0: entered promiscuous mode [ 459.135193][T18139] syzkaller0: entered allmulticast mode [ 459.223044][T18143] sch_fq: defrate 0 ignored. [ 459.876196][T18181] netlink: 'syz.0.3383': attribute type 10 has an invalid length. [ 459.931963][T18181] 8021q: adding VLAN 0 to HW filter on device bond0 [ 459.949029][T18181] team0: Port device bond0 added [ 460.052956][T18196] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 462.079428][T18200] geneve2: entered promiscuous mode [ 462.084807][T18200] geneve2: entered allmulticast mode [ 464.036981][T18291] netlink: 'syz.1.3408': attribute type 1 has an invalid length. [ 464.206043][T18296] __nla_validate_parse: 4 callbacks suppressed [ 464.206063][T18296] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3410'. [ 464.238021][T18294] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3409'. [ 464.384456][T18302] openvswitch: netlink: Duplicate or invalid key (type 0). [ 464.399944][T18302] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 464.596552][T18311] netlink: 'syz.3.3417': attribute type 11 has an invalid length. [ 464.629229][T18311] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3417'. [ 464.645787][T18320] tipc: Started in network mode [ 464.651087][T18320] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 464.658740][T18320] tipc: Enabled bearer , priority 0 [ 465.274624][T18355] IPv6: Can't replace route, no match found [ 465.568124][T18364] dvmrp8: entered allmulticast mode [ 465.573640][T18368] IPv6: Can't replace route, no match found [ 465.634887][T18357] openvswitch: netlink: Flow key attr not present in new flow. [ 465.644441][T18356] dvmrp8: left allmulticast mode [ 465.657621][T14835] tipc: Node number set to 11578026 [ 465.701952][T18376] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3432'. [ 465.712933][T18376] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3432'. [ 465.735219][T18376] 8021q: VLANs not supported on ip_vti0 [ 465.760964][T18380] netlink: 308 bytes leftover after parsing attributes in process `syz.3.3433'. [ 465.772044][T18380] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3433'. [ 465.793360][T18380] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 466.394736][ T9682] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.612038][T18412] block nbd1: server does not support multiple connections per device. [ 466.624190][T18412] block nbd1: shutting down sockets [ 466.661735][T18415] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3444'. [ 467.306148][T18444] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3449'. [ 467.364268][T18445] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 467.476196][T18451] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3451'. [ 467.695631][T18444] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 467.710008][T18444] bond0 (unregistering): Released all slaves [ 469.602876][T18532] __nla_validate_parse: 3 callbacks suppressed [ 469.602897][T18532] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3474'. [ 469.719500][T18536] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3474'. [ 471.379546][T18535] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3475'. [ 471.517596][T18540] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3476'. [ 471.719216][T18560] netlink: 5 bytes leftover after parsing attributes in process `syz.1.3483'. [ 471.745117][T18560] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 471.754547][T18560] 0ªî{X¹¦: entered allmulticast mode [ 471.760850][T18560] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 472.268598][T18575] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3487'. [ 472.788207][T18599] macsec2: entered promiscuous mode [ 472.817438][T18607] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3492'. [ 472.840000][T18599] macsec2: entered allmulticast mode [ 473.733743][T18630] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3500'. [ 473.918280][T18641] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3501'. [ 473.945634][T18630] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3500'. [ 474.369806][T18666] netlink: 'syz.3.3508': attribute type 3 has an invalid length. [ 474.522203][ T7207] IPVS: starting estimator thread 0... [ 474.628055][T18672] IPVS: using max 23 ests per chain, 55200 per kthread [ 474.933650][T18686] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3515'. [ 474.958635][T18686] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3515'. [ 475.038868][T18691] policy can only be matched on NF_INET_PRE_ROUTING [ 475.038893][T18691] unable to load match [ 475.043908][T18693] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3517'. [ 475.075998][T18693] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3517'. [ 475.108170][T18696] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3515'. [ 475.147817][T18698] team0: No ports can be present during mode change [ 475.643568][T18705] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3521'. [ 475.867975][T18713] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 475.879072][T18718] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 475.887455][ T5986] IPVS: starting estimator thread 0... [ 475.977833][T18719] IPVS: using max 26 ests per chain, 62400 per kthread [ 476.879243][T18751] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3531'. [ 478.004432][T18776] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3538'. [ 478.603586][T18800] netlink: 'syz.0.3545': attribute type 10 has an invalid length. [ 478.611925][T18801] netlink: 'syz.0.3545': attribute type 10 has an invalid length. [ 478.628647][T18800] team0: Port device dummy0 added [ 478.639454][T18800] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3545'. [ 478.645004][T18803] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 478.686118][T18803] bpq0: entered promiscuous mode [ 478.768278][T18806] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 478.840322][T18809] netlink: 'syz.3.3544': attribute type 4 has an invalid length. [ 478.971204][T18811] syzkaller1: entered promiscuous mode [ 478.987633][T18811] syzkaller1: entered allmulticast mode [ 479.051659][T18814] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3548'. [ 479.297734][T18822] IPVS: set_ctl: invalid protocol: 51 172.20.20.170:20000 [ 479.500417][T18835] netlink: 'syz.3.3555': attribute type 1 has an invalid length. [ 479.508758][T18835] netlink: 'syz.3.3555': attribute type 4 has an invalid length. [ 480.182516][T18854] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.195798][T18858] netlink: 'syz.3.3562': attribute type 1 has an invalid length. [ 480.214005][T18858] __nla_validate_parse: 4 callbacks suppressed [ 480.214024][T18858] netlink: 232 bytes leftover after parsing attributes in process `syz.3.3562'. [ 480.413893][T18854] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.466382][T18865] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3565'. [ 480.656850][T18854] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.710540][T18886] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3569'. [ 480.753439][T18884] netlink: 'syz.4.3568': attribute type 1 has an invalid length. [ 480.771227][T18884] netlink: 'syz.4.3568': attribute type 1 has an invalid length. [ 480.825920][T18854] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.917115][T18886] 8021q: adding VLAN 0 to HW filter on device bond1 [ 480.963463][T18891] bond1: entered promiscuous mode [ 480.970121][T18891] macvlan2: entered promiscuous mode [ 480.975552][T18891] macvlan2: entered allmulticast mode [ 480.984693][T18891] bond1: entered allmulticast mode [ 480.993293][T18891] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 481.326771][T18899] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3571'. [ 481.367840][T18903] netlink: 'syz.1.3572': attribute type 21 has an invalid length. [ 481.374167][T18899] netlink: 216 bytes leftover after parsing attributes in process `syz.0.3571'. [ 481.384991][T18899] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3571'. [ 481.394189][T18899] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3571'. [ 481.401270][ T9679] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.424240][T18903] netlink: 'syz.1.3572': attribute type 6 has an invalid length. [ 481.448029][T18903] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3572'. [ 481.459186][T18906] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3572'. [ 481.473522][ T9679] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.511442][ T9679] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.515016][T18909] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3572'. [ 481.555478][ T8120] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.578351][T18943] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 482.743080][T18945] tipc: Enabled bearer , priority 0 [ 482.794839][T18945] syzkaller0: entered promiscuous mode [ 482.821377][T18945] syzkaller0: entered allmulticast mode [ 482.921300][T18945] tipc: Resetting bearer [ 482.985705][T18944] tipc: Resetting bearer [ 483.068898][T18944] tipc: Disabling bearer [ 483.103748][T18961] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 483.832637][T18985] sysfs: cannot create duplicate filename '/class/ieee80211/!å' [ 483.847876][T18985] CPU: 1 UID: 0 PID: 18985 Comm: syz.4.3593 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 483.847910][T18985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 483.847922][T18985] Call Trace: [ 483.847931][T18985] [ 483.847941][T18985] dump_stack_lvl+0x189/0x250 [ 483.847978][T18985] ? __pfx_dump_stack_lvl+0x10/0x10 [ 483.848006][T18985] ? __pfx__printk+0x10/0x10 [ 483.848041][T18985] ? kernfs_path_from_node+0x2f/0x290 [ 483.848074][T18985] ? kernfs_path_from_node+0x250/0x290 [ 483.848094][T18985] ? kernfs_path_from_node+0x2f/0x290 [ 483.848120][T18985] sysfs_warn_dup+0x8e/0xa0 [ 483.848142][T18985] sysfs_do_create_link_sd+0xc0/0x110 [ 483.848167][T18985] device_add_class_symlinks+0x1cf/0x240 [ 483.848203][T18985] device_add+0x475/0xb50 [ 483.848239][T18985] wiphy_register+0x1ba6/0x28d0 [ 483.848289][T18985] ? __pfx_wiphy_register+0x10/0x10 [ 483.848313][T18985] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 483.848355][T18985] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 483.848392][T18985] ieee80211_register_hw+0x3425/0x4080 [ 483.848446][T18985] ? ieee80211_register_hw+0x1431/0x4080 [ 483.848490][T18985] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 483.848527][T18985] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 483.848562][T18985] ? __hrtimer_setup+0x187/0x210 [ 483.848580][T18985] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 483.848611][T18985] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 483.848677][T18985] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 483.848699][T18985] ? trace_kmalloc+0x1f/0xd0 [ 483.848723][T18985] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 483.848752][T18985] ? kstrndup+0xbf/0x160 [ 483.848789][T18985] hwsim_new_radio_nl+0xea4/0x1b10 [ 483.848814][T18985] ? __pfx___nla_validate_parse+0x10/0x10 [ 483.848858][T18985] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 483.848905][T18985] ? __nla_parse+0x40/0x60 [ 483.848937][T18985] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 483.848970][T18985] genl_family_rcv_msg_doit+0x215/0x300 [ 483.849001][T18985] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 483.849039][T18985] ? bpf_lsm_capable+0x9/0x20 [ 483.849073][T18985] ? security_capable+0x7e/0x2e0 [ 483.849106][T18985] genl_rcv_msg+0x60e/0x790 [ 483.849135][T18985] ? __pfx_genl_rcv_msg+0x10/0x10 [ 483.849155][T18985] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 483.849207][T18985] netlink_rcv_skb+0x208/0x470 [ 483.849230][T18985] ? __lock_acquire+0xab9/0xd20 [ 483.849261][T18985] ? __pfx_genl_rcv_msg+0x10/0x10 [ 483.849284][T18985] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 483.849338][T18985] ? down_read+0x1ad/0x2e0 [ 483.849371][T18985] genl_rcv+0x28/0x40 [ 483.849400][T18985] netlink_unicast+0x82c/0x9e0 [ 483.849437][T18985] ? __pfx_netlink_unicast+0x10/0x10 [ 483.849464][T18985] ? netlink_sendmsg+0x642/0xb30 [ 483.849488][T18985] ? skb_put+0x11b/0x210 [ 483.849521][T18985] netlink_sendmsg+0x805/0xb30 [ 483.849578][T18985] ? __pfx_netlink_sendmsg+0x10/0x10 [ 483.849610][T18985] ? aa_sock_msg_perm+0xf1/0x1d0 [ 483.849642][T18985] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 483.849664][T18985] ? __pfx_netlink_sendmsg+0x10/0x10 [ 483.849692][T18985] __sock_sendmsg+0x21c/0x270 [ 483.849744][T18985] ____sys_sendmsg+0x505/0x830 [ 483.849783][T18985] ? __pfx_____sys_sendmsg+0x10/0x10 [ 483.849840][T18985] ? import_iovec+0x74/0xa0 [ 483.849875][T18985] ___sys_sendmsg+0x21f/0x2a0 [ 483.849910][T18985] ? __pfx____sys_sendmsg+0x10/0x10 [ 483.849993][T18985] ? __fget_files+0x2a/0x420 [ 483.850023][T18985] ? __fget_files+0x3a0/0x420 [ 483.850076][T18985] __x64_sys_sendmsg+0x19b/0x260 [ 483.850110][T18985] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 483.850156][T18985] ? rcu_is_watching+0x15/0xb0 [ 483.850185][T18985] ? do_syscall_64+0xbe/0x3b0 [ 483.850218][T18985] do_syscall_64+0xfa/0x3b0 [ 483.850242][T18985] ? lockdep_hardirqs_on+0x9c/0x150 [ 483.850273][T18985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.850294][T18985] ? clear_bhb_loop+0x60/0xb0 [ 483.850321][T18985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.850341][T18985] RIP: 0033:0x7fe13058ebe9 [ 483.850362][T18985] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 483.850381][T18985] RSP: 002b:00007fe131467038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 483.850405][T18985] RAX: ffffffffffffffda RBX: 00007fe1307b6180 RCX: 00007fe13058ebe9 [ 483.850421][T18985] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000a [ 483.850435][T18985] RBP: 00007fe130611e19 R08: 0000000000000000 R09: 0000000000000000 [ 483.850447][T18985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 483.850460][T18985] R13: 00007fe1307b6218 R14: 00007fe1307b6180 R15: 00007ffd4572d4b8 [ 483.850497][T18985] [ 484.639910][T18993] tipc: Enabled bearer , priority 0 [ 484.669745][T18993] syzkaller0: entered promiscuous mode [ 484.683434][T18993] syzkaller0: entered allmulticast mode [ 484.717909][T18993] tipc: Resetting bearer [ 484.756916][T18993] tipc: Resetting bearer [ 484.784850][T18993] tipc: Disabling bearer [ 485.243182][T19011] ip6erspan0: entered allmulticast mode [ 485.268274][T19018] __nla_validate_parse: 3 callbacks suppressed [ 485.268293][T19018] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3603'. [ 485.744310][T19036] bridge_slave_0: left allmulticast mode [ 485.762177][T19036] bridge_slave_0: left promiscuous mode [ 485.787600][T19036] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.926426][T19036] bridge_slave_1: left allmulticast mode [ 485.938430][T19036] bridge_slave_1: left promiscuous mode [ 485.944472][T19036] bridge0: port 2(bridge_slave_1) entered disabled state [ 485.965527][T19036] bond0: (slave bond_slave_0): Releasing backup interface [ 486.031999][T19036] bond0: (slave bond_slave_1): Releasing backup interface [ 486.038716][T19042] netlink: 248 bytes leftover after parsing attributes in process `syz.4.3606'. [ 486.088028][T19036] team0: Port device team_slave_0 removed [ 486.107068][T19036] team0: Port device team_slave_1 removed [ 486.116456][T19036] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 486.132995][T19036] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 486.142590][T19036] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 486.150579][T19036] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 486.254255][T19037] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 487.272820][ T9680] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.304886][ T9680] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.344349][ T9680] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.358600][T19088] netlink: 592 bytes leftover after parsing attributes in process `syz.3.3617'. [ 487.383869][ T9680] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.390374][T19087] netlink: 592 bytes leftover after parsing attributes in process `syz.3.3617'. [ 487.543474][T19100] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3619'. [ 487.711598][T19107] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3624'. [ 487.760093][T19110] delete_channel: no stack [ 487.883820][T19116] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3625'. [ 488.071284][T19118] netlink: 'syz.3.3628': attribute type 16 has an invalid length. [ 488.085172][T19118] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.3628'. [ 488.250504][T19123] batman_adv: batadv0: Adding interface: gretap1 [ 488.257180][T19123] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 488.295183][T19123] batman_adv: batadv0: Interface activated: gretap1 [ 488.518613][T19136] netlink: 144 bytes leftover after parsing attributes in process `syz.2.3633'. [ 488.768015][T19145] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3636'. [ 488.980460][T19163] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 489.064568][T19168] netlink: 'syz.0.3640': attribute type 19 has an invalid length. [ 489.135116][T19168] netlink: 'syz.0.3640': attribute type 19 has an invalid length. [ 489.332308][T19175] syz_tun: entered allmulticast mode [ 489.522897][T19175] syz_tun: left allmulticast mode [ 489.583179][T19192] netlink: 'syz.0.3646': attribute type 18 has an invalid length. [ 490.106345][T19212] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 490.189149][T19207] vlan2: entered promiscuous mode [ 490.194635][T19207] vlan2: entered allmulticast mode [ 490.215572][T19216] netlink: 'syz.0.3655': attribute type 6 has an invalid length. [ 490.238135][T19207] hsr_slave_1: entered allmulticast mode [ 490.295816][T19208] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 490.346243][T19216] __nla_validate_parse: 5 callbacks suppressed [ 490.346264][T19216] netlink: 176 bytes leftover after parsing attributes in process `syz.0.3655'. [ 490.453704][T19225] IPv6: addrconf: prefix option has invalid lifetime [ 490.508729][T19227] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3655'. [ 490.891364][T19234] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 490.949892][T19240] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3660'. [ 491.135139][T19252] netlink: zone id is out of range [ 491.142232][T19254] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3662'. [ 491.156477][T19252] netlink: zone id is out of range [ 491.212952][T19252] netlink: zone id is out of range [ 491.244983][T19252] netlink: zone id is out of range [ 491.262489][T19252] netlink: zone id is out of range [ 491.276672][T19252] netlink: zone id is out of range [ 491.286560][T19252] netlink: zone id is out of range [ 491.291808][T19256] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3663'. [ 491.302753][T19252] netlink: zone id is out of range [ 491.330187][T19252] netlink: zone id is out of range [ 491.353036][T19261] netlink: zone id is out of range [ 491.377590][T19252] netlink: zone id is out of range [ 491.378067][T19261] netlink: zone id is out of range [ 491.387647][T19252] netlink: zone id is out of range [ 491.413109][T19252] netlink: zone id is out of range [ 491.613529][T19268] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3665'. [ 491.629509][T19270] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3666'. [ 491.640765][T19270] 8021q: VLANs not supported on caif0 [ 491.662898][T19268] 8021q: VLANs not supported on nlmon0 [ 491.703705][T19272] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3668'. [ 491.714161][T19274] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3667'. [ 491.722782][T19275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3669'. [ 491.750419][T19269] Bluetooth: MGMT ver 1.23 [ 491.996213][T19286] netlink: 'syz.4.3670': attribute type 1 has an invalid length. [ 496.141890][T19360] __nla_validate_parse: 7 callbacks suppressed [ 496.141911][T19360] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3695'. [ 496.660949][T19384] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3703'. [ 496.728018][T19387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3704'. [ 496.744964][T19387] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3704'. [ 496.779189][T19390] lo speed is unknown, defaulting to 1000 [ 496.791401][T19390] lo speed is unknown, defaulting to 1000 [ 496.797711][T19388] syzkaller0: entered promiscuous mode [ 496.803407][T19388] syzkaller0: entered allmulticast mode [ 496.816436][T19390] lo speed is unknown, defaulting to 1000 [ 497.130564][T19406] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3706'. [ 497.217117][T19409] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3706'. [ 497.285453][ T51] Bluetooth: hci5: link tx timeout [ 497.291971][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 497.301894][ T5864] Bluetooth: hci5: link tx timeout [ 497.307095][ T5864] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 497.323054][T19412] netlink: 'syz.3.3709': attribute type 1 has an invalid length. [ 497.324376][T19409] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3706'. [ 497.451595][T19390] infiniband syz0: set active [ 497.456580][ T7206] lo speed is unknown, defaulting to 1000 [ 497.466730][T19390] infiniband syz0: added lo [ 497.475815][T19390] syz0: rxe_create_cq: returned err = -12 [ 497.486347][T19390] infiniband syz0: Couldn't create ib_mad CQ [ 497.493920][T19390] infiniband syz0: Couldn't open port 1 [ 497.506828][T19396] mpoa:mpoad_close: () going down [ 497.569838][T19390] RDS/IB: syz0: added [ 497.588382][T19390] smc: adding ib device syz0 with port count 1 [ 497.607343][T19390] smc: ib device syz0 port 1 has pnetid [ 497.662490][ T7218] lo speed is unknown, defaulting to 1000 [ 497.668754][T19390] lo speed is unknown, defaulting to 1000 [ 497.906773][T19434] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3715'. [ 497.944445][T19434] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3715'. [ 498.247747][T19441] (unnamed net_device) (uninitialized): option ad_select: invalid value (34) [ 498.300689][T19390] lo speed is unknown, defaulting to 1000 [ 498.627512][T19453] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3722'. [ 498.981323][T19390] lo speed is unknown, defaulting to 1000 [ 499.134439][ T30] audit: type=1800 audit(1754803367.377:10): pid=19478 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3732" name="memory.events" dev="tmpfs" ino=591 res=0 errno=0 [ 499.225028][ T30] audit: type=1804 audit(1754803367.467:11): pid=19485 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.3732" name="/newroot/112/memory.events" dev="tmpfs" ino=591 res=1 errno=0 [ 499.367656][ T5864] Bluetooth: hci5: command 0x0406 tx timeout [ 499.664716][T19390] lo speed is unknown, defaulting to 1000 [ 499.821387][T19501] tipc: Enabled bearer , priority 0 [ 499.846021][T19501] net_ratelimit: 171 callbacks suppressed [ 499.846043][T19501] syzkaller0: mtu less than device minimum [ 500.258015][T19524] veth1_macvtap: left promiscuous mode [ 500.407622][T19390] lo speed is unknown, defaulting to 1000 [ 500.456575][T19531] netlink: 'syz.1.3747': attribute type 7 has an invalid length. [ 500.527460][T19531] netlink: 'syz.1.3747': attribute type 8 has an invalid length. [ 500.558788][T19536] tipc: Enabling of bearer rejected, already enabled [ 500.571067][T19536] syzkaller0: entered promiscuous mode [ 500.576597][T19536] syzkaller0: entered allmulticast mode [ 500.918930][T19553] Unsupported ieee802154 address type: 0 [ 500.937320][ T7225] tipc: Node number set to 4090286033 [ 500.955716][T19390] lo speed is unknown, defaulting to 1000 [ 501.189631][T19555] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 501.250355][T19390] lo speed is unknown, defaulting to 1000 [ 501.493068][T19390] lo speed is unknown, defaulting to 1000 [ 501.708251][T19568] __nla_validate_parse: 5 callbacks suppressed [ 501.708273][T19568] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3758'. [ 501.731648][T19568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3758'. [ 501.743152][T19568] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3758'. [ 501.753044][T19568] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3758'. [ 501.762345][T19568] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3758'. [ 501.776674][T19572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3759'. [ 501.786099][T19572] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3759'. [ 501.817900][T19573] vlan0: entered promiscuous mode [ 501.880809][T19573] team0: Port device vlan0 added [ 501.896632][T19568] tipc: Enabled bearer , priority 0 [ 501.926986][T19575] netlink: 'syz.0.3760': attribute type 3 has an invalid length. [ 501.958449][T19575] syz_tun: entered allmulticast mode [ 501.977816][T19575] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3760'. [ 502.000695][T19574] syz_tun: left allmulticast mode [ 502.032404][T19577] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 502.070662][T19390] lo speed is unknown, defaulting to 1000 [ 502.136293][T19581] netem: change failed [ 502.304287][T19586] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3764'. [ 502.421059][T19592] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3766'. [ 502.490077][T19390] lo speed is unknown, defaulting to 1000 [ 502.772444][T19598] netlink: 'syz.4.3767': attribute type 4 has an invalid length. [ 502.785993][T19598] netlink: 'syz.4.3767': attribute type 4 has an invalid length. [ 503.018174][ T7218] tipc: Node number set to 3963675112 [ 503.696216][T19631] netlink: 'syz.2.3776': attribute type 1 has an invalid length. [ 503.995588][T19632] tipc: Enabled bearer , priority 0 [ 504.096785][T19634] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 504.169943][T19638] veth3: entered promiscuous mode [ 504.190436][T19638] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 504.302184][T19628] tipc: Resetting bearer [ 504.320043][T19636] syzkaller0: entered promiscuous mode [ 504.325569][T19636] syzkaller0: entered allmulticast mode [ 504.392377][T19623] tipc: Resetting bearer [ 504.482001][T19623] tipc: Disabling bearer [ 505.010105][T19667] tipc: Enabled bearer , priority 0 [ 505.225585][T19667] syzkaller0: entered promiscuous mode [ 505.247472][T19667] syzkaller0: entered allmulticast mode [ 505.304809][T19667] tipc: Resetting bearer [ 505.343084][T19686] sit0: entered promiscuous mode [ 505.409700][T19686] netlink: 'syz.4.3784': attribute type 1 has an invalid length. [ 505.506925][T19688] bridge0: entered promiscuous mode [ 505.512845][T19688] macsec0: entered promiscuous mode [ 505.520274][T19688] bridge0: port 3(macsec0) entered blocking state [ 505.532160][T19688] bridge0: port 3(macsec0) entered disabled state [ 505.577575][T19688] macsec0: entered allmulticast mode [ 505.583016][T19688] bridge0: entered allmulticast mode [ 505.622571][T19688] macsec0: left allmulticast mode [ 505.654628][T19688] bridge0: left allmulticast mode [ 505.664985][T19688] bridge0: left promiscuous mode [ 505.755330][ T30] audit: type=1107 audit(1754803373.997:12): pid=19690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ï;{SÏÌOŠº™(Ít:Ê…w³ì#>|ÃLxxÈ–6' [ 505.804582][T19665] tipc: Resetting bearer [ 506.108791][ T7218] tipc: Node number set to 166965715 [ 507.630401][T19665] tipc: Disabling bearer [ 507.828991][T19720] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 508.146398][T19735] lo speed is unknown, defaulting to 1000 [ 508.292432][T19739] __nla_validate_parse: 5 callbacks suppressed [ 508.292451][T19739] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3796'. [ 508.308314][T19739] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3796'. [ 508.317511][T19743] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3797'. [ 508.317688][T19743] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 508.317721][T19743] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 508.490326][T19748] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3800'. [ 508.509568][T19748] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3800'. [ 508.534747][T19748] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3800'. [ 508.794888][T19757] netlink: 'syz.3.3802': attribute type 13 has an invalid length. [ 508.817679][T19759] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3803'. [ 508.828356][T19757] netlink: 'syz.3.3802': attribute type 17 has an invalid length. [ 508.864793][T19757] gretap0: left promiscuous mode [ 508.878451][T19757] erspan0: left allmulticast mode [ 508.896845][T19757] syz_tun: left promiscuous mode [ 508.929517][T19757] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 509.002675][T19757] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3802'. [ 509.124172][T19760] lo speed is unknown, defaulting to 1000 [ 509.223598][T19766] block nbd1: server does not support multiple connections per device. [ 509.233485][T19766] block nbd1: shutting down sockets [ 509.257503][T19767] netlink: 'syz.0.3804': attribute type 9 has an invalid length. [ 509.888634][T19779] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3808'. [ 509.910855][T19779] netlink: 'syz.0.3808': attribute type 11 has an invalid length. [ 509.924097][T19779] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3808'. [ 510.822063][T19806] veth1_to_bond: entered allmulticast mode [ 510.911852][T19811] lo speed is unknown, defaulting to 1000 [ 511.537501][T19832] syzkaller0: entered promiscuous mode [ 511.543564][T19832] syzkaller0: entered allmulticast mode [ 511.581925][T19800] veth1_to_bond: left allmulticast mode [ 512.072526][T19841] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.430691][T19841] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.586345][T19860] syz_tun: entered allmulticast mode [ 512.613493][T19869] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 512.633007][T19865] dvmrp1: entered allmulticast mode [ 512.719474][T19841] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.754996][T19854] syz_tun: left allmulticast mode [ 512.896362][ T7218] IPVS: starting estimator thread 0... [ 513.007454][T19882] IPVS: using max 29 ests per chain, 69600 per kthread [ 513.035036][T19841] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.062620][T19887] tipc: New replicast peer: 255.255.255.255 [ 513.073895][T19887] tipc: Enabled bearer , priority 26 [ 513.220901][ T9682] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.235120][ T9682] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.302951][ T9662] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.343809][ T9682] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.450537][T19901] pimreg3: entered allmulticast mode [ 513.575543][T19908] __nla_validate_parse: 5 callbacks suppressed [ 513.575565][T19908] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3842'. [ 513.813833][T19910] netlink: 'syz.3.3843': attribute type 1 has an invalid length. [ 513.842774][T19913] netlink: 'syz.3.3843': attribute type 1 has an invalid length. [ 514.249869][T19925] syzkaller0: left promiscuous mode [ 514.255138][T19925] syzkaller0: left allmulticast mode [ 514.272459][T19925] syzkaller0: entered promiscuous mode [ 514.285237][T19925] syzkaller0: entered allmulticast mode [ 514.393529][T19928] netlink: 'syz.0.3847': attribute type 1 has an invalid length. [ 514.402468][T19928] netlink: zone id is out of range [ 514.454086][T19930] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3850'. [ 514.484861][T19930] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3850'. [ 514.564761][T19933] tipc: New replicast peer: 255.255.255.255 [ 514.738377][T19933] tipc: Enabled bearer , priority 26 [ 514.933931][T19934] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3851'. [ 515.413769][T19939] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3853'. [ 515.884151][T19962] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3858'. [ 516.655805][T19981] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3863'. [ 516.748691][T19982] netlink: 4660 bytes leftover after parsing attributes in process `syz.2.3863'. [ 516.874091][T19986] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3863'. [ 517.276982][T19992] netlink: 248 bytes leftover after parsing attributes in process `syz.1.3866'. [ 517.376527][T20002] 0ªî{X¹¦: left allmulticast mode [ 517.544624][T20002] 8021q: adding VLAN 0 to HW filter on device bond0 [ 517.570871][T20002] 8021q: adding VLAN 0 to HW filter on device team0 [ 517.640573][T20002] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 518.788032][T20053] lo speed is unknown, defaulting to 1000 [ 519.067878][T20068] __nla_validate_parse: 2 callbacks suppressed [ 519.067901][T20068] netlink: 84 bytes leftover after parsing attributes in process `syz.3.3886'. [ 519.122067][T20068] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3886'. [ 519.157305][T20068] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3886'. [ 519.315604][T20077] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3889'. [ 519.663664][T20093] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3895'. [ 519.673094][T20090] syzkaller0: entered promiscuous mode [ 519.679283][T20090] syzkaller0: entered allmulticast mode [ 519.696739][T20088] tipc: Enabled bearer , priority 0 [ 519.730017][T20098] netlink: 209816 bytes leftover after parsing attributes in process `syz.3.3895'. [ 519.932996][T20103] openvswitch: netlink: Key 6 has unexpected len 4 expected 2 [ 519.950010][T20088] tipc: Resetting bearer [ 520.025578][T20088] tipc: Disabling bearer [ 520.421509][T20115] lo speed is unknown, defaulting to 1000 [ 520.852251][T20128] vlan2: entered allmulticast mode [ 520.877244][T20128] veth1: entered allmulticast mode [ 521.988251][T20184] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input10 [ 522.056897][T20186] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3922'. [ 522.086797][T20187] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 522.151939][T20182] lo speed is unknown, defaulting to 1000 [ 522.644132][T20210] netlink: 212936 bytes leftover after parsing attributes in process `syz.0.3927'. [ 522.742435][T20213] tipc: Started in network mode [ 522.755266][T20213] tipc: Node identity 7aafcd9dbcb, cluster identity 4711 [ 522.765081][T20213] tipc: Enabled bearer , priority 0 [ 522.793959][T20214] syzkaller0: entered promiscuous mode [ 522.813273][T20214] syzkaller0: entered allmulticast mode [ 522.840014][T20178] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 522.906213][T20214] tipc: Resetting bearer [ 522.945393][T20214] tipc: Disabling bearer [ 523.011263][T20225] netlink: 'syz.0.3930': attribute type 11 has an invalid length. [ 523.042596][T20225] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3930'. [ 523.284305][T20234] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3934'. [ 523.476686][T20245] bridge_slave_0: left allmulticast mode [ 523.487520][T20245] bridge_slave_0: left promiscuous mode [ 523.493404][T20245] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.551472][T20245] bridge_slave_1: left allmulticast mode [ 523.562936][T20245] bridge_slave_1: left promiscuous mode [ 523.587750][T20245] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.626310][T20245] bond0: (slave bond_slave_0): Releasing backup interface [ 523.642775][T20245] bond0: (slave bond_slave_1): Releasing backup interface [ 523.681926][T20255] netlink: 'syz.4.3937': attribute type 10 has an invalid length. [ 523.685984][T20245] team0: Port device team_slave_0 removed [ 523.705290][T20245] team0: Port device team_slave_1 removed [ 523.715927][T20245] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.724244][T20245] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 523.741596][T20245] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.749467][T20245] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 523.764600][T20245] team0: Port device vlan0 removed [ 523.795495][ T9662] tipc: Resetting bearer [ 523.865011][T20255] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 524.216787][T20278] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 524.311590][T20279] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 524.333291][T20281] lo speed is unknown, defaulting to 1000 [ 524.406196][T20279] __nla_validate_parse: 2 callbacks suppressed [ 524.406240][T20279] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3946'. [ 524.533890][T20289] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3947'. [ 524.781598][T20305] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3951'. [ 525.058208][T20275] lo speed is unknown, defaulting to 1000 [ 525.058588][T20311] netlink: 'syz.2.3954': attribute type 1 has an invalid length. [ 525.178705][T20311] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 525.241242][T20318] bond0: entered promiscuous mode [ 525.276984][T20318] bond0: entered allmulticast mode [ 525.304104][T20318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 525.339862][T20324] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3957'. [ 525.456124][T20330] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3959'. [ 525.643048][T20336] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3961'. [ 525.654177][T20336] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3961'. [ 525.664522][T20336] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3961'. [ 525.703137][T20291] lo speed is unknown, defaulting to 1000 [ 526.190626][T20355] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 526.221088][T20355] netlink: 212936 bytes leftover after parsing attributes in process `syz.3.3966'. [ 526.278278][T20305] lo speed is unknown, defaulting to 1000 [ 527.107980][T20367] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3970'. [ 527.120352][T20367] netlink: 'syz.2.3970': attribute type 21 has an invalid length. [ 527.613070][T20394] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 528.395643][T20403] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 528.763795][T20408] lo speed is unknown, defaulting to 1000 [ 528.775178][T20412] netlink: 'syz.3.3978': attribute type 6 has an invalid length. [ 528.926829][T20412] bridge2: entered promiscuous mode [ 528.939379][T20412] macsec2: entered promiscuous mode [ 528.944842][T20412] macsec2: entered allmulticast mode [ 528.967983][T20412] bridge2: entered allmulticast mode [ 528.987386][T20412] bridge2: port 1(macsec2) entered blocking state [ 528.997730][T20412] bridge2: port 1(macsec2) entered disabled state [ 529.026155][T20412] bridge2: left allmulticast mode [ 529.035857][T20412] bridge2: left promiscuous mode [ 529.288954][T20380] Bluetooth: hci1: command 0x0406 tx timeout [ 529.295662][T20380] Bluetooth: hci3: command 0x0406 tx timeout [ 529.359209][T20416] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 529.436825][T20422] netlink: 'syz.1.3980': attribute type 10 has an invalid length. [ 529.458487][T20422] __nla_validate_parse: 5 callbacks suppressed [ 529.458506][T20422] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3980'. [ 529.487680][T20428] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3982'. [ 529.515724][T20422] team0: Port device geneve0 added [ 529.710385][ T8109] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.755437][ T8109] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.797390][ T8109] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.806169][ T8109] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.031238][T20454] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 530.443562][T20469] netlink: 116 bytes leftover after parsing attributes in process `syz.4.3995'. [ 530.955429][T20485] lo speed is unknown, defaulting to 1000 [ 531.003111][T20493] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4002'. [ 531.388717][T20499] vcan0: tx drop: invalid sa for name 0x0000000000000080 [ 531.425411][T20500] netlink: 216 bytes leftover after parsing attributes in process `syz.1.4004'. [ 531.463119][T20500] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4004'. [ 531.472256][T20500] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4004'. [ 531.502135][T20487] netlink: 'syz.4.4001': attribute type 1 has an invalid length. [ 531.520261][T20499] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4005'. [ 531.566831][T20487] 8021q: adding VLAN 0 to HW filter on device bond3 [ 531.874010][T20504] bond3: (slave veth5): Enslaving as an active interface with a down link [ 531.887782][T20500] netlink: 'syz.1.4004': attribute type 4 has an invalid length. [ 531.930465][T20508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4006'. [ 531.946914][T20487] vlan3: entered allmulticast mode [ 531.974369][T20487] veth1: entered allmulticast mode [ 531.983620][T20487] veth1: entered promiscuous mode [ 532.054237][T20487] veth1: left promiscuous mode [ 532.068201][T20487] bond3: (slave vlan3): making interface the new active one [ 532.075824][T20513] netlink: 'syz.0.4008': attribute type 8 has an invalid length. [ 532.077288][T20487] veth1: entered promiscuous mode [ 532.083662][T20513] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4008'. [ 532.096368][T20487] vlan3: entered promiscuous mode [ 532.103583][T20487] bond3: (slave vlan3): Enslaving as an active interface with an up link [ 532.430627][T20522] mac80211_hwsim hwsim47 wlan1: entered allmulticast mode [ 532.540150][T20522] netlink: 'syz.0.4010': attribute type 10 has an invalid length. [ 532.548443][T20522] mac80211_hwsim hwsim47 wlan1: left allmulticast mode [ 532.794851][T20530] lo speed is unknown, defaulting to 1000 [ 533.652394][T20557] syzkaller0: entered promiscuous mode [ 533.658498][T20557] syzkaller0: entered allmulticast mode [ 533.901986][T20561] IPVS: set_ctl: invalid protocol: 29 0.0.0.0:20001 [ 534.486938][T20583] __nla_validate_parse: 7 callbacks suppressed [ 534.486960][T20583] netlink: 92 bytes leftover after parsing attributes in process `syz.3.4030'. [ 534.523983][T20585] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4031'. [ 534.561767][T20590] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4030'. [ 534.587602][T20590] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4030'. [ 534.609196][T20590] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 534.732509][T20597] tipc: Enabling of bearer rejected, already enabled [ 534.762308][T20597] tipc: Resetting bearer [ 535.504299][T20618] lo speed is unknown, defaulting to 1000 [ 535.531464][T20623] netlink: 324 bytes leftover after parsing attributes in process `syz.2.4045'. [ 535.553876][T20621] netlink: 292 bytes leftover after parsing attributes in process `syz.1.4044'. [ 535.580400][T20621] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4044'. [ 535.720776][T20628] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4047'. [ 535.885570][T20634] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4049'. [ 535.903718][T20634] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4049'. [ 536.504173][T20660] netlink: 'syz.1.4055': attribute type 29 has an invalid length. [ 536.562619][T20662] netlink: 'syz.0.4056': attribute type 13 has an invalid length. [ 536.582425][T20662] netlink: 'syz.0.4056': attribute type 17 has an invalid length. [ 536.647832][ T5864] Bluetooth: hci5: command 0x0406 tx timeout [ 536.680831][T20662] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 536.975640][T20683] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 537.138572][T20683] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 537.178070][ T8111] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 537.188025][ T8111] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 537.323586][ T8111] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 537.362280][ T8111] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 537.665622][T20697] tipc: Enabled bearer , priority 0 [ 537.684871][T20697] syzkaller0: entered promiscuous mode [ 537.697291][T20697] syzkaller0: entered allmulticast mode [ 537.749089][T20697] tipc: Resetting bearer [ 537.792774][T20696] tipc: Resetting bearer [ 537.826714][T20696] tipc: Disabling bearer [ 538.003576][T20702] netlink: 'syz.2.4068': attribute type 4 has an invalid length. [ 538.377650][T20723] nbd4: detected capacity change from 0 to 63 [ 538.388405][ T5864] block nbd4: Receive control failed (result -32) [ 538.726796][T20737] mac80211_hwsim hwsim37 wlan0: entered promiscuous mode [ 538.750459][T20737] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 538.778648][T20734] tipc: Enabled bearer , priority 0 [ 538.794486][T20737] netlink: 'syz.3.4079': attribute type 1 has an invalid length. [ 538.798885][T20734] syzkaller0: entered promiscuous mode [ 538.811464][T20734] syzkaller0: entered allmulticast mode [ 538.856069][T20737] bond2: (slave gretap2): making interface the new active one [ 538.865788][T20737] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 538.905864][T20734] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 538.972966][T20734] tipc: Resetting bearer [ 539.054629][T20732] tipc: Resetting bearer [ 539.081721][T20732] tipc: Disabling bearer [ 539.162112][T20749] lo speed is unknown, defaulting to 1000 [ 539.213836][T20753] veth0_virt_wifi: entered allmulticast mode [ 539.753555][T20783] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 539.963022][T20791] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 541.405028][T20859] netlink: 'syz.3.4116': attribute type 1 has an invalid length. [ 541.416980][T20859] netlink: 'syz.3.4116': attribute type 2 has an invalid length. [ 541.492896][T20862] __nla_validate_parse: 13 callbacks suppressed [ 541.492916][T20862] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4118'. [ 541.547970][T20864] veth1_to_batadv: entered promiscuous mode [ 541.554470][T20864] macvlan3: entered allmulticast mode [ 541.569497][T20864] veth1_to_batadv: entered allmulticast mode [ 541.578860][T20864] veth1_to_batadv: left allmulticast mode [ 541.584905][T20864] veth1_to_batadv: left promiscuous mode [ 541.741043][T20871] tipc: Enabling of bearer rejected, failed to enable media [ 541.963135][T20885] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4127'. [ 541.983363][T20888] netlink: 'syz.1.4128': attribute type 13 has an invalid length. [ 541.994783][T20887] netlink: 'syz.4.4129': attribute type 2 has an invalid length. [ 542.008462][T20885] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4127'. [ 542.009475][T20888] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4128'. [ 542.033027][T20887] netlink: 'syz.4.4129': attribute type 8 has an invalid length. [ 542.041185][T20887] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4129'. [ 542.339009][T20902] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4132'. [ 542.485920][T20908] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4133'. [ 543.067836][T20928] block nbd1: server does not support multiple connections per device. [ 543.078303][T20928] block nbd1: shutting down sockets [ 543.200827][ T8120] vlan3: left promiscuous mode [ 543.290559][T20933] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4140'. [ 543.312305][T20933] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4140'. [ 543.343183][T20933] netlink: 'syz.4.4140': attribute type 14 has an invalid length. [ 543.359906][T20933] netlink: 'syz.4.4140': attribute type 11 has an invalid length. [ 543.442159][T20942] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4142'. [ 543.479348][T20943] siw: device registration error -23 [ 543.835626][T20960] netlink: 'syz.1.4147': attribute type 1 has an invalid length. [ 545.281214][T21042] netlink: 'syz.4.4170': attribute type 4 has an invalid length. [ 547.207396][ T51] Bluetooth: hci5: command 0x0406 tx timeout [ 547.325258][T21109] __nla_validate_parse: 72 callbacks suppressed [ 547.325281][T21109] netlink: 172 bytes leftover after parsing attributes in process `syz.2.4190'. [ 547.438965][T21115] netlink: 'syz.3.4193': attribute type 1 has an invalid length. [ 547.446849][T21115] netlink: 'syz.3.4193': attribute type 3 has an invalid length. [ 547.457077][T21117] netlink: 'syz.2.4194': attribute type 1 has an invalid length. [ 547.481932][T21117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4194'. [ 547.497266][T21115] netlink: 'syz.3.4193': attribute type 1 has an invalid length. [ 547.510738][T21115] netlink: 204 bytes leftover after parsing attributes in process `syz.3.4193'. [ 547.525710][T21115] NCSI netlink: No device for ifindex 0 [ 547.573082][T21120] tipc: Enabled bearer , priority 10 [ 547.661789][T21126] netlink: 844 bytes leftover after parsing attributes in process `syz.3.4197'. [ 547.876543][T21132] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input11 [ 548.138231][T21144] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4203'. [ 548.290659][T21158] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4207'. [ 548.491075][T21168] syz.0.4211: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 548.536388][T21168] CPU: 0 UID: 0 PID: 21168 Comm: syz.0.4211 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 548.536421][T21168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 548.536433][T21168] Call Trace: [ 548.536441][T21168] [ 548.536451][T21168] dump_stack_lvl+0x189/0x250 [ 548.536487][T21168] ? __pfx_dump_stack_lvl+0x10/0x10 [ 548.536521][T21168] ? __pfx__printk+0x10/0x10 [ 548.536551][T21168] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 548.536577][T21168] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 548.536604][T21168] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 548.536633][T21168] warn_alloc+0x214/0x310 [ 548.536666][T21168] ? stack_depot_save_flags+0x40/0x860 [ 548.536693][T21168] ? __pfx_warn_alloc+0x10/0x10 [ 548.536727][T21168] ? kasan_save_track+0x4f/0x80 [ 548.536753][T21168] ? xskq_create+0x56/0x170 [ 548.536773][T21168] ? xsk_init_queue+0xb0/0x110 [ 548.536792][T21168] ? xsk_setsockopt+0x4dc/0x8d0 [ 548.536810][T21168] ? do_sock_setsockopt+0x17c/0x1b0 [ 548.536838][T21168] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 548.536864][T21168] ? do_syscall_64+0xfa/0x3b0 [ 548.536887][T21168] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.536918][T21168] __vmalloc_node_range_noprof+0x125/0x12f0 [ 548.536985][T21168] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 548.537023][T21168] ? __kasan_kmalloc+0x93/0xb0 [ 548.537052][T21168] vmalloc_user_noprof+0xad/0xf0 [ 548.537076][T21168] ? xskq_create+0xbf/0x170 [ 548.537097][T21168] xskq_create+0xbf/0x170 [ 548.537124][T21168] xsk_init_queue+0xb0/0x110 [ 548.537151][T21168] xsk_setsockopt+0x4dc/0x8d0 [ 548.537181][T21168] ? __pfx_xsk_setsockopt+0x10/0x10 [ 548.537202][T21168] ? __pfx_aa_sk_perm+0x10/0x10 [ 548.537233][T21168] ? aa_sock_opt_perm+0xff/0x1b0 [ 548.537264][T21168] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 548.537285][T21168] ? __pfx_xsk_setsockopt+0x10/0x10 [ 548.537316][T21168] do_sock_setsockopt+0x17c/0x1b0 [ 548.537351][T21168] __x64_sys_setsockopt+0x13f/0x1b0 [ 548.537387][T21168] do_syscall_64+0xfa/0x3b0 [ 548.537411][T21168] ? lockdep_hardirqs_on+0x9c/0x150 [ 548.537435][T21168] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.537455][T21168] ? clear_bhb_loop+0x60/0xb0 [ 548.537482][T21168] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.537501][T21168] RIP: 0033:0x7fcd0598ebe9 [ 548.537520][T21168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 548.537540][T21168] RSP: 002b:00007fcd06736038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 548.537563][T21168] RAX: ffffffffffffffda RBX: 00007fcd05bb5fa0 RCX: 00007fcd0598ebe9 [ 548.537578][T21168] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000006 [ 548.537590][T21168] RBP: 00007fcd05a11e19 R08: 0000000000000004 R09: 0000000000000000 [ 548.537603][T21168] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 548.537616][T21168] R13: 00007fcd05bb6038 R14: 00007fcd05bb5fa0 R15: 00007ffc93ce04c8 [ 548.537653][T21168] [ 548.843738][T21168] Mem-Info: [ 548.874456][T21168] active_anon:4175 inactive_anon:0 isolated_anon:0 [ 548.874456][T21168] active_file:1753 inactive_file:40025 isolated_file:0 [ 548.874456][T21168] unevictable:1643 dirty:88 writeback:0 [ 548.874456][T21168] slab_reclaimable:13136 slab_unreclaimable:148422 [ 548.874456][T21168] mapped:29199 shmem:1536 pagetables:949 [ 548.874456][T21168] sec_pagetables:0 bounce:0 [ 548.874456][T21168] kernel_misc_reclaimable:0 [ 548.874456][T21168] free:1278732 free_pcp:13393 free_cma:0 [ 549.003106][T21175] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4213'. [ 549.022767][T21168] Node 0 active_anon:17464kB inactive_anon:0kB active_file:7012kB inactive_file:159904kB unevictable:6352kB isolated(anon):0kB isolated(file):0kB mapped:117532kB dirty:352kB writeback:0kB shmem:5372kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12548kB pagetables:3788kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 549.157399][ T5967] tipc: Node number set to 3323973021 [ 549.163290][T21168] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 549.237394][T21168] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 549.300869][T21168] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 549.312923][T21168] Node 0 DMA32 free:1200720kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:19948kB inactive_anon:0kB active_file:7012kB inactive_file:158336kB unevictable:9400kB writepending:352kB present:3129332kB managed:2557520kB mlocked:7852kB bounce:0kB free_pcp:32472kB local_pcp:17960kB free_cma:0kB [ 549.409736][T21168] lowmem_reserve[]: 0 0 1 1 1 [ 549.434597][T21168] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 549.477995][T21168] lowmem_reserve[]: 0 0 0 0 0 [ 549.497262][T21168] Node 1 Normal free:3898732kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:12992kB local_pcp:9152kB free_cma:0kB [ 549.573702][T21168] lowmem_reserve[]: 0 0 0 0 0 [ 549.620497][T21168] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 549.698519][T21168] Node 0 DMA32: 1126*4kB (UE) 380*8kB (UE) 271*16kB (UME) 404*32kB (UME) 59*64kB (UM) 96*128kB (UM) 57*256kB (UM) 22*512kB (UM) 16*1024kB (UME) 11*2048kB (UME) 266*4096kB (UM) = 1195176kB [ 549.749173][T21168] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 549.769276][T21168] Node 1 Normal: 161*4kB (UME) 49*8kB (UME) 40*16kB (UME) 187*32kB (UME) 64*64kB (UME) 13*128kB (UME) 3*256kB (ME) 3*512kB (UM) 2*1024kB (ME) 1*2048kB (E) 947*4096kB (UM) = 3898732kB [ 549.801962][T21168] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 549.830155][T21168] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 549.848180][T21186] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4206'. [ 549.860174][T21168] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 549.881740][T21168] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 549.899697][T21168] 45529 total pagecache pages [ 549.914878][T21168] 0 pages in swap cache [ 549.919560][T21168] Free swap = 124996kB [ 549.923736][T21168] Total swap = 124996kB [ 549.935851][T21168] 2097051 pages RAM [ 549.943503][T21168] 0 pages HighMem/MovableOnly [ 549.952801][T21168] 425645 pages reserved [ 549.962912][T21168] 0 pages cma reserved [ 550.011615][T21188] veth0_vlan: entered allmulticast mode [ 550.268261][T21206] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 550.602523][T21228] netlink: 248 bytes leftover after parsing attributes in process `syz.3.4227'. [ 551.134739][T21255] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 551.430226][ T30] audit: type=1800 audit(1754803419.677:13): pid=21267 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4237" name="memory.events" dev="tmpfs" ino=1391 res=0 errno=0 [ 551.461430][T21251] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 551.484787][T21267] netlink: 'syz.4.4237': attribute type 10 has an invalid length. [ 551.534556][T21267] team0: Port device dummy0 added [ 551.675198][T21275] netlink: 'syz.3.4239': attribute type 12 has an invalid length. [ 551.676890][T21276] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4240'. [ 552.462728][T21311] __nla_validate_parse: 2 callbacks suppressed [ 552.462752][T21311] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4251'. [ 552.516125][T21314] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4250'. [ 552.572225][T21314] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4250'. [ 552.574867][T21318] syzkaller0: entered promiscuous mode [ 552.591739][T21314] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4250'. [ 552.636106][T21318] syzkaller0: entered allmulticast mode [ 552.667432][T21322] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4253'. [ 552.731797][T21314] vxcan3: entered allmulticast mode [ 552.953598][T21330] batadv_slave_1: entered promiscuous mode [ 553.344944][T21347] lo speed is unknown, defaulting to 1000 [ 553.375795][T21349] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4262'. [ 553.393295][T21346] tipc: Enabled bearer , priority 0 [ 553.427079][T21355] syzkaller0: entered promiscuous mode [ 553.440459][T21355] syzkaller0: entered allmulticast mode [ 553.578910][T21366] tipc: Resetting bearer [ 553.615966][T21345] tipc: Resetting bearer [ 553.651318][T21351] vcan0: tx drop: invalid sa for name 0xfffffffffffffffc [ 553.659349][T21345] tipc: Disabling bearer [ 554.690543][T21394] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4272'. [ 554.757455][T21395] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4272'. [ 556.357012][T21399] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.418536][T21409] netlink: 'syz.0.4277': attribute type 10 has an invalid length. [ 556.457756][T21409] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 556.480536][T21411] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4278'. [ 556.490767][T21409] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 556.515976][T21399] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.588107][T21411] netlink: 'syz.1.4278': attribute type 8 has an invalid length. [ 556.659697][T21399] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.753822][T21399] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.902691][T21425] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4283'. [ 556.926741][ T8109] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.007469][ T9670] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.124970][ T8109] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.205868][T21436] syz_tun: entered promiscuous mode [ 557.215118][T21436] syz_tun: left promiscuous mode [ 557.258296][ T9670] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.382069][T21453] netlink: 'syz.2.4290': attribute type 1 has an invalid length. [ 557.815285][T21471] lo speed is unknown, defaulting to 1000 [ 557.937859][T21482] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 557.952431][T21483] __nla_validate_parse: 7 callbacks suppressed [ 557.952453][T21483] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4297'. [ 557.986805][T21482] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4298'. [ 558.312582][T21493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4302'. [ 558.407819][T21493] tls_set_device_offload_rx: netdev not found [ 558.861666][T21517] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4308'. [ 558.889486][T21517] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4308'. [ 558.922986][T21517] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4308'. [ 558.957270][T21520] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4310'. [ 559.114789][T21523] vlan3: entered promiscuous mode [ 559.135212][T21525] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4311'. [ 559.158221][T21523] netlink: 27 bytes leftover after parsing attributes in process `syz.3.4310'. [ 559.185172][T21525] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4311'. [ 559.306425][T21530] vlan2: entered allmulticast mode [ 559.331656][T21530] bond0: entered allmulticast mode [ 559.346608][T21530] mac80211_hwsim hwsim47 wlan1: entered allmulticast mode [ 559.356405][T21530] batadv0: entered allmulticast mode [ 559.512351][T21538] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 559.856316][T21557] netlink: 'syz.3.4323': attribute type 26 has an invalid length. [ 559.928591][T21559] netlink: 'syz.3.4323': attribute type 26 has an invalid length. [ 560.007677][ T5864] Bluetooth: hci4: command 0x0406 tx timeout [ 560.165332][T21569] tipc: Enabling of bearer rejected, failed to enable media [ 560.193083][T21569] RDS: rds_bind could not find a transport for fe88::1, load rds_tcp or rds_rdma? [ 560.277892][T21573] netlink: zone id is out of range [ 560.290593][T21573] netlink: zone id is out of range [ 560.295913][T21573] netlink: get zone limit has 8 unknown bytes [ 560.394177][T21577] IPv6: Can't replace route, no match found [ 560.536296][T21580] lo speed is unknown, defaulting to 1000 [ 560.770710][T21591] syzkaller1: entered promiscuous mode [ 560.779716][T21591] syzkaller1: entered allmulticast mode [ 561.264506][T21617] tipc: Invalid UDP bearer configuration [ 561.264572][T21617] tipc: Enabling of bearer rejected, failed to enable media [ 562.790693][T21652] 8021q: adding VLAN 0 to HW filter on device bond2 [ 563.140769][T21652] bond2 (unregistering): Released all slaves [ 563.184729][T21660] netlink: 'syz.0.4352': attribute type 13 has an invalid length. [ 563.368390][T21668] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 563.626704][T21687] __nla_validate_parse: 8 callbacks suppressed [ 563.626724][T21687] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4360'. [ 563.713854][T21687] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4360'. [ 563.753164][T21687] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4360'. [ 563.895208][T21696] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4361'. [ 563.905725][T21696] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4361'. [ 563.933119][T21696] bridge0: port 3(vlan0) entered blocking state [ 563.943930][T21696] bridge0: port 3(vlan0) entered disabled state [ 563.953370][T21696] vlan0: entered allmulticast mode [ 563.965123][T21696] bridge0: entered allmulticast mode [ 563.968610][T21699] netlink: 'syz.0.4362': attribute type 39 has an invalid length. [ 563.985403][T21696] vlan0: left allmulticast mode [ 563.995021][T21702] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4363'. [ 563.996053][T21696] bridge0: left allmulticast mode [ 564.165596][T21709] tipc: Enabled bearer , priority 0 [ 564.173608][T21709] syzkaller0: entered promiscuous mode [ 564.185102][T21709] syzkaller0: entered allmulticast mode [ 564.249202][T21667] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 564.311592][T21713] netlink: 'syz.2.4366': attribute type 3 has an invalid length. [ 564.359675][T21709] tipc: Resetting bearer [ 564.427589][T21718] netlink: 'syz.4.4368': attribute type 1 has an invalid length. [ 564.430059][T21709] tipc: Disabling bearer [ 564.445448][T21718] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4368'. [ 564.456537][T21718] netlink: 45 bytes leftover after parsing attributes in process `syz.4.4368'. [ 564.837102][T21747] netlink: 'syz.0.4374': attribute type 2 has an invalid length. [ 564.852750][T21743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4375'. [ 564.867461][T21747] netlink: 'syz.0.4374': attribute type 1 has an invalid length. [ 564.906000][T21749] netlink: 'syz.4.4376': attribute type 8 has an invalid length. [ 565.159229][T21759] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4380'. [ 565.192408][T21759] gretap0: entered promiscuous mode [ 565.258891][T21759] gretap0: left promiscuous mode [ 566.156142][T21810] lo speed is unknown, defaulting to 1000 [ 566.799415][T21830] bridge_slave_1: left allmulticast mode [ 566.805137][T21830] bridge_slave_1: left promiscuous mode [ 566.811924][T21830] bridge0: port 2(bridge_slave_1) entered disabled state [ 566.823778][T21830] bridge_slave_0: left allmulticast mode [ 566.831200][T21830] bridge_slave_0: left promiscuous mode [ 566.844825][T21830] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.149486][T21867] tipc: Resetting bearer [ 569.158533][T21867] batman_adv: batadv0: Interface deactivated: gretap1 [ 569.283406][T21878] pim6reg: entered allmulticast mode [ 569.302622][T21880] pim6reg: left allmulticast mode [ 569.379673][T21889] pim6reg: entered allmulticast mode [ 569.395966][T21891] pim6reg: left allmulticast mode [ 569.488394][T14835] syz1: Port: 1 Link DOWN [ 569.491083][ T9670] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.512147][ T9670] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.530301][ T9670] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.544923][ T9670] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.741498][T21905] lo speed is unknown, defaulting to 1000 [ 570.010408][T21913] __nla_validate_parse: 11 callbacks suppressed [ 570.010434][T21913] netlink: 248 bytes leftover after parsing attributes in process `syz.0.4423'. [ 570.784094][T21922] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 570.876126][T21906] netlink: 248 bytes leftover after parsing attributes in process `syz.2.4420'. [ 571.111852][T21921] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 571.153518][T21928] lo speed is unknown, defaulting to 1000 [ 571.602798][T21949] netlink: 'syz.3.4431': attribute type 1 has an invalid length. [ 571.979560][T21963] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 572.195340][T21966] lo speed is unknown, defaulting to 1000 [ 572.376313][T21977] netlink: 'syz.3.4439': attribute type 1 has an invalid length. [ 572.505453][T21982] bond3: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 572.524792][T21982] bond3: (slave ip6gre1): Error -95 calling set_mac_address [ 572.749464][T21987] C: renamed from team_slave_0 [ 572.779234][T21987] netlink: 'syz.4.4442': attribute type 2 has an invalid length. [ 572.833298][T21987] netlink: 116 bytes leftover after parsing attributes in process `syz.4.4442'. [ 572.877365][T21987] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 572.912547][T21993] netlink: 'syz.3.4445': attribute type 7 has an invalid length. [ 572.968790][T21998] netlink: 'syz.3.4445': attribute type 2 has an invalid length. [ 573.041688][T21993] : entered promiscuous mode [ 573.064016][T21999] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4443'. [ 573.453650][T22014] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4450'. [ 573.481805][T22014] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4450'. [ 573.508476][T22019] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4451'. [ 573.551438][T22014] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 573.562252][T22014] gretap1: entered promiscuous mode [ 573.567667][T22014] gretap1: entered allmulticast mode [ 573.593459][T22019] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 573.665102][T22018] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 573.665456][T22027] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4453'. [ 573.850991][T22034] netlink: 'syz.1.4453': attribute type 1 has an invalid length. [ 573.885141][T22029] lo speed is unknown, defaulting to 1000 [ 574.006538][T22042] netlink: 136 bytes leftover after parsing attributes in process `syz.4.4456'. [ 574.470496][T22066] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4463'. [ 574.735672][T22075] macvlan3: entered allmulticast mode [ 574.743084][T22075] veth1_vlan: entered allmulticast mode [ 574.752390][T22075] veth1_vlan: left allmulticast mode [ 574.790857][T22076] unknown channel width for channel at 909000KHz? [ 574.947141][T22069] lo speed is unknown, defaulting to 1000 [ 575.414758][T22094] netlink: 'syz.0.4473': attribute type 3 has an invalid length. [ 575.693587][T22105] __nla_validate_parse: 1 callbacks suppressed [ 575.693609][T22105] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4476'. [ 575.805104][T22109] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4477'. [ 576.089280][T22118] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4478'. [ 576.106533][T22029] mpoa:mpoad_close: () going down [ 576.328097][T22127] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4480'. [ 576.497649][T22136] netem: change failed [ 576.719278][T22148] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4487'. [ 576.735132][T22148] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 576.754162][T22150] !: renamed from dummy0 (while UP) [ 576.808775][T22150] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4488'. [ 576.933694][T22156] netlink: 7 bytes leftover after parsing attributes in process `syz.0.4491'. [ 577.188889][T22157] lo speed is unknown, defaulting to 1000 [ 578.261020][T22199] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4499'. [ 578.386161][T22202] syzkaller0: entered promiscuous mode [ 578.392039][T22202] syzkaller0: entered allmulticast mode [ 578.411960][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.445814][T22168] lo speed is unknown, defaulting to 1000 [ 578.899773][T22207] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4502'. [ 579.215277][T22214] tipc: Enabling of bearer rejected, already enabled [ 672.647514][ T5864] Bluetooth: hci5: command 0x0406 tx timeout [ 693.126579][T22243] lo speed is unknown, defaulting to 1000 [ 693.983999][T22250] lo speed is unknown, defaulting to 1000 [ 694.184990][T22271] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4519'. [ 694.484255][T22280] netlink: 830 bytes leftover after parsing attributes in process `syz.1.4522'. [ 694.827383][T22292] netlink: 2 bytes leftover after parsing attributes in process `syz.1.4523'. [ 695.660196][T22320] netlink: 'syz.2.4532': attribute type 1 has an invalid length. [ 695.670656][T22321] netlink: 'syz.2.4532': attribute type 1 has an invalid length. [ 695.693554][T22321] netlink: 244 bytes leftover after parsing attributes in process `syz.2.4532'. [ 695.711531][T22320] netlink: 244 bytes leftover after parsing attributes in process `syz.2.4532'. [ 695.869209][T22329] tipc: Enabled bearer , priority 0 [ 695.890640][T22329] syzkaller0: entered promiscuous mode [ 695.904334][T22335] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4538'. [ 695.907867][T22329] syzkaller0: entered allmulticast mode [ 695.966491][T22335] team0: entered promiscuous mode [ 695.989146][T22335] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 696.035618][T22335] team0: left promiscuous mode [ 696.193087][T22347] tipc: Resetting bearer [ 696.238269][T22328] tipc: Resetting bearer [ 696.255562][T22350] netlink: 'syz.4.4542': attribute type 1 has an invalid length. [ 696.276368][T22352] netlink: 'syz.4.4542': attribute type 1 has an invalid length. [ 696.314986][T22328] tipc: Disabling bearer [ 696.338997][T22352] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 696.341892][T22350] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 696.429547][T22364] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4544'. [ 696.461555][T22364] netem: unknown loss type 13 [ 696.476542][T22364] netem: change failed [ 696.502439][T22364] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4544'. [ 696.511993][T22369] netlink: 248 bytes leftover after parsing attributes in process `syz.2.4545'. [ 696.999093][T22395] bpq0: left promiscuous mode [ 697.101318][T22397] netlink: 148 bytes leftover after parsing attributes in process `syz.0.4552'. [ 697.149901][T22397] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 697.243702][T22402] netlink: 'syz.2.4554': attribute type 3 has an invalid length. [ 697.377819][T22404] lo speed is unknown, defaulting to 1000 [ 697.413267][T22413] block nbd3: not configured, cannot reconfigure [ 698.417480][T22418] netlink: 'syz.4.4558': attribute type 10 has an invalid length. [ 698.633835][T22428] chnl_net:caif_netlink_parms(): no params data found [ 698.924581][T22412] lo speed is unknown, defaulting to 1000 [ 699.158205][T22447] tipc: Enabled bearer , priority 0 [ 699.166587][T22446] syzkaller0: entered promiscuous mode [ 699.173299][T22446] syzkaller0: entered allmulticast mode [ 699.276420][T22447] tipc: Resetting bearer [ 699.486151][T22449] netlink: 'syz.2.4568': attribute type 1 has an invalid length. [ 699.500286][T22449] netlink: 'syz.2.4568': attribute type 4 has an invalid length. [ 699.511282][T22449] __nla_validate_parse: 4 callbacks suppressed [ 699.511301][T22449] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.4568'. [ 699.801300][T22454] pimreg: tun_chr_ioctl cmd 1074025673 [ 699.899575][T22445] tipc: Resetting bearer [ 699.975453][T22445] tipc: Disabling bearer [ 700.555257][T22474] netlink: 'syz.1.4573': attribute type 3 has an invalid length. [ 701.291337][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.927072][T22476] netlink: 'syz.3.4575': attribute type 11 has an invalid length. [ 701.935551][T22476] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4575'. [ 702.590895][T22471] tipc: Enabling of bearer rejected, failed to enable media [ 702.708310][T22483] netlink: 'syz.0.4578': attribute type 1 has an invalid length. [ 702.748561][T22486] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4579'. [ 702.797857][T22488] netlink: 124 bytes leftover after parsing attributes in process `syz.3.4580'. [ 702.861870][T22493] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4582'. [ 702.879470][T22497] IPVS: set_ctl: invalid protocol: 9 1.0.0.0:0 [ 702.893099][T22496] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4583'. [ 703.022214][T22506] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4585'. [ 703.036813][T22508] netlink: 'syz.1.4583': attribute type 1 has an invalid length. [ 703.047746][T22506] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4585'. [ 703.067445][T22506] netlink: 'syz.3.4585': attribute type 18 has an invalid length. [ 703.109436][T22508] 8021q: adding VLAN 0 to HW filter on device bond2 [ 703.143721][T22506] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4585'. [ 703.151924][ T8109] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.163183][ T8109] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.168221][T22506] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4585'. [ 703.195322][ T8109] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.222573][T22506] netlink: 'syz.3.4585': attribute type 18 has an invalid length. [ 703.234225][ T8109] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.439048][T22526] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 703.457643][T22526] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.609729][T22526] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 703.620569][T22526] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.763200][T22526] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 703.778031][T22526] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.824813][T22543] netlink: 'syz.1.4595': attribute type 20 has an invalid length. [ 703.846209][T22545] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 703.861855][T22540] netlink: 'syz.2.4598': attribute type 23 has an invalid length. [ 703.868591][T22543] netlink: 'syz.1.4595': attribute type 20 has an invalid length. [ 703.869928][ T9680] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.900338][ T9680] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.916761][ T9680] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 704.042933][T22526] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 704.099875][T22526] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.140194][ T9680] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 704.236676][T22545] lo speed is unknown, defaulting to 1000 [ 704.357679][T22559] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 704.464086][ T9682] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 704.496482][ T9682] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.519544][ T9682] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 704.534942][ T9682] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.613127][ T9682] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 704.637256][ T9682] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.645885][T22568] IPv6: NLM_F_CREATE should be specified when creating new route [ 704.667432][ T9682] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 704.675677][ T9682] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.886217][T22578] bridge0: port 1(bond2) entered blocking state [ 704.978995][T22578] bridge0: port 1(bond2) entered disabled state [ 704.985698][T22578] bond2: entered allmulticast mode [ 705.026894][T22578] bond2: entered promiscuous mode [ 705.358199][T22598] syzkaller1: entered promiscuous mode [ 705.363741][T22598] syzkaller1: entered allmulticast mode [ 706.049606][T22616] lo speed is unknown, defaulting to 1000 [ 706.242529][T22624] netlink: 'syz.1.4618': attribute type 1 has an invalid length. [ 706.402018][T22624] 8021q: adding VLAN 0 to HW filter on device bond3 [ 706.671746][T22620] __nla_validate_parse: 7 callbacks suppressed [ 706.671767][T22620] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4616'. [ 706.730605][T22634] netlink: 'syz.2.4616': attribute type 13 has an invalid length. [ 706.810162][T22643] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4620'. [ 707.120802][T22634] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 707.154653][ T5967] lo speed is unknown, defaulting to 1000 [ 707.650496][T22648] ip6gretap1: entered promiscuous mode [ 708.055054][T22659] tipc: Enabling of bearer rejected, failed to enable media [ 709.025190][T22674] validate_nla: 1 callbacks suppressed [ 709.025211][T22674] netlink: 'syz.2.4631': attribute type 35 has an invalid length. [ 710.471555][T22542] Set syz1 is full, maxelem 65536 reached [ 710.525659][T22713] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4640'. [ 710.576424][T22713] 0ªX¹¦À: renamed from caif0 [ 710.638392][T22709] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4639'. [ 710.791585][T22713] 0ªX¹¦À: entered allmulticast mode [ 710.797073][T22713] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 710.846392][T22711] lo speed is unknown, defaulting to 1000 [ 710.891432][T22730] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4645'. [ 710.900741][T22730] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4645'. [ 711.046120][T22740] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4646'. [ 711.144778][T22736] raw_sendmsg: syz.4.4648 forgot to set AF_INET. Fix it! [ 711.400981][T22757] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4652'. [ 711.478104][T22755] netlink: 'syz.0.4653': attribute type 10 has an invalid length. [ 711.486363][T22755] netlink: 2 bytes leftover after parsing attributes in process `syz.0.4653'. [ 711.514899][T22755] gretap0: entered promiscuous mode [ 711.521028][T22758] lo speed is unknown, defaulting to 1000 [ 711.896451][T22765] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4654'. [ 711.946109][T22765] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 711.964123][T22767] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4655'. [ 712.384293][T22773] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4657'. [ 712.445969][ T8109] dvmrp0 (unregistering): left allmulticast mode [ 712.997909][ T8109] bond0 (unregistering): Released all slaves [ 713.012213][ T8109] bond1 (unregistering): Released all slaves [ 713.153871][ T8109] bond2 (unregistering): Released all slaves [ 713.167870][ T8109] bond3 (unregistering): Released all slaves [ 713.312197][ T8109] bond4 (unregistering): Released all slaves [ 713.385426][T22770] dummy0: entered allmulticast mode [ 713.425142][T22772] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 713.464223][T22772] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 713.525627][ T8109] : left promiscuous mode [ 713.556613][T22764] lo speed is unknown, defaulting to 1000 [ 713.642795][T22782] netlink: 200 bytes leftover after parsing attributes in process `syz.3.4659'. [ 713.653881][T22782] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4659'. [ 713.710474][ T8109] tipc: Disabling bearer [ 713.740237][ T8109] tipc: Disabling bearer [ 713.760321][ T8109] tipc: Left network mode [ 713.825723][T22787] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4661'. [ 714.574923][T22796] mac80211_hwsim hwsim50 wlan0: entered promiscuous mode [ 714.594537][T22796] macsec0: entered promiscuous mode [ 714.600626][T22796] macsec0: entered allmulticast mode [ 714.605997][T22796] mac80211_hwsim hwsim50 wlan0: entered allmulticast mode [ 714.658361][T22798] syzkaller0: left promiscuous mode [ 714.665857][T22798] syzkaller0: left allmulticast mode [ 715.242018][T22814] lo speed is unknown, defaulting to 1000 [ 715.381163][T22824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4671'. [ 715.406365][T22824] syzkaller1: entered promiscuous mode [ 715.412290][T22824] syzkaller1: entered allmulticast mode [ 715.667806][T22832] vcan0: tx drop: invalid sa for name 0x0000000000000080 [ 716.376163][T22852] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4679'. [ 716.404681][T22852] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4679'. [ 716.443295][T22858] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4678'. [ 716.921238][ T8109] veth1_vlan: left allmulticast mode [ 718.031399][T22880] __nla_validate_parse: 1 callbacks suppressed [ 718.031419][T22880] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.4683'. [ 718.075189][T22880] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4683'. [ 718.090317][T22880] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 718.237909][T22888] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4684'. [ 718.419324][T22898] netlink: 'syz.2.4690': attribute type 1 has an invalid length. [ 718.440671][T22889] lo speed is unknown, defaulting to 1000 [ 718.662663][T22909] netlink: 244 bytes leftover after parsing attributes in process `syz.0.4691'. [ 718.676459][T22910] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4692'. [ 718.684484][ T8109] IPVS: stop unused estimator thread 0... [ 718.706519][T22911] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4692'. [ 718.882251][T22919] pim6reg1: entered promiscuous mode [ 718.892182][T22919] pim6reg1: entered allmulticast mode [ 718.900259][T22917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4695'. [ 718.903984][T22919] netlink: 'syz.2.4694': attribute type 1 has an invalid length. [ 718.922233][T22919] netlink: 228 bytes leftover after parsing attributes in process `syz.2.4694'. [ 718.932871][T22919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4694'. [ 718.972425][T22921] netlink: 'syz.4.4696': attribute type 1 has an invalid length. [ 719.114808][T22921] bond4: entered promiscuous mode [ 719.127819][T22921] 8021q: adding VLAN 0 to HW filter on device bond4 [ 719.258397][T22904] lo speed is unknown, defaulting to 1000 [ 719.359977][T22931] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4699'. [ 719.370533][T22931] openvswitch: netlink: nsh attr 0 has unexpected len 7 expected 0 [ 719.388014][T22931] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.623649][T22939] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond0, syncid = 8, id = 0 [ 719.923765][T22950] team0: Port device dummy0 removed [ 719.983842][T22950] bond0: (slave wlan1): Releasing backup interface [ 720.101182][T22950] bond3: (slave veth5): Releasing active interface [ 720.109148][T22950] bond3: (slave veth5): the permanent HWaddr of slave - ca:c2:50:d1:69:98 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 720.132974][T22950] vlan3: entered promiscuous mode [ 720.160996][T22950] bond3: (slave vlan3): Releasing active interface [ 720.177593][T22950] vlan3: left promiscuous mode [ 720.193151][T22950] veth1: left promiscuous mode [ 720.250919][ T9680] tipc: Resetting bearer [ 720.377938][T22961] netlink: 'syz.2.4705': attribute type 8 has an invalid length. [ 720.399736][ T30] audit: type=1800 audit(1754803588.647:14): pid=22957 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.4704" name="memory.events" dev="tmpfs" ino=1687 res=0 errno=0 [ 721.434343][T23000] IPv6: Can't replace route, no match found [ 721.513817][T22996] lo speed is unknown, defaulting to 1000 [ 721.831545][T23017] tipc: Resetting bearer [ 722.139666][T23017] tipc: Disabling bearer [ 722.536467][T23019] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 722.560827][T23018] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 723.513477][T23082] __nla_validate_parse: 8 callbacks suppressed [ 723.513497][T23082] netlink: 45 bytes leftover after parsing attributes in process `syz.0.4735'. [ 723.962341][T23117] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4741'. [ 723.969987][T23110] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4737'. [ 724.002686][T23117] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4741'. [ 724.014115][T23117] bond0: (slave rose0): Error: Device can not be enslaved while up [ 724.040296][T23121] sctp: [Deprecated]: syz.3.4737 (pid 23121) Use of int in maxseg socket option. [ 724.040296][T23121] Use struct sctp_assoc_value instead [ 724.179641][T23124] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4740'. [ 724.519861][T23129] netlink: 732 bytes leftover after parsing attributes in process `syz.0.4742'. [ 724.524647][T23131] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4742'. [ 724.578074][T23134] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4742'. [ 724.597499][T23129] netlink: 732 bytes leftover after parsing attributes in process `syz.0.4742'. [ 724.820220][T23147] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4743'. [ 725.072512][T23158] netlink: 'syz.3.4749': attribute type 10 has an invalid length. [ 725.091191][T23154] unsupported nlmsg_type 40 [ 725.251183][T23160] lo speed is unknown, defaulting to 1000 [ 725.696884][T23184] sctp: [Deprecated]: syz.1.4756 (pid 23184) Use of struct sctp_assoc_value in delayed_ack socket option. [ 725.696884][T23184] Use struct sctp_sack_info instead [ 725.715267][T23187] sysfs: cannot create duplicate filename '/class/ieee80211/žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»–_à›xDä±pj8¼•TTí!' [ 725.746105][T23187] CPU: 0 UID: 0 PID: 23187 Comm: syz.0.4758 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 725.746146][T23187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 725.746159][T23187] Call Trace: [ 725.746167][T23187] [ 725.746177][T23187] dump_stack_lvl+0x189/0x250 [ 725.746238][T23187] ? __pfx_dump_stack_lvl+0x10/0x10 [ 725.746279][T23187] ? __pfx__printk+0x10/0x10 [ 725.746333][T23187] ? kernfs_path_from_node+0x2f/0x290 [ 725.746358][T23187] ? kernfs_path_from_node+0x250/0x290 [ 725.746388][T23187] ? kernfs_path_from_node+0x2f/0x290 [ 725.746425][T23187] sysfs_warn_dup+0x8e/0xa0 [ 725.746449][T23187] sysfs_do_create_link_sd+0xc0/0x110 [ 725.746476][T23187] device_add_class_symlinks+0x1cf/0x240 [ 725.746513][T23187] device_add+0x475/0xb50 [ 725.746551][T23187] wiphy_register+0x1ba6/0x28d0 [ 725.746610][T23187] ? __pfx_wiphy_register+0x10/0x10 [ 725.746636][T23187] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 725.746681][T23187] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 725.746718][T23187] ieee80211_register_hw+0x3425/0x4080 [ 725.746775][T23187] ? ieee80211_register_hw+0x1431/0x4080 [ 725.746819][T23187] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 725.746858][T23187] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 725.746898][T23187] ? __hrtimer_setup+0x187/0x210 [ 725.746918][T23187] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 725.746948][T23187] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 725.747017][T23187] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 725.747039][T23187] ? trace_kmalloc+0x1f/0xd0 [ 725.747063][T23187] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 725.747089][T23187] ? kstrndup+0xbf/0x160 [ 725.747122][T23187] hwsim_new_radio_nl+0xea4/0x1b10 [ 725.747147][T23187] ? __pfx___nla_validate_parse+0x10/0x10 [ 725.747193][T23187] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 725.747242][T23187] ? __nla_parse+0x40/0x60 [ 725.747275][T23187] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 725.747308][T23187] genl_family_rcv_msg_doit+0x215/0x300 [ 725.747339][T23187] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 725.747378][T23187] ? bpf_lsm_capable+0x9/0x20 [ 725.747405][T23187] ? security_capable+0x7e/0x2e0 [ 725.747441][T23187] genl_rcv_msg+0x60e/0x790 [ 725.747471][T23187] ? __pfx_genl_rcv_msg+0x10/0x10 [ 725.747490][T23187] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 725.747533][T23187] netlink_rcv_skb+0x208/0x470 [ 725.747557][T23187] ? __lock_acquire+0xab9/0xd20 [ 725.747588][T23187] ? __pfx_genl_rcv_msg+0x10/0x10 [ 725.747610][T23187] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 725.747662][T23187] ? down_read+0x1ad/0x2e0 [ 725.747695][T23187] genl_rcv+0x28/0x40 [ 725.747724][T23187] netlink_unicast+0x82c/0x9e0 [ 725.747760][T23187] ? __pfx_netlink_unicast+0x10/0x10 [ 725.747787][T23187] ? netlink_sendmsg+0x642/0xb30 [ 725.747809][T23187] ? skb_put+0x11b/0x210 [ 725.747839][T23187] netlink_sendmsg+0x805/0xb30 [ 725.747874][T23187] ? __pfx_netlink_sendmsg+0x10/0x10 [ 725.747904][T23187] ? aa_sock_msg_perm+0xf1/0x1d0 [ 725.747934][T23187] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 725.747954][T23187] ? __pfx_netlink_sendmsg+0x10/0x10 [ 725.747979][T23187] __sock_sendmsg+0x21c/0x270 [ 725.748006][T23187] ____sys_sendmsg+0x505/0x830 [ 725.748045][T23187] ? __pfx_____sys_sendmsg+0x10/0x10 [ 725.748088][T23187] ? import_iovec+0x74/0xa0 [ 725.748114][T23187] ___sys_sendmsg+0x21f/0x2a0 [ 725.748147][T23187] ? __pfx____sys_sendmsg+0x10/0x10 [ 725.748237][T23187] ? __fget_files+0x2a/0x420 [ 725.748268][T23187] ? __fget_files+0x3a0/0x420 [ 725.748313][T23187] __x64_sys_sendmsg+0x19b/0x260 [ 725.748348][T23187] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 725.748394][T23187] ? rcu_is_watching+0x15/0xb0 [ 725.748423][T23187] ? do_syscall_64+0xbe/0x3b0 [ 725.748457][T23187] do_syscall_64+0xfa/0x3b0 [ 725.748480][T23187] ? lockdep_hardirqs_on+0x9c/0x150 [ 725.748504][T23187] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.748525][T23187] ? clear_bhb_loop+0x60/0xb0 [ 725.748551][T23187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.748572][T23187] RIP: 0033:0x7fcd0598ebe9 [ 725.748592][T23187] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 725.748610][T23187] RSP: 002b:00007fcd06715038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 725.748633][T23187] RAX: ffffffffffffffda RBX: 00007fcd05bb6090 RCX: 00007fcd0598ebe9 [ 725.748648][T23187] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000009 [ 725.748662][T23187] RBP: 00007fcd05a11e19 R08: 0000000000000000 R09: 0000000000000000 [ 725.748674][T23187] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 725.748687][T23187] R13: 00007fcd05bb6128 R14: 00007fcd05bb6090 R15: 00007ffc93ce04c8 [ 725.748724][T23187] [ 726.419192][T23195] tipc: Enabled bearer , priority 0 [ 726.479180][T23195] syzkaller0: entered promiscuous mode [ 726.502134][T23195] syzkaller0: entered allmulticast mode [ 726.633722][T23195] tipc: Resetting bearer [ 726.706790][T23194] tipc: Resetting bearer [ 726.746804][T23194] tipc: Disabling bearer [ 726.788493][T23199] syzkaller1: entered promiscuous mode [ 726.794468][T23199] syzkaller1: entered allmulticast mode [ 726.933054][T23204] bond0: option use_carrier: invalid value (2) [ 727.201923][T23223] tipc: Enabled bearer , priority 0 [ 727.215751][T23222] syzkaller1: entered promiscuous mode [ 727.221991][T23222] syzkaller1: entered allmulticast mode [ 727.469411][T23222] tipc: Disabling bearer [ 727.945549][T23260] netlink: 'syz.4.4773': attribute type 39 has an invalid length. [ 728.413005][T23260] veth0_macvtap: left promiscuous mode [ 728.620601][T23269] __nla_validate_parse: 4 callbacks suppressed [ 728.620624][T23269] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4778'. [ 728.719877][T23273] bond0: (slave gretap0): Error -99 calling set_mac_address [ 729.046013][T23286] team0: Device gtp0 is of different type [ 729.376962][T23298] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4785'. [ 729.482293][T23300] syzkaller1: entered promiscuous mode [ 729.514419][T23300] syzkaller1: entered allmulticast mode [ 729.937918][T23336] netlink: 'syz.1.4796': attribute type 12 has an invalid length. [ 730.250547][T23354] openvswitch: netlink: Key 2 has unexpected len 2 expected 4 [ 730.447851][T23365] syzkaller1: entered promiscuous mode [ 730.460953][T23365] syzkaller1: entered allmulticast mode [ 730.481312][ T24] IPVS: starting estimator thread 0... [ 730.587387][T23372] IPVS: using max 23 ests per chain, 55200 per kthread [ 731.189385][T23401] syzkaller1: entered promiscuous mode [ 731.194919][T23401] syzkaller1: entered allmulticast mode [ 731.225443][T23404] netlink: 'syz.3.4819': attribute type 7 has an invalid length. [ 731.243430][T23404] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4819'. [ 731.336168][T23409] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4823'. [ 731.686573][T23430] netlink: 324 bytes leftover after parsing attributes in process `syz.4.4830'. [ 731.887908][T23440] tipc: Enabled bearer , priority 0 [ 731.964100][T23440] syzkaller0: entered promiscuous mode [ 731.970200][T23440] syzkaller0: entered allmulticast mode [ 731.978235][T23440] tipc: Resetting bearer [ 732.074855][T23440] tipc: Resetting bearer [ 732.228375][T23467] netlink: 288 bytes leftover after parsing attributes in process `syz.4.4835'. [ 732.247363][T23467] netlink: 556 bytes leftover after parsing attributes in process `syz.4.4835'. [ 734.348296][T23440] tipc: Disabling bearer [ 734.478832][T23480] tipc: Enabling of bearer rejected, failed to enable media [ 734.512549][T23466] lo speed is unknown, defaulting to 1000 [ 734.944971][T23500] syzkaller0: entered promiscuous mode [ 735.017362][T23500] syzkaller0: entered allmulticast mode [ 735.223483][T23515] netlink: zone id is out of range [ 735.288756][T23515] netlink: zone id is out of range [ 735.310655][T23515] netlink: set zone limit has 4 unknown bytes [ 736.504200][T23525] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4852'. [ 737.576258][T23523] netlink: 'syz.3.4852': attribute type 1 has an invalid length. [ 737.603564][T23524] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 737.809268][T23539] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 738.032953][T23539] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 738.202696][T23554] netlink: 248 bytes leftover after parsing attributes in process `syz.0.4858'. [ 738.413038][T23565] netlink: 'syz.4.4861': attribute type 4 has an invalid length. [ 738.426078][T23565] syzkaller0: entered promiscuous mode [ 738.431915][T23565] syzkaller0: entered allmulticast mode [ 738.560516][T23574] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4862'. [ 738.718430][T23580] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4866'. [ 738.746531][T23582] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4867'. [ 738.769859][ T8120] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.769999][T23580] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4866'. [ 738.788387][ T8120] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.810700][ T8120] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.833931][ T8120] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.846241][T23584] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4868'. [ 738.870507][T23586] netlink: 'syz.1.4869': attribute type 1 has an invalid length. [ 738.913956][T23586] 8021q: adding VLAN 0 to HW filter on device bond5 [ 738.952149][T23586] bond5: entered promiscuous mode [ 738.962155][T23590] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4870'. [ 739.113504][T23590] tipc: Enabled bearer , priority 0 [ 739.125692][T23590] syzkaller0: entered promiscuous mode [ 739.132549][T23590] syzkaller0: entered allmulticast mode [ 739.143680][T23590] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 739.214328][T23590] syzkaller0: mtu less than device minimum [ 739.268762][T23590] bridge0: entered allmulticast mode [ 739.313629][T23589] tipc: Resetting bearer [ 739.404240][T23589] tipc: Disabling bearer [ 739.672232][T23619] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4880'. [ 739.783099][T23623] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4882'. [ 739.858593][T23623] bond4: entered promiscuous mode [ 739.867827][T23623] 8021q: adding VLAN 0 to HW filter on device bond4 [ 740.211255][T23623] bond4 (unregistering): Released all slaves [ 740.270307][T23632] tap0: tun_chr_ioctl cmd 1074025677 [ 740.276109][T23632] tap0: linktype set to 776 [ 740.703012][T23666] syzkaller0: entered promiscuous mode [ 740.716961][T23666] syzkaller0: entered allmulticast mode [ 741.047179][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.056399][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.373977][T23706] netlink: 'syz.0.4906': attribute type 1 has an invalid length. [ 741.438843][T23706] 8021q: adding VLAN 0 to HW filter on device bond4 [ 741.602670][T23723] __nla_validate_parse: 9 callbacks suppressed [ 741.602692][T23723] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4911'. [ 741.716653][T23731] netlink: 'syz.3.4915': attribute type 1 has an invalid length. [ 741.865816][T23739] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 741.891159][T23739] macsec2: entered promiscuous mode [ 742.087213][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.095443][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.143808][T23748] tipc: Enabled bearer , priority 0 [ 742.225797][T23748] syzkaller0: entered promiscuous mode [ 742.232087][T23748] syzkaller0: entered allmulticast mode [ 742.239320][T23748] tipc: Resetting bearer [ 742.291822][T23748] tipc: Resetting bearer [ 742.485492][T23763] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 743.137247][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.181709][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.190014][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.614122][T23748] tipc: Disabling bearer [ 744.681296][T23787] tipc: Enabling of bearer rejected, failed to enable media [ 744.941862][T23814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4933'. [ 744.990052][T23814] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 745.141821][T23818] tipc: Enabled bearer , priority 0 [ 745.186359][T23818] syzkaller0: entered promiscuous mode [ 745.197163][T23818] syzkaller0: entered allmulticast mode [ 745.290732][T23818] tipc: Resetting bearer [ 745.322772][T23833] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4941'. [ 745.350600][T23817] tipc: Resetting bearer [ 745.402339][T23817] tipc: Disabling bearer [ 745.459213][T23833] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4941'. [ 745.473391][T23833] netlink: 7 bytes leftover after parsing attributes in process `syz.2.4941'. [ 745.874455][T23863] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4952'. [ 745.971439][T23871] syzkaller1: entered promiscuous mode [ 745.976978][T23871] syzkaller1: entered allmulticast mode [ 746.026750][T23875] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4952'. [ 746.036078][T23875] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4952'. [ 746.062022][T23875] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4952'. [ 746.122105][T23873] IPVS: persistence engine module ip_vs_pe_@ not found [ 746.178276][T23878] tipc: Enabling of bearer rejected, failed to enable media [ 746.247194][ C1] net_ratelimit: 1 callbacks suppressed [ 746.247216][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.261407][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.374011][T23895] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4961'. [ 746.702687][T23917] __nla_validate_parse: 2 callbacks suppressed [ 746.702710][T23917] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4966'. [ 747.287200][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.295407][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.398638][T23945] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4971'. [ 747.406591][T23942] lo speed is unknown, defaulting to 1000 [ 747.445500][T23945] bridge5: entered promiscuous mode [ 747.511508][T23945] bridge5: entered allmulticast mode [ 747.517811][T23947] tipc: Enabling of bearer rejected, already enabled [ 747.656656][T23952] netlink: 'syz.1.4976': attribute type 4 has an invalid length. [ 747.758079][T23956] syz_tun: entered allmulticast mode [ 747.804797][T23956] dvmrp1: entered allmulticast mode [ 747.877685][T23963] netlink: 'syz.3.4979': attribute type 1 has an invalid length. [ 747.896944][T23963] netlink: 116 bytes leftover after parsing attributes in process `syz.3.4979'. [ 747.912361][T23954] syz_tun: left allmulticast mode [ 747.988761][T23961] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4978'. [ 748.035311][T23966] 8021q: adding VLAN 0 to HW filter on device bond6 [ 748.042669][T23960] lo speed is unknown, defaulting to 1000 [ 748.141770][T23966] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 748.162829][T23966] bond6: (slave macvlan0): Enslaving as a backup interface with an up link [ 748.186931][T23967] bond6: (slave macvlan1): Error -98 calling set_mac_address [ 748.227008][T23970] tipc: Resetting bearer [ 748.249869][T23069] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 748.296107][T23970] team0: Port device geneve0 removed [ 748.327247][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.345026][T23970] bond6: (slave macvlan0): Removing an active aggregator [ 748.374826][T23970] bond6: (slave macvlan0): Releasing backup interface [ 748.395809][T23974] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4981'. [ 748.451519][T23069] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.475029][T23069] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.551420][T23069] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.589006][T23084] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.093741][T24006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4992'. [ 749.367255][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.375506][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.398940][T24011] smc: adding net device syzkaller1 with user defined pnetid SYZ2 [ 749.402034][T24014] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4994'. [ 749.604963][T24014] smc: removing net device syzkaller1 with user defined pnetid SYZ2 [ 749.937370][T24038] tipc: Enabled bearer , priority 0 [ 749.946275][T24038] syzkaller0: entered promiscuous mode [ 749.952489][T24038] syzkaller0: entered allmulticast mode [ 750.008896][T24039] tipc: Resetting bearer [ 750.015824][T24044] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5001'. [ 750.056257][T24037] tipc: Resetting bearer [ 750.112055][T24037] tipc: Disabling bearer [ 750.300817][ T30] audit: type=1800 audit(1754803618.537:15): pid=24031 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5001" name="cgroup.controllers" dev="tmpfs" ino=2082 res=0 errno=0 [ 750.407262][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.634434][T24068] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.685349][T24068] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.741561][T24074] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5010'. [ 750.824434][T24068] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.905776][T24068] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.936610][T24086] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5016'. [ 751.058111][T24086] hsr_slave_0: left promiscuous mode [ 751.065360][T24086] hsr_slave_1: left promiscuous mode [ 751.096578][T24068] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 751.107913][T24068] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.206187][T24068] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 751.240240][T24068] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.256078][T24097] netlink: 'syz.1.5021': attribute type 17 has an invalid length. [ 751.278524][T24097] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 751.426861][T23069] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.440295][T23069] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.449144][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.449311][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.501046][T23069] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.514753][T23069] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.542113][T24106] tipc: Enabled bearer , priority 0 [ 751.556015][T24106] syzkaller0: entered promiscuous mode [ 751.561835][T24106] syzkaller0: entered allmulticast mode [ 751.610051][T23085] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.623018][T23085] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.635286][T24106] tipc: Resetting bearer [ 751.662961][ T8120] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.676362][ T8120] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.685698][T24107] @ÿ: renamed from bond_slave_0 (while UP) [ 751.703389][T24114] batadv_slave_1: entered promiscuous mode [ 751.714311][T24104] tipc: Resetting bearer [ 751.749668][T24104] tipc: Disabling bearer [ 751.774152][T24116] __nla_validate_parse: 3 callbacks suppressed [ 751.774174][T24116] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5028'. [ 751.775297][T24114] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5027'. [ 751.813705][T24113] batadv_slave_1: left promiscuous mode [ 751.876308][T24119] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5028'. [ 751.969217][T24121] netlink: 'syz.1.5030': attribute type 10 has an invalid length. [ 751.978451][T24121] netlink: 'syz.1.5030': attribute type 10 has an invalid length. [ 751.993871][T24121] 8021q: adding VLAN 0 to HW filter on device bond0 [ 752.013158][T24121] team0: Device bond0 failed to register rx_handler [ 752.032447][T24124] dummy0: entered allmulticast mode [ 752.044273][T24123] dummy0: left allmulticast mode [ 752.259644][ T5864] Bluetooth: hci5: command 0x0406 tx timeout [ 752.487578][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.495910][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.877578][T24171] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5042'. [ 752.897890][T24166] bond0: (slave rose0): Error: Device can not be enslaved while up [ 753.527281][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.551090][T24161] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5040'. [ 753.776910][T24192] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5047'. [ 753.963477][T24196] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5048'. [ 754.227528][T24217] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5053'. [ 754.509251][T24233] netlink: 268 bytes leftover after parsing attributes in process `syz.4.5057'. [ 754.567217][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.575603][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.165893][T24255] lo speed is unknown, defaulting to 1000 [ 755.308169][T24263] netlink: 'syz.1.5066': attribute type 1 has an invalid length. [ 755.316220][T24263] netlink: 'syz.1.5066': attribute type 2 has an invalid length. [ 755.324624][T24263] netlink: 'syz.1.5066': attribute type 8 has an invalid length. [ 755.334152][T24263] netlink: 1148 bytes leftover after parsing attributes in process `syz.1.5066'. [ 755.607267][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.765088][ T30] audit: type=1804 audit(1754803623.997:16): pid=24285 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.5070" name="/newroot/420/cgroup.controllers" dev="tmpfs" ino=2165 res=1 errno=0 [ 755.794840][ T30] audit: type=1800 audit(1754803623.997:17): pid=24285 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5070" name="cgroup.controllers" dev="tmpfs" ino=2165 res=0 errno=0 [ 756.005633][T24295] syzkaller0: entered promiscuous mode [ 756.012963][T24295] syzkaller0: entered allmulticast mode [ 756.647192][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.655451][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.792186][T24313] __nla_validate_parse: 4 callbacks suppressed [ 756.792209][T24313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5080'. [ 757.024989][T24331] tipc: Enabled bearer , priority 10 [ 757.224210][T24345] netlink: 'syz.4.5089': attribute type 4 has an invalid length. [ 757.232563][T24345] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5089'. [ 757.525711][T24353] lo speed is unknown, defaulting to 1000 [ 757.570051][T24350] dvmrp1: entered allmulticast mode [ 757.577699][T24358] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5092'. [ 757.587234][T24350] dvmrp1: left allmulticast mode [ 757.616021][T24358] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5092'. [ 757.640399][T24358] netlink: 'syz.0.5092': attribute type 12 has an invalid length. [ 757.652194][T24358] netlink: 'syz.0.5092': attribute type 11 has an invalid length. [ 757.687188][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.695540][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.780587][T24360] netlink: 'syz.0.5093': attribute type 28 has an invalid length. [ 757.935278][T24362] netlink: 'syz.1.5094': attribute type 1 has an invalid length. [ 758.365233][T24378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5099'. [ 758.389985][T24378] netlink: 'syz.0.5099': attribute type 15 has an invalid length. [ 758.491120][T24384] netlink: 'syz.2.5100': attribute type 18 has an invalid length. [ 758.727312][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 758.890922][T24400] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 758.906426][T24400] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5106'. [ 758.926415][T24400] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5106'. [ 758.951289][T24400] bridge0: port 2(vlan4) entered blocking state [ 758.958632][T24400] bridge0: port 2(vlan4) entered disabled state [ 758.966813][T24400] vlan4: entered allmulticast mode [ 758.972528][T24400] bridge0: entered allmulticast mode [ 758.983235][T24400] vlan4: left allmulticast mode [ 758.989620][T24400] bridge0: left allmulticast mode [ 759.010162][T24406] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5108'. [ 759.254495][T24417] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5111'. [ 759.440405][T24427] lo speed is unknown, defaulting to 1000 [ 759.612674][T24438] ================================================================== [ 759.620810][T24438] BUG: KASAN: global-out-of-bounds in xfrm_state_find+0x2cf2/0x5400 [ 759.628847][T24438] Read of size 1 at addr ffffffff8b9c5468 by task syz.3.5118/24438 [ 759.636771][T24438] [ 759.639121][T24438] CPU: 1 UID: 0 PID: 24438 Comm: syz.3.5118 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 759.639149][T24438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 759.639162][T24438] Call Trace: [ 759.639171][T24438] [ 759.639180][T24438] dump_stack_lvl+0x189/0x250 [ 759.639209][T24438] ? __kasan_check_byte+0x12/0x40 [ 759.639239][T24438] ? __pfx_dump_stack_lvl+0x10/0x10 [ 759.639264][T24438] ? lock_release+0x4b/0x3e0 [ 759.639298][T24438] ? __virt_addr_valid+0x4a5/0x5c0 [ 759.639326][T24438] print_report+0xca/0x240 [ 759.639345][T24438] ? xfrm_state_find+0x2cf2/0x5400 [ 759.639372][T24438] kasan_report+0x118/0x150 [ 759.639401][T24438] ? xfrm_state_find+0x2cf2/0x5400 [ 759.639432][T24438] xfrm_state_find+0x2cf2/0x5400 [ 759.639471][T24438] ? xfrm_state_find+0x1da/0x5400 [ 759.639500][T24438] ? __pfx_xfrm_state_find+0x10/0x10 [ 759.639526][T24438] ? xfrm4_get_saddr+0xd5/0x140 [ 759.639544][T24438] ? __pfx_xfrm4_get_saddr+0x10/0x10 [ 759.639579][T24438] ? xfrm_resolve_and_create_bundle+0x6e6/0x2f80 [ 759.639603][T24438] xfrm_resolve_and_create_bundle+0x768/0x2f80 [ 759.639633][T24438] ? fib_rules_lookup+0xc55/0xe90 [ 759.639663][T24438] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 759.639685][T24438] ? __lock_acquire+0xab9/0xd20 [ 759.639723][T24438] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 759.639750][T24438] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 759.639773][T24438] ? xfrm_expand_policies+0x41f/0x6a0 [ 759.639795][T24438] xfrm_lookup_with_ifid+0x2a7/0x1a70 [ 759.639820][T24438] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 759.639840][T24438] ? rcuref_put+0x1b7/0x210 [ 759.639859][T24438] ? __pfx_rcuref_put+0x10/0x10 [ 759.639886][T24438] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 759.639915][T24438] xfrm_lookup_route+0x3c/0x1c0 [ 759.639937][T24438] __ip4_datagram_connect+0x9a5/0x1270 [ 759.639977][T24438] __ip6_datagram_connect+0x9f0/0x1150 [ 759.640005][T24438] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 759.640028][T24438] ? __local_bh_enable_ip+0x12d/0x1c0 [ 759.640049][T24438] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 759.640072][T24438] ip6_datagram_connect_v6_only+0x63/0xa0 [ 759.640096][T24438] __sys_connect+0x316/0x440 [ 759.640121][T24438] ? __pfx___sys_connect+0x10/0x10 [ 759.640158][T24438] __x64_sys_connect+0x7a/0x90 [ 759.640183][T24438] do_syscall_64+0xfa/0x3b0 [ 759.640208][T24438] ? lockdep_hardirqs_on+0x9c/0x150 [ 759.640232][T24438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 759.640252][T24438] ? clear_bhb_loop+0x60/0xb0 [ 759.640274][T24438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 759.640294][T24438] RIP: 0033:0x7ff46718ebe9 [ 759.640312][T24438] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 759.640331][T24438] RSP: 002b:00007ff468062038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 759.640355][T24438] RAX: ffffffffffffffda RBX: 00007ff4673b5fa0 RCX: 00007ff46718ebe9 [ 759.640371][T24438] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000005 [ 759.640384][T24438] RBP: 00007ff467211e19 R08: 0000000000000000 R09: 0000000000000000 [ 759.640398][T24438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 759.640410][T24438] R13: 00007ff4673b6038 R14: 00007ff4673b5fa0 R15: 00007ffefce2a7a8 [ 759.640434][T24438] [ 759.640442][T24438] [ 759.967394][T24438] The buggy address belongs to the variable: [ 759.973492][T24438] sysfs_file_kfops_empty+0x88/0xa0 [ 759.978800][T24438] [ 759.981123][T24438] The buggy address belongs to the physical page: [ 759.987532][T24438] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb9c5 [ 759.996216][T24438] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 760.004205][T24438] raw: 00fff00000002000 ffffea00002e7148 ffffea00002e7148 0000000000000000 [ 760.012878][T24438] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 760.021560][T24438] page dumped because: kasan: bad access detected [ 760.027971][T24438] page_owner info is not present (never set?) [ 760.034031][T24438] [ 760.036372][T24438] Memory state around the buggy address: [ 760.042186][T24438] ffffffff8b9c5300: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 [ 760.050289][T24438] ffffffff8b9c5380: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 [ 760.059077][T24438] >ffffffff8b9c5400: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 [ 760.067499][T24438] ^ [ 760.075093][T24438] ffffffff8b9c5480: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 [ 760.083551][T24438] ffffffff8b9c5500: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 [ 760.091624][T24438] ================================================================== [ 760.100601][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.108834][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.127693][T24438] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 760.134974][T24438] CPU: 0 UID: 0 PID: 24438 Comm: syz.3.5118 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 760.146732][T24438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 760.156803][T24438] Call Trace: [ 760.160103][T24438] [ 760.163037][T24438] dump_stack_lvl+0x99/0x250 [ 760.167658][T24438] ? __asan_memcpy+0x40/0x70 [ 760.172259][T24438] ? __pfx_dump_stack_lvl+0x10/0x10 [ 760.177555][T24438] ? __pfx__printk+0x10/0x10 [ 760.182164][T24438] vpanic+0x281/0x750 [ 760.186150][T24438] ? preempt_schedule+0xae/0xc0 [ 760.191036][T24438] ? __pfx_vpanic+0x10/0x10 [ 760.195556][T24438] ? preempt_schedule_common+0x83/0xd0 [ 760.201116][T24438] ? preempt_schedule+0xae/0xc0 [ 760.205971][T24438] ? __pfx_preempt_schedule+0x10/0x10 [ 760.211355][T24438] panic+0xb9/0xc0 [ 760.215171][T24438] ? __pfx_panic+0x10/0x10 [ 760.219604][T24438] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 760.225515][T24438] ? xfrm_state_find+0x2cf2/0x5400 [ 760.230638][T24438] check_panic_on_warn+0x89/0xb0 [ 760.235588][T24438] ? xfrm_state_find+0x2cf2/0x5400 [ 760.240715][T24438] end_report+0x78/0x160 [ 760.244992][T24438] kasan_report+0x129/0x150 [ 760.249519][T24438] ? xfrm_state_find+0x2cf2/0x5400 [ 760.254850][T24438] xfrm_state_find+0x2cf2/0x5400 [ 760.260087][T24438] ? xfrm_state_find+0x1da/0x5400 [ 760.265233][T24438] ? __pfx_xfrm_state_find+0x10/0x10 [ 760.270566][T24438] ? xfrm4_get_saddr+0xd5/0x140 [ 760.275877][T24438] ? __pfx_xfrm4_get_saddr+0x10/0x10 [ 760.281183][T24438] ? xfrm_resolve_and_create_bundle+0x6e6/0x2f80 [ 760.287525][T24438] xfrm_resolve_and_create_bundle+0x768/0x2f80 [ 760.293788][T24438] ? fib_rules_lookup+0xc55/0xe90 [ 760.298855][T24438] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 760.305468][T24438] ? __lock_acquire+0xab9/0xd20 [ 760.310446][T24438] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 760.315850][T24438] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 760.321226][T24438] ? xfrm_expand_policies+0x41f/0x6a0 [ 760.326603][T24438] xfrm_lookup_with_ifid+0x2a7/0x1a70 [ 760.331985][T24438] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 760.337796][T24438] ? rcuref_put+0x1b7/0x210 [ 760.342328][T24438] ? __pfx_rcuref_put+0x10/0x10 [ 760.347289][T24438] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 760.352685][T24438] xfrm_lookup_route+0x3c/0x1c0 [ 760.357725][T24438] __ip4_datagram_connect+0x9a5/0x1270 [ 760.363298][T24438] __ip6_datagram_connect+0x9f0/0x1150 [ 760.369122][T24438] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 760.375037][T24438] ? __local_bh_enable_ip+0x12d/0x1c0 [ 760.380420][T24438] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 760.386340][T24438] ip6_datagram_connect_v6_only+0x63/0xa0 [ 760.392158][T24438] __sys_connect+0x316/0x440 [ 760.396758][T24438] ? __pfx___sys_connect+0x10/0x10 [ 760.401911][T24438] __x64_sys_connect+0x7a/0x90 [ 760.406708][T24438] do_syscall_64+0xfa/0x3b0 [ 760.411228][T24438] ? lockdep_hardirqs_on+0x9c/0x150 [ 760.416442][T24438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.422513][T24438] ? clear_bhb_loop+0x60/0xb0 [ 760.427280][T24438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.433172][T24438] RIP: 0033:0x7ff46718ebe9 [ 760.437677][T24438] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 760.457498][T24438] RSP: 002b:00007ff468062038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 760.465933][T24438] RAX: ffffffffffffffda RBX: 00007ff4673b5fa0 RCX: 00007ff46718ebe9 [ 760.473949][T24438] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000005 [ 760.481936][T24438] RBP: 00007ff467211e19 R08: 0000000000000000 R09: 0000000000000000 [ 760.489979][T24438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 760.497953][T24438] R13: 00007ff4673b6038 R14: 00007ff4673b5fa0 R15: 00007ffefce2a7a8 [ 760.506025][T24438] [ 760.509339][T24438] Kernel Offset: disabled [ 760.513683][T24438] Rebooting in 86400 seconds..