last executing test programs: 5.141379729s ago: executing program 3 (id=3918): socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/mnt\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket(0x11, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="05000000030800"/16, @ANYRES64=0x0, @ANYRESHEX], 0x80}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) pipe(&(0x7f0000000000)) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) pipe(&(0x7f0000000380)={0xffffffffffffffff}) close(r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r3 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r2, &(0x7f00000003c0), &(0x7f0000000080)=@udp=r3, 0x1}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r6, 0x114, 0x8, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r4, r7, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000880)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @broadcast, @void, {@mpls_uc={0x8847, {[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x5, 0x58, 0x64, 0x0, 0x8, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x7, 0x1, 0x9, 0x0, 0x1, 0x2, 0x2, 0xb}, 0x1, {0x2}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x6, 0x3, 0x1, 0x1, 0x4, 0x2e}, 0x2, {0x5, 0x5, 0x3, 0x7, 0x1, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x201}}}}}}}, 0x0) 4.981945649s ago: executing program 4 (id=3919): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) (async) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x4e22, 0x1, @remote, 0x1000}], 0x1c) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x2, 0x8001, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0xd6, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0x4d15, 0x1ff, 0xfffff068, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x1, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x800, 0x1, 0x1, 0x0, 0x7, 0x196, 0x2, 0x6, 0x0, 0xe, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0xfffffffc, 0xf, 0x1982, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0x2, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x43d, 0x1b8c, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x8, 0x10001, 0x295, 0x6, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0xd, 0x7, 0x5, 0xfffffffd, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x2, 0x8001, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0xd6, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0x4d15, 0x1ff, 0xfffff068, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x1, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x800, 0x1, 0x1, 0x0, 0x7, 0x196, 0x2, 0x6, 0x0, 0xe, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0xfffffffc, 0xf, 0x1982, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0x2, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x43d, 0x1b8c, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x8, 0x10001, 0x295, 0x6, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0xd, 0x7, 0x5, 0xfffffffd, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r9, {0xfff2}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x800, 0x7, 0x0, 0x4, 0x2, 0x9, 0x7, 0x7, 0x1, 0x3, 0x98, 0x12, 0x8, 0x40, 0x9, 0x202}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r10 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r11, 0x3e}, 0x80, &(0x7f00000007c0)=[{&(0x7f00000002c0)="c2", 0x1}], 0x1}, 0x20004014) (async) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r11, 0x3e}, 0x80, &(0x7f00000007c0)=[{&(0x7f00000002c0)="c2", 0x1}], 0x1}, 0x20004014) 4.9190811s ago: executing program 1 (id=3920): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(twofish)\x00'}, 0x58) (async) accept(r0, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r1, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4805}, 0x20000050) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800014000000000080002400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2c000000180a09000000000000000000020000000900010073797a30000000000900020073797a300000000074000000200a01040000000000000000020000020900020073797a30000000000900010073797a30"], 0xc8}}, 0x0) socket$packet(0x11, 0x2, 0x300) (async, rerun: 32) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) (async, rerun: 32) socket$vsock_stream(0x28, 0x1, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) socket(0x28, 0x5, 0x0) (async, rerun: 64) socket(0x28, 0x5, 0x0) (async, rerun: 64) socket$nl_sock_diag(0x10, 0x3, 0x4) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r5, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x60}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newtfilter={0x24, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r5, {}, {0xffff, 0x1}, {0xa, 0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) 4.918475127s ago: executing program 3 (id=3921): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="611244000000000061136b0000000000bf200000000000001500000008ffffffbd0301000000000095000000000000006916320000000000bf67000000000000a406000007ff07006706000040000000070600000ee60000bf050000000000002e650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f2d4301000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9755ba08554bb4f2278af6d71d79a5e12810a089dc1d4681d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a6538b89dc6c60bf70d742a81b72bab8395fa64810b5b1bfd3782519518c51231422bb8fab4d4d897db2c544c0ec50b8eac8c63d2b1cd06a39702bd547f5ebaa6954f01cef3c9bacec15e2e3b2bd352e93a2aadfe8efe33ff2f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564b8f8a621483fb2a5ff221e0d831d64759d17b8c59d0f2b0727f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d54574164bbea3e7b7f8a13cce7014137f250370b8a70ae3eaf736f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf4b1be6f29358d4f5dfec405bde000000000000000000000000000000902e647cc5962eccaad64429335f3ce2a10ce72da82875427c1d16db24dca08487ba41a3fb337f8432d8176a515229e32ee11a1dd23dac038f989eafdd67f60b63f7be4d1bf325b57335b9973c73bfa89517a98b1fc15f8a2713718feb01059d8b570a0000e3b2a93bd745a74f9bf7f7abc5d15d56331055cc0820c5c9d676d92557c4e47cfbe27f91f0eb18e21dfdab3c84ec11377fbbfd1e000000000000b542a536559eed87b58edcfee83a50077ee0e8fb6e787cb3076dfeeb79f55927fef9651e176b40e64740a01944577caea4ceb9e907cec36a8429445c833b9d24d53dc91f15af1f4a1db9fa452fa3f0b812355aab5b58659ffd56034fdbb169f3e86660acdc65dc699d3e6364a80f45e54d6efcb99b41a080494f842706f3c1716d2e252bf89663393356296d89fbf95aa7966fa700b710008311d6f25e05f77d68799e671d90cb04131742790941d83ffdfa857e9e085a59a78e7a17f008ce55866fcc4de388f270a1ba675f43481bd2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) unshare(0x400) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000010c0)={0x1f, 0x0, @any, 0x3, 0x3}, 0xe) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0x25, 0x0, &(0x7f0000000000)="259a53f271a76d2608004c6588a80a38000d2f15", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) 4.333882319s ago: executing program 1 (id=3927): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'dummy0\x00', 0x0}) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r0, r2, 0x25, 0x2, @void}, 0x10) close(r3) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001100010000000000000000000000000a58000000060a0b0400000000000000000200006c6f775f6f66666c6f616400000000020000000900010073797a30000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x80}, 0x1, 0x0, 0x0, 0x2000094}, 0x80) sendmsg$NFT_BATCH(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000ff31ffffffffffdf00000a14000000020a01"], 0x3c}, 0x1, 0x0, 0x0, 0x4008004}, 0x4000000) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) r10 = socket(0x2a, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x2, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000075266f83000000000000000004000000ffffffff62000000000100009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1b, &(0x7f0000000100)=""/147, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x17, 0x10, 0x0, 0x0, 0x61e5cc96}, 0x22) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r11, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, "45208e", 0x10, 0x3a, 0xff, @empty, @mcast2, {[], @ni={0x8b, 0x0, 0x0, 0x7, 0x43}}}}}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x70, 0x2c, 0xf3f, 0x70fd30, 0x25dddbbd, {0x0, 0x0, 0x0, r11, {0xc, 0x3da48c8682330ab8}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0x86, 0x3}, {0x5, 0x7}}}]}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x1, 0x7, 0x4}, {{0x3, 0x0, 0x1}, {0x4, 0x0, 0x1}}}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$TUNGETIFF(r4, 0x800454d2, &(0x7f0000000180)={'bond_slave_1\x00'}) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000001f40)=[{&(0x7f0000001d80)="ca", 0x1}], 0x1}, 0x20004014) 4.115007216s ago: executing program 3 (id=3928): socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df0700010014b3be76bc4086dd87", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1}, 0x50) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$bt_hci(r2, 0x0, 0x3, &(0x7f0000000080)=""/3, &(0x7f00000000c0)=0x3) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r3, &(0x7f0000000640)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x1}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)="f8", 0x1}], 0x1}}], 0x1, 0x20008050) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000002c0)=@newlink={0x248, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_VFINFO_LIST={0x228, 0x16, 0x0, 0x1, [{0x64, 0x1, 0x0, 0x1, [@IFLA_VF_LINK_STATE={0xc, 0x5, {0x9, 0xe}}, @IFLA_VF_VLAN_LIST={0x54, 0xc, 0x0, 0x1, [{0x14, 0x1, {0xb4d, 0x69, 0x8, 0x8100}}, {0x14, 0x1, {0x0, 0x70, 0x200, 0x88a8}}, {0x14, 0x1, {0x2, 0xf5e, 0x2, 0x88a8}}, {0x14, 0x1, {0x26, 0xf34, 0x3ff, 0x88a8}}]}]}, {0xb4, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x45e, 0x1bb}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x341a, 0x6}}, @IFLA_VF_RATE={0x10, 0x6, {0x70f, 0x218, 0xe}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0xfffffffc, 0x100}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0xffffffff}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x40, 0x6}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x7, 0x5}}, @IFLA_VF_VLAN_LIST={0xfffffffffffffec4, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x8, 0x275, 0x8000, 0x88a8}}, {0x14, 0x1, {0x3, 0x244, 0x1, 0x88a8}}]}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x2, 0x10001}}, @IFLA_VF_VLAN={0x10, 0x2, {0x50, 0xad7, 0x2}}]}, {0xe8, 0x1, 0x0, 0x1, [@IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x4, 0x6}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x71c, 0x81}}, @IFLA_VF_VLAN_LIST={0x68, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x1, 0xd5, 0xfffffffa}}, {0x14, 0x1, {0x8, 0x45f, 0x7, 0x88a8}}, {0x14, 0x1, {0xa33, 0xb1e, 0xa2, 0x88a8}}, {0x14, 0x1, {0xb9, 0x51f, 0x7, 0x88a8}}, {0x14, 0x1, {0x1, 0xb62, 0xfffffffa, 0x8100}}]}, @IFLA_VF_VLAN={0x10, 0x2, {0xf8, 0x507, 0xfffffffb}}, @IFLA_VF_VLAN_LIST={0x2c, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x5, 0x925, 0x9, 0x88a8}}, {0x14, 0x1, {0x6, 0x3d2, 0x1, 0x8100}}]}, @IFLA_VF_TRUST={0xc, 0x9, {0x0, 0x7ff}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x8000003, 0x9284}}]}, {0x24, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x7ff, 0x4}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x3, 0x74c}}]}]}]}, 0x248}, 0x1, 0x0, 0x0, 0x4008011}, 0x4080) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000240)={0x0, 0x964, 0x89f8}, 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f00000001c0), 0x8) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000580)) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r5) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x34, r6, 0x6a98047402e98331, 0x4070bd29, 0x25dfdbfc, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004110}, 0x8000) socket$pppl2tp(0x18, 0x1, 0x1) syz_genetlink_get_family_id$ethtool(&(0x7f0000000ac0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) 3.912420974s ago: executing program 4 (id=3932): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0xfffffff8, 0x3, 0x1}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000002040), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r1, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000000380)=ANY=[@ANYBLOB="b5635aa36c6c108a397c6fae974d80fcf18deb2578c78fbb4b68279b44d654b2903579d595c79af5e29d835b83a38051747d6aae3b3e346026e477160855215834687bccf29c8e938354b068821482a5312d404f9a439c58de3d107a122e7d6fe0f0b34bf2dac8fe278c70a99e6f34f2e306cb3d83f357e6449243455b98893708aa90237783b364d526d88d8e2c7c592cb7d5ec99f951ab14e9fa98fbab", @ANYRES16=r2, @ANYBLOB="010026bd7000fddbdf2501000000080003000700000005000500000000000500060001000000"], 0x2c}, 0x1, 0x4000000000000000, 0x0, 0x882}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910710007e570966f4366ec9d4"], 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) recvmmsg$unix(r3, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@getqdisc={0x24, 0x26, 0x10, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0x3, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x20040000) r5 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ec0)=@newqdisc={0x68, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xffff}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe, 0x4, 0x7, 0x4, 0x2, 0x2cf, 0x8d2, 0x1}}, {0x6, 0x2, [0xffff]}}]}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x401}}]}, 0x68}, 0x1, 0x0, 0x0, 0x80d1}, 0x34008098) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$kcm(0x21, 0x3, 0xa) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r9}, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) write(r8, &(0x7f0000000040)="0d00005c0200f400013ba938c8790200d52c57ddbef02a69664da5e583faf0f534288f3a2e27dbfd327b0c53fc537e35af22abefe6a3557b07", 0x39) 3.648026063s ago: executing program 0 (id=3936): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000002c80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40209c0}}, {{&(0x7f0000000080)=@abs={0x1, 0x0, 0x4e23}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x20000000}}], 0x2, 0x20000000) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r1, 0x890c, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="1720000021200000400012800c0001006d6163766c616e0030000280080003000300000009000100100000001c0005800a000400aaaaaaaaaa2d00000a0004003426f7b68ed1000008000500", @ANYRES32=r3], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1e, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) setsockopt$inet6_int(r4, 0x29, 0x4e, &(0x7f0000000400)=0x7, 0x4) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYBLOB="d506330080000000ffff"], 0x6f4}}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x97}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x24, r6, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x24044810}, 0x0) 3.282106076s ago: executing program 3 (id=3938): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x69b, 0x4}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x1}, {0xffff, 0x1}, {0x2, 0x8}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x14, 0x2, [@TCA_PIE_ECN={0x8}, @TCA_PIE_ECN={0x8, 0x6, 0x1}]}}]}, 0x40}}, 0x0) 3.039190148s ago: executing program 0 (id=3939): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) socket$kcm(0x2, 0xa, 0x2) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x8, 0x12) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$NFT_BATCH(r3, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000100)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={0x0}}, 0x4000800) sendmsg$TIPC_CMD_GET_LINKS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r4, 0x100, 0x70bd27, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0x9}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8011}, 0xc000) r5 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/pid_for_children\x00') unshare(0x2020600) ioctl$NS_GET_PARENT(r5, 0xb702, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_queued\x00', 0x275a, 0x0) socket$rds(0x15, 0x5, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r7, 0x3e8, 0xe80, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) (fail_nth: 25) 2.579892292s ago: executing program 3 (id=3941): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000000203010100000000000000ffffff7f000800034000000000080004400000000008000540000000000900020000000000020000000800010001"], 0x40}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)=@newtaction={0x5c, 0x30, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x48, 0x1, [@m_bpf={0x44, 0x1, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x6, 0x9, 0x10000000, 0x4, 0x2c33}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x5c}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x84, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e24, 0x279, @remote}}, 0x1000, 0xffff}, 0x90) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000780)=@filter={'filter\x00', 0xe, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, {[{{@ip={@loopback, @remote, 0x0, 0x0, 'lo\x00', 'lo\x00'}}, @common=@unspec=@NFQUEUE0}, {{@ip={@loopback, @remote, 0x0, 0x0, 'lo\x00', 'lo\x00'}}, @common=@unspec=@NFQUEUE0}, {{@ip={@loopback, @remote, 0x0, 0x0, 'lo\x00', 'lo\x00'}}, @common=@unspec=@NFQUEUE0}], {{}, {0x0, '\x00', 0x0, 0x0}}}}, 0x2b8) sendto$inet(r3, &(0x7f0000000000)="12345678", 0x8, 0x0, &(0x7f0000000020)={0x2, 0x1234, @loopback}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000040)={'lo\x00'}) ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x82307201, &(0x7f00000004c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000140), 0x8) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r7, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r5, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, r6, 0x100, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x57}, @void, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x5555, 0x7a}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xa, 0x2c}}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x44}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000084}, 0x8000) 2.52304486s ago: executing program 4 (id=3942): bpf$MAP_CREATE(0x4000000000000, &(0x7f00000007c0)=ANY=[@ANYBLOB="0600000004000000be7000005c00000000000000", @ANYRES32, @ANYBLOB="003601005f"], 0x50) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet_tcp(0x2, 0x1, 0x0) r1 = gettid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000006bc0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000006880)=[@cred={{0x18, 0x1, 0x2, {r1, 0x0, 0xee00}}}, @cred={{0x18}}], 0x30, 0x800}}], 0x2, 0x20000000) (async, rerun: 32) r3 = socket$kcm(0x10, 0x2, 0x10) (rerun: 32) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) (async) r7 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) (async) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x9}]}, 0x2c}}, 0x0) (async, rerun: 32) sendmsg$nl_route_sched(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x20000003}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) (async, rerun: 32) write$tun(r4, &(0x7f00000004c0)={@void, @val={0x1, 0x0, 0x9, 0x5, 0x6}, @ipv6=@icmpv6={0x1, 0x6, "d78643", 0x1c, 0x3a, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, {[], @mlv2_query={0x82, 0x0, 0x0, 0xffff, 0x9, @remote, 0x0, 0x0, 0x4, 0x3}}}}, 0x4e) (async) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r8, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) (async) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x513000, 0x1000, 0x0, 0x1}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r9, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) (async) setsockopt$XDP_RX_RING(r9, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) setsockopt$XDP_UMEM_FILL_RING(r8, 0x11b, 0x5, &(0x7f0000000340)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r9, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) (async) bind$xdp(r9, &(0x7f0000000100)={0x2c, 0x0, r10, 0x1, r9}, 0x10) bind$xdp(r8, &(0x7f0000000240)={0x2c, 0x1, r10, 0x1fffffe, r9}, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="400000004100010000000000000000000101000000000000040008000400028020000180100004000000000000000000000000000c001c"], 0x40}}, 0x20048014) (async) r11 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$NILFS_IOCTL_GET_CPINFO(r11, 0x80186e82, &(0x7f0000000540)={&(0x7f0000000340)=[{0x3, 0x0, 0x7cae7b9c, 0x8, 0x101, 0x3, 0x3ff, 0x8000000000000000}, {0x0, 0x0, 0x34a, 0x1, 0x7fffffff, 0x8000, 0x7, 0x10}, {0x1, 0x0, 0x5, 0x3, 0xfffffffffffffffe, 0x5, 0xffffffffffffcaa9, 0x7}, {0x0, 0x0, 0x10, 0x100000001, 0x5, 0x4, 0x7fffffffffffffff, 0x3ff}, {0x3, 0x0, 0x0, 0x0, 0x400, 0x2, 0x7, 0xffffffffffff6bf6}, {0x1, 0x0, 0x8000000000000000, 0xfff, 0xf, 0x7, 0x400c, 0x3}, {0x1, 0x0, 0x7, 0x6, 0x2db, 0x411, 0xa, 0x7}, {0x3, 0x0, 0x5, 0x80000001, 0x4, 0x328eb720, 0xa, 0x8}, {0x1, 0x0, 0x5, 0x3, 0x0, 0xff, 0x8000, 0x5}], 0x9, 0x38, 0x1, 0x1}) 2.245779788s ago: executing program 0 (id=3943): unshare(0x2c020400) unshare(0x40000) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x4, 0x8000}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x4c}, {0x6}]}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000200)={0x5e, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x3, 'lblcr\x00', 0x21, 0xce85, 0x4}, 0x2c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="00950e0da34e7a803207795254f9de42710fa0bc1b4d591b1e1bc7c8d489d29124bde3f76494a54fbaba"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) socket$packet(0x11, 0x3, 0x300) socket(0x2, 0xa, 0x300) recvmmsg(r1, &(0x7f0000000940)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x0, 0x0) read(r1, &(0x7f0000000080)=""/64, 0x40) 2.131005368s ago: executing program 1 (id=3945): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="00000000040000000000000000cbd3f5303e3f324689ed79da891aabed09402b8046cb5afbfbfa5f578df76e403473d35d25b8a9c1d221bfc94e92c7a573f8f3c28563fa8187c326f61681035dfc9934b4b8a0ff6e7faeaec86ef0f8a947aa7c", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095", @ANYRES16=0x0], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000001640), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$inet6(0xa, 0x80000, 0x2) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000340)=0x152, 0x4) setsockopt$inet6_int(r4, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="d0000000120067fb27bd7000ffdbdf2500000000", @ANYRES32, @ANYBLOB="820000007002080008000f00080000001800128008000100736974000c0002", @ANYBLOB="0400140008001d000200000008002e"], 0xd0}, 0x1, 0x0, 0x0, 0x4000800}, 0x4800) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001680)=ANY=[@ANYRES8=0x0, @ANYBLOB="54a62d6f27c246ef86949a179168b40f8d5111abd5522797a5b8ab1f8f2660aba25ed9de98ae514b41c4df3aef813b9dba29f33ea99ddb4d457704af68a602536447717be404bb069185b70ed1b2afb0cdd168b687657d965fdfcf699eaa98c8263906df9b21521cfdc17127f669cbb417d13763596294d4272e8b4c2fb9ffdcbbdbfb5e1fa5ad70193b95ef58ef94a5bce0118b766a87bc4609330d7a197556e5128c9e08fd9878883e7d266d5e053e5643711dfd1893d955e71defba70bad35fc939ca44db8e0f3dc4ed7764a06caf6dc27e86b4f1a8def296bffc21b0c58da6317f1b747fcdba39f655da8489f8520938700b4fa8dc83348771a99192e52a636b1ad1ce17103e51fc8a74aa81b9b6f44fe8274c4e3f4ad2fe1a5c744ea42f7fadcc8c3621ee50638e364b31c5c2dfd2b1f3eb30e88bd826076cdc2bf68c6f004d52d7e8a7512f1b13d64629a965e53662a9931303a34c49118071eb602fe95dbc4378649a3b8ea64a4b024677e415dcf85d4da37ecd7d48d82178668d334367a7f25323712ba21ccbee873ab774e3692f5b40571acf53144888715f25678551aad859232685daef1c3fa06f3e85b1120ef19748a099f7ffcc0f5be66c709b0a29ba4e2e1dfc7b9a7c026bd721c6b9a3235007c51e16dc03f9a7ce9ae9ff5a134b69f8a45ee5659fe920f80c1a02c0732f7f2f6a07e684235b240c3b08dd16093a8dd4d0c4a3e5ce5d67ca49eaef295aa37afa26fab35cabf55f0ba4150acee77685ac7c35a8e0060931ba1cd8f28f68e9cf76ccee5b0a6a0698c5c126376053ba394bdb6d0728ae4dc4119e1504128b7830d2b980988a3e14ebca8ec4f1b98c63d1d1565af32ae1e32911d9a06fbc3a6e6718cb8c32e1465269db28a6228674b6d7f5fbf5ca0f41271310f9a12aee6d5ae59bf1febe711a217a572d3c0ad82adaaa4044122060d9cc575a230ed53456b96060bfa0bce5b9bf86de4b0707acea19ee8cb89abc96b870f406c5b221886c428d13b0c2f223aa26c83125d7fd81949f8170ac738f301898e900bd2f8fbb3b24d6e0622c1b2b6fd3f79b118271e7d2ffce882c027f6ec3a181916a4046335a7a588aec649ef8cdec4c223a04bd4ff3946dbed6b40af020986cc3ab10c5779166fc3a9d24139b76c605536be16599c1e80444f599a99501c0e01d4eb9794198c3c589f4b7f13baf20f655a3833f677ea649fee9c9beea86c988954b487be609748b1e1f95a4c529fb409d607ed0ef6906fa9e39badd956f7d9d9ba0ea86f53867a107de86cdf016ad043e0785112b3cbf32ce42432dda84f167a3009322413ad46ebd44e85f6a72593d43ba52f833f09932c5fafb2f632f05c1cc552f1ce4a54866920b8618046fdae95a93f8f5892f5f95b084dc650eee98ad03e999ba67b0f0dfd98a7cc6a479a109482524b4e165147efa06e8070b48ae7366d9973383f6c4971629c5fa7e3bd3fd68fedbdb515d14c986a8e8df3874cf58234300bd6072439b33dded910deac76707adaa6bd8c2fa5ea198838ab38596bf126e6da2d9c941176f4bdb1ecdf025cc1b252cd0827b2697964d979dc09817eb403f93ad9a0af8a06ff99c2569dfe5d42cab5516635d8e200853c876abce5ab65c76530d39d8387dc68c94c5479b08425fc2d84ad9af72b37c75e6af7c3ddabfa2540c979da36c91eb4edbcd6bef6fbbf668f24caea40ca5c5183712404d9c6b17e32a0e32a258b2fe522cdc75b699e0e97377b6909a7c3e6287d596592c82ebe2fcbee762e315fa87af424d7f2f69efdb3ff472e5425b3124ecabdca070d1fb2c57fb590a9bc6743d9ac2cec1cbcf8cbf6de1431e9de55150b1e65cb2ef2fd9c21a1f634893eb2879489b0c8a5e3d017dfa418252fff4b448a66c1ea9a5d3c824363d65a7fd99dac1ceb4aff9867c31d194df5574d897ca4472cb4ae16e72b7375b6c602afdd3b184fbeb8f6aace4392644fce2a02e78b67724048d45024ca97f3d70cca8c95ac9be2c6664ec72d4ae213edcecce21dd7d7260352ac6077c2691193b1ae39d75fba73466215f9d342f632694741543ed6b7bb50dc553347705063ee4d95622302bc55abcfc3b3b8d39cc95b41978399cf7ebb82fc24cf2543581d4f96ceff83c831ce955c5ac0730c1f2680dea232216e43dcadc1dd270970cf06e6235adb9b119750c4b154ffaae14b57f4f2f49a4cd8c6f38c926fec78c9be2ee8ac5e96604775dd6c9eacb8cd88a6dbb0fa993a7299cac56aea9fb220b40eb17b5a83242dfce3fc46d11984aaf1cee49ea1ecbbb7b93e0aad6c0f8a7fae30b68c7634b396faef3096c4a85b46bdab51237bebd3fc65a5a6cdb24033a04087c27025d55e4c9ab9365b611770d69545729a9498fa228fb6242b71aea8331e61d8fe0b5b510394dc84e7e031aecd4974bbde9be9509350b493ed127ba7688756ff6d32e7e0ee45d6518db76a53908a4b15b554836e543387e8ed067cb95f2eab01fa2edf2b1b66384807e775d5535b3f75a1ed21c62acb8f90298d10387c6d315feffaa8d8fb402331997470c422b8d75e3bb10daba5f7631ad1e8c63eb65c5f8e08e82d1a256ccde9c153fdd98a8760f59a51b6065a466ff326d23174d78bb862ba2728ca8a2b04befa42dd96412e680df899aeb8e7403baeba10e816945db73e9a2f5b99130b92ea378988bc734b951edace500308bbf5fd9661e39b58d2ef4d5767f51a86740a3f5796582413c8203bda9545d4998125200845fb64bd68e8a948f5046287deaca16f1b0a067b5027bfce4558e4dda7dbf949860718ca30cf3b81d13bb69bab90735cd3cd39fafaeb96bd9735df7c45b8269a52179f2e287e22228fd1190ae0165e5f3bddaa04414288c0c710fd02e29c3baaa447fd97bc7cd33740270915e53ed6024f76e38b72af9a97215ed7bfb2fb740dfeb7c844832cb59bd11330be525d1edaa59c8f125315aadf906bb6d9942850d5e613231cd2a4b08c695139ce9c05054f8192a470e6a239415c594a28cdf7a270c769e70700355e21536549ca7e90f0600f0082f7efb5bc219ec9a871da0f2f8ca775f186316a8dbb3954c04a7e89629c432ab1240fbea047e09267a441496519f74888e81279ab866dc973c18d8d6c0111caa6567c4d875b35a0cc2bb5e94a0d6ea589b4ac16b4360308ffdfbcd872bde1e15dd67591f2a76db5381c31426e259d177d8a72bd5bbc92e5826a258c1387a1d2ee24639b18b6bb89f3a8c10441cffdd410c8661a30942c281481df77742bdc5315371c784b6f10a0ba59da792bf87de6ef7ad2620cdd7f123d1d8604892b784248429f98e20a1f3f6774363b3a25575efbadbd550fd9aecb772d11dc30384bcb768e5c5846adbe2f7c055e2c3e925fca1f11b2469233ea35548a4bff9116f19b8cafee6e710f3eff0b312d9972e9264dc6df476dbe944ea8ef153fb3d0737a70f088e72704df613faf06ba61a034cdb8023cec6268d760bb1c82b8f033a7f78d89a7501072353516a0b40d3c377ce9385ef41dbae7a6a6cec3d7cea010d3862b18c549bae182960601abd5ba6ed4a18d4a30b5b2e95aac883bac266099f47dc12b35aabe97f102678f038f459459731680571d0cd41dbb2e01d24572636cd9f44f60f025e885fd00f5cc6dd8b10a32e52d55f657fa2caad73c65ea4dc60fc5a7d1da66792f94034e8e82d5ac9eeb33076060c0b1bb71eb384a578a948a65f301633ce04625c6faabce59b95d76e480396322fb2f9f86c4b7455134242e7e19434581b14cddc382c1e50785c00d8fceb9d01fcca40a42127fad6d8e3c741885a56029f4f23d5ef00582834d9099c696ad8dd32da7a37e20ab0e3b1bcfb131d77238f8ef15a3c520bae3ea8a5b710b11de9499ecae41c5aa7ed12f550d9c468d6c304eb9d9dc76705f409dd6ee2cb84987a15a3fd7762ad7565080254856a20f62a149ef560ad9ed043c8ce58b8a813cf6b94dbf5644f5ba76390c80fb46b614197d0c94946809ce8759c7bb9f7fd20253b8fb87a45beb8eece0b294d09692fb80bb92e7e90f67d1d2f37da85863631733325487b235b28995b8b41ee92440be213bc3fbe96876fbeee11b5bdc64784a03c9c95720ea51ff1f3dadd13d89434795708f9b368eb0378f011fda602c9c64f8be27e3ce1a5ce5cfef6b0c1eeb75c2170c7fa8bebe198189e3e398c851cb6771532d7f04dbec2a6722946f8dc8d5820d2bea3b6445519daca05c675a5200fbe693eb3f81499e0a85453fea1b7262a6ae8e72f86dbd70c4b5affeb8c7e6c284444b87bc786e2b1f6f648051a761a7293a00987144b6d75a866d1af1d58d246a01af8dac583d7b850996e58d2933721eb6ae195e218b7a0c6b2a4638b8683ffe731d9ab78c4b1ed8825f1867dc6305fd1b2902b66926e1f19088b67d03b5381035b17145d143abe01d8f19ee424ce1244278ed031fb3382a08994809a342a7574e7858d0d00723a4fdb1368dcf393e7c9974b9ff3fa6d752e4db9b868247bc3864fb76d78563398763e4fb5da06fe24446c3149113622dab7452b517aafa2e8d3277cd2164209951cbd16e88133e54dccabe3363a4dbd697f8c0dbe1e662591ef5201709cafb0a18e2fde48085d86b44417855380d54dc5fef9cdaffe79b411c86be5b16f2afdfe062133e3b2cd06c77e46e3079f9c76e3091e2a210eb6df844b71d3e3024b2d77258c178daa31754a692fa9ea3501d5e2678f421410e344550a3408ab79ff735e8dd8a7f43d50ee59c2ec1d76493f2bb6e192026068494ac9d9e7558da2c840e484220be0ed3b5b49ac18fa0d750bb30b01caa74a568d379d7ed80383348156dae63152a33406956c0c44b1ced38e9c5aafec57cc5fda13b923584fc6e4b1b35c443a7707c1d25333cf3f7d36fd6fd450c8ad19d43c1037725769b5ad6c6d5ebb3642861ae3beba84fb90673b699eb1c7842d72d3aec9b7868969405645df6cae5c596a2196b29b9fe9f74bb5d987b229919f2d844ad123d6402696c13526a3aac3f5a98e9eb6d6d5828f65709c51c3159c455bc069cf847edcb01ed3555e5f1d55336422fd9c0f005609148927576508422b528c32cb4134b3a7e2a1ffcee17e36ba8de3cb360dae3df2648f87510bbfb98dc43373a978339d7a67e4fc2cf121ac29981dd682bcde69e26e69d80f3ee94a56d12938bf81fb64a5f3bf904cc304a5702379dd8dae23085f6ee59ceb211d8c8a94de2ab7057d9ee6f02993847b247fa172d4929039e56bb383b65853d1cd65cfa247421454578fe654db4a382dd529b94cfdf80a237c9ae53ae7a89ff0fe45cac2214e0e332f6c801e743bdbd801a297954fc742b1801ed4093451b2559afc1612d345127621eea064c40c0c1f2967e155078a48f56843726fa7f758005befef47243d409ea9fdfe617cb2a5e6dfd2b32dddf34f1d5129c0e7592012c7deaa63f28289232efe52587ab039d8f9f33720735beab980854b38fa63764c94e07704698c5d7f48d51922a4d3b9845012e1ed7077017a70f77a80810681720ffb40d64aa6d4b507074f3dc670b50687647661e37c5aae0aea2a0d8f28c0662e2b93e784335d21e3b958110be8e50f4aaef6347fd12e1911c769bb5c3969be3b5db78201db1ddd5a13ccc140257f993755ef70b08f829d5e006f89f4c9e6fe432fa0d003a28a30a8a1549d686f68ff79d62f986ef727e47a40731d4ff203d73688edf963f529dafbd4d96d9beee5040e99d5731dd3a5994645616bd66234e05de7d780", @ANYRESHEX=r3, @ANYRES16, @ANYRES64=r2], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r6, 0x0, &(0x7f0000000100)=""/7}, 0x20) sendmmsg$inet6(r4, &(0x7f00000002c0)=[{{&(0x7f0000000b00)={0xa, 0x4e23, 0x7, @local}, 0x1c, 0x0}}], 0x1, 0x24000000) recvmmsg(r4, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/153, 0x99}, 0xdb31}], 0x1, 0x40002102, 0x0) r7 = socket$kcm(0xa, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r8 = socket(0x2, 0x80805, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000280)={0x5e, @loopback, 0x4e22, 0x100003, 'rr\x00', 0x34, 0x80003, 0x70}, 0x2c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2e}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYRES8=0x0, @ANYRES8=r1, @ANYBLOB="7d2a55dd73c1832200d9492ac06d91e713743b43e574024ff1a7a806e6cc09c13c8c649950d85bc4c26a58f131894245", @ANYRES32=0x0, @ANYRES32, @ANYRES8=r8], 0x50) close(0x3) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e21, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1ff}, 0x1c) socket$kcm(0x2d, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r8, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e61, 0x3, 'lc\x00', 0x8, 0x20000, 0x77}, {@remote, 0x4e20, 0xac91d2bf000ec5eb, 0xcd}}, 0x44) sendmsg$sock(r7, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r9, 0x0, 0x485, 0x0, 0x0) 2.08589634s ago: executing program 3 (id=3946): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f0000002980)={0x44, r1, 0x1, 0x70bd2c, 0x25dfdc03, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @loopback}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000080), 0x8000, r2}, 0x38) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x6, 0x5, 0x0, 0x0, {0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x58010}, 0x800) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd27, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'xfrm0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xd1}, 0x8014) r5 = socket(0x11, 0x3, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r6) bind$packet(r5, &(0x7f00000001c0)={0x11, 0x0, r7, 0x1, 0x2, 0x6, @broadcast}, 0x14) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x26, &(0x7f0000000640)={@multicast, @multicast, @val={@val={0x88a8, 0x0, 0x0, 0x4}, {0x8100, 0x0, 0x0, 0x1}}, {@can={0xc, {{0x3}, 0x5, 0x1, 0x0, 0x0, "87fec05b53996cd2"}}}}, 0x0) sendto$inet6(r5, &(0x7f0000000240)="aefe9193226504984bf1f2", 0xb, 0x24044001, &(0x7f0000000280)={0xa, 0x4e24, 0x80, @mcast1, 0x7f}, 0x1c) socket$kcm(0x10, 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r8, 0x84, 0xb, &(0x7f00000002c0)={0x6, 0x2, 0x4, 0x1, 0x10, 0x8, 0x0, 0x9, 0x0, 0x8, 0xfc, 0x0, 0x1}, 0xe) shutdown(r8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r9, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r10, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) 1.786240611s ago: executing program 4 (id=3947): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.648525641s ago: executing program 4 (id=3948): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000006400)=ANY=[@ANYBLOB="4433000041000701fefffffffeffffff017c0000040042800c00018006000600800a0000203302801c3317800400150004008b80080086800400b28006330180242019"], 0x3344}}, 0xc000) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x3d, 0x800000, 0x8, 0x7, 0x2, 0x81}) write$bt_hci(r2, &(0x7f0000000080)=ANY=[], 0x6) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000003200)=@newtfilter={0x478, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x4, 0x5}, {}, {0xd, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x448, 0x2, [@TCA_CGROUP_POLICE={0x444, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x2, 0x100, 0x8, 0x9, 0x401, 0x1, 0x1, 0x7, 0x3, 0xb84d, 0x6, 0x2, 0x0, 0x8, 0x9, 0x3, 0x3, 0x2, 0xc, 0xb, 0x9a, 0x8, 0xfffffff7, 0x1, 0x74, 0x6, 0x6, 0x0, 0x401, 0x1, 0x83, 0xffff, 0x90000000, 0x3564, 0x0, 0x992, 0xd, 0x7, 0xf2, 0x2ba6, 0x8, 0x12, 0x1b5b, 0x5, 0x6, 0x800, 0x2, 0x1, 0x40, 0xfffffff8, 0x86, 0x3, 0x7, 0x3, 0x10, 0x90d4, 0x10000, 0x9, 0x5, 0x6, 0x5, 0x400, 0xa6, 0x6, 0x7, 0x7, 0x7fff, 0x81, 0x2, 0x5, 0x5, 0x40, 0xfffffff7, 0xb3, 0x2, 0x2, 0xa, 0x9, 0x10, 0x158, 0x5, 0x7fffffff, 0x7ff, 0x97, 0x8, 0x4, 0xd5, 0xffff, 0x2, 0x6, 0x9, 0x8, 0x6, 0x1, 0x401, 0x289, 0x5, 0x800, 0xf35, 0x7f, 0x9, 0x6, 0x1, 0x800, 0xd90, 0x9, 0x26b, 0x6217, 0x1009, 0x4, 0x7, 0x6, 0x2, 0x3, 0xf, 0x1, 0x4, 0x5, 0x4, 0x3, 0x7, 0x3, 0x7, 0x9, 0x400, 0x8, 0xffffff01, 0x9, 0x8, 0x7f1, 0x6, 0xc, 0x4, 0x5, 0x4, 0xb, 0x80000000, 0x7f, 0x3c, 0x5158, 0x3, 0x448, 0x9, 0x80, 0x4, 0x81, 0xf744, 0xd, 0x0, 0x3, 0x1, 0x9, 0xd3e, 0x4, 0x2, 0xd6d, 0x476cf286, 0x2, 0x105, 0xd6, 0x80000000, 0x6, 0x3, 0x6, 0x2, 0x5, 0x8, 0x0, 0x9, 0xf8, 0x0, 0x5, 0x800, 0x3, 0x3, 0xff, 0x6, 0x6, 0x6, 0x8b9d, 0x4104, 0x8000, 0x0, 0x6, 0x3, 0x56, 0x0, 0x2, 0x893e, 0x2, 0x3ff, 0x8, 0x1, 0x0, 0x80, 0x2, 0x8, 0x7f, 0x5, 0xa54, 0x2, 0x1, 0x2, 0x8, 0x97, 0x2e, 0x4023, 0x7, 0x9, 0x9, 0x20, 0x9, 0x2, 0x80000000, 0x100, 0x5, 0x1df, 0x9, 0x40e4, 0x7, 0x3, 0x609, 0x7, 0xd5c, 0xfffffffe, 0xfffffff9, 0x6, 0x19bd, 0x885, 0x7, 0x5, 0x9, 0xbe000000, 0xe9, 0x4, 0x61bf, 0x1, 0x100, 0x77, 0x81, 0x0, 0x0, 0x9, 0x8, 0x6, 0x4, 0x4, 0xfffffffc, 0x4, 0x5, 0x3, 0x0, 0x1, 0x7, 0x401, 0x69]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x10001, 0x4, 0x5, 0x3, 0x2, {0x2, 0x1, 0x3e, 0x0, 0xffff, 0x800}, {0x4, 0x1, 0x10, 0x9, 0x2, 0x2}, 0x7, 0x7, 0x800}}]}]}}]}, 0x478}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4041080) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(twofish)\x00'}, 0x58) syz_emit_ethernet(0x4a, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb8100300086dd60c6dd0000103afffc000000000000000000000000000001ff0200000000000000000000000000018900907801fe000000000000feffffff5cd7c9000f11fbd360eec6e21d545b10765118608c8dc51dcb246771c08f710d6cb211763df16d5a6e33d32ff2b8"], 0x0) syz_emit_ethernet(0xf87, &(0x7f0000001180)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0xf51, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @local, {[@routing={0x84}], "223427d5c9a46b9fa14172170a013589317d2af31ba55431762f462a5abc3f46494ee91bfca594d52f8c3785143e92da5d2d81edc09f68f122fbf741257bf1319408347a17c89212dfe27a0fc65362487e5afe673f0954f60d9d08b61276ce0b3aa520b5f30a9f52c4aa53fc003f8570383ca63530d93b78a7875338b3d7645ef2c24ab05db63cfdcde7b3cac2248c9d1c73d0d4382b3f520ad6e9be698eaa9bf5b939ce09919c9485c4725690ee2483315829a196f85a5ae552ebe19a2d6768ce2a6bf60fbb53104c7919b7cf28fa555fc9460df11e72eddebb2fc4eb6f83b16e0d65307e4210dfc209f0c68df65b57f420fd215546b798af6b6ab7bfb2fe6bd6142f877852717370b1ca39d199c149c3ead97c4e16229ce4c08a111a0fc64651c21e9174dd72442a9ae2a42d9433c7b54c8dd4b59203f9a2e227e9b043eb430e606cf98f3428ac8511948dd553bc0728c0626fbda71bd2a1d734d605e27bdb0be93b7b91284689e31fccb70c15f2c39da9011c84d36fe4b4b36ff26e45a34685fc638dbdaa068a3d3d4f5d44b74afc0fc7956e5fcc3fe405ac6d292d1d90f257f18fe14a3192d28ed369956aa2f91f9fee773cf7fb5d90705347eeadc1af86de78a498fa1a20e5b3f481a0595769654d969299506d8ffbc172a7fb9453a8a3787e80b167936863f2cc16c1d03481bd40e1abcf87a292559771572136932bf30e48174012a1d4d5f138f93140af2ceb9c821c7966ea7592d762975b5b33ef141b6b91eb388c91b924945c3231d0f299adb5a36e0c95a17872e7ebf0bc0e33baf5c46f9e2087b77bad0794d519ce7bc8674a70f3545d020454ded22f164185df3b4f952b132947b75333993fd73a6bac5836dd5720e559bcb82a4926734c5c3b1287c5fec219a99f71eb398430001f007306e9232c269c2886357f75d935e8de054341ac36f1df1fc77fbc347d90660f4d5658cfeb9e289f70968a7c0b38ae34c4bfa46b47964e223ac34f472e3231e8c285add5713592c76c062c3477beb55b279846f04f8d6a5ce2743c6a2020f0c5164953b8dca7e57239dc8a7f507bcf77767ab0b4602437171a09c8e80f5a165c4c37eaae386cfcb927dd1a935fa717fa1608792b34bafbc20cf11a678455894ede62788309ab7a7075535847a2b48260a613e521b01d75648263ad78e6176528dbf3e6c4e4d72066e617be5387183a51dd97d2e846c5d173b51e17a4c8d78a49c914cbe44236c52c78de45b44f9d80bc6f77c75135922a84579bce77baa71311889f5b7b90c5124b8298d5e9c81c442d60df00795854d3213a1ac254c8963c109f68b3ff5451c381f6fb56c116f86b71f988d1e9f732280cbf3d4e9791fefc4bdec5dc293fb77b02d5aab6bd8cd179b7e425126b7f78c0d004bc6470ecc2bbc422bd06a6bd8f717009509e6a88b01347b7a62b9dea6f7a7446a371f422499a6e66eeb6a7b0beb4a86a61f875a9bfe0f5d5f0d0e4c85852afaea97d74ebc80d6491a8a1c998c4b5bc34b3edaeba2df902cd5e14e016720e6c3c8b15287b2471c34251e26dc442720cd5d984e30b110b7370f233f865b9ac129fdf49ff02b303d7d4f91039d3bb58a9d64d7a72d8b8eba6b45a000370d4f0e9c0d411768441372e7112e5d4e7d70a9d6b428b8b85ee6209d6f73e7b024740c052166deeb843e4ab78d1d354d75a5827ff0d49d8964e75785f3594c7299c0917b48f3b2efb81a4c3a7d6e0f1cf50efe0360963c2e3ee390ed2a4c39f42e856eced0f2ee7beacd2ecbece493e911ca0460584323ea6d4a0c00864693c979cae38f0c5841bfaeebf609d1075163c120fea0bd0207d2dd07e5e2e0a5afe3efee0ee6bb9a926a8dba7a27a82c5421a5b20bfb5dbdef532a12435fcd899f15603209831711e0dcfaaf2104b2016f087fce44848c70b65a34b9be83df2064391fc5a8d169dc1943d226e57ab5ba06c656273d4efba73a8a61aae19df4d2445f3ce7e649af1b4ffc86106c9092ddd0aafeb45653d181cb32b06a1dd41573495f15c3b8c0019ba72a2eb163dfcbdbb235322ae27d7116af506f295c2424ab9191aa8ce0e4617b212af21983f8d2b19d7fdeec881f6fa448acc7c3e133b6f281583fad4467c05801e69f6ffc1ae2e1f54655534d884c2f8f60303da33ccbe47a293643edb61c7d9fad4e3e54028bc64be8e5b1da53446869b136660b8e96ff96c48641ece275967b27b291c5c240b3399b5b901b699227735f821938bc88ded45bada2b257b1a4bcab7ed6647f2027e5680c87329e9cfdba6bde2f2a9b676be016001702bebbabb2eae3eba01d6f49ab70245a4c5ef0e136b531e1843487b3f69c5b811217d6d2f5e71b47f40c28117bd09a88bb21887a06e2cc164d4281d0df47cbd5781f1524098d89ccae32f24c5f9d86469106685fdc683ad5e873030b621dc00354e0621106da90aca69bb53848dd57251a45bc1898aca9bc84c9a8d2f8aabeed888560771c8cb03aab02620430fec8e9740880790060ccbffd5b8edaa219ca61587eff1b1b03ae8af53059f121efdec8b3ee8aba06f494a5b4575bc848d5a9773d2346f75811cb82a078fc960c9bd374555d78b1b4ba0b438ef00e8aa75810ca5efc5c70936e2cb0e515912cb7f625a2130a9ad58f29e58ae6eac5c3f15f22f0163ee6dead6947c4390b92c8dfb146fec7bfc0b37e8ff2c9de90c30f2d8b5e334107f9835bc47fbc193c60ebd5ac4e677c7fd5b6261ff96e97c185c726ec02941bc2336946f181fd2aff43f0e95f06105a049fcb8e4e3738407d6356856f533f17fae281a3be9f2050ae3d19d1b8350d424087ac9b7875824a9b7e098775b53d6ec960fc052ecd165d17a7897de75f15316a072bb9ccf6ce1ec085bb5356c271b985a437a32f12308fc927410fd444bcded9859e7b8a3cfaaf29ebfb92cc7cbfad2559bbe4f90e189e8708e93827b221869cc78fa41fd5bcb6577b7dfe4c3927dc25a58aa84419f76e71d1f3c10cbb5e52ab2bebe0d39bdffda0fa1b55fe3a03683f882a82dd58498d62b101acd710fd436aa7409fe3cf5352dffb399d560323e14d564bdb3121b89c1f43fc9a892b799cd32f7ce2ededb868920b4547735ef0bf3e148251a4f65dddb7f96b2f33734522a8cffdc51520ac98926b3406e96618cf15a042a67239e755afc70ec6a9c99f8e08ec2946e5901364d85223a63d49572519137d93b6b0798e72acf9da120e706ee73367dec1450a68def886c149bcd734469e10b933899501011cd548e99d638821d5709fde050ab382d4896ecfd7999d40ea9c690c26d396545224c8f9e19705593df2688eb592e2476a0193f7054ab6f703d41c545a80bf285bbc7cc735bd306c9ea5eb64f40752fd4c741d9b6e03cd41b636ef8f5e810047a21c0b24c6fde1f2e98f2f27730c90d93af9e7564e4e209a61ff626b666fcc4f75f7d560da688169ff0af5e674a0b89a99fb54bb438a65f953c2db0faec2ce09cec33b6d25620b5a0393ac473fed48a38beaca5223997419876d571ce969b83b5b3ae54de83dd89fd92ed2a93c087828bef49a24ed1a97778c47fdc691a94fd5b437dfe494b5c6fadf499d9d15583b0439d3d5ecb61a32a2508a6960be6009accfd1d5d75a16dbc4121c6ef07bda12646792449c18a56e7aa3893f3f0e55a8e09ca64193dd29ea24ed8614ee8e717f046dd99a8e3750506655331125a502aa89c0d7e8e30c36a4be22cd911322695144d3bf034f38ef32d49431d50da583d08a3e4c5862483cdd52d031b12c89fdaafc3334e877e464134baece883d301193a9c27311a987d4dae82a061f48182cc747cd64441e88b68e26e4975f0fdde3129a9e6af80009962581d5349676df9c73b81514b175709d9193749660f480bd4009b528c1db4f76f42b6a175126603c39a374e890f871c97b2eebb4500451d827cc15497dc5ae89edc6f47f25db7efa4b4b2afbbb2ee543e3db8d20fe93faf300247f59075921e8b2f2a025af8a1d46f274e0c6cb4be0293c7c16c88e98d7d189e9733e4c0e3b96be4aa3fa6ecf42732e0b1432d38aeaf2330d92713cd5580ce42bfe47fb98fea64783de23f456300dd193008211a5ba408d32dedbf12aa8237a6e1a2c9890a2c1011855241fea186906a5139d1c300be57dc7ff493de80010520d10fc3eda0ee9cd413e075d3dc02258fdab567a16e43edbeecc366a69d8d75512f43a2b79cbb9132cdcd00c531730d05f1eabf66613d6e7ebb8c4c3f4f7efd415d41049786352808b22a3bde40121968af39c8f00296001662adc72b7963c8bafab4a496b50f3237a29d19ad4a51a62b1c77a04c14004734189cf7ec49e3d041a1e5658d080f09df77f39782e7133968c1f39ab3ae2a5f24a60073288f3c5825dafd614a379b8b905aaf961caa14ffa38de0d632918d31e4a9291b0f0789248e232e4276840a1ed0257300e522d83111dffd424b1b33148981e3794b2b649ba9174e6697bcc96049f4f3dcc7cf4ca97e2006ec8a146014bb49184632e4fb159a34b6530e959e60a6b4e0427cc697f14cfe6bb7a662a6f5012744f3cf2307abc19c58449864d98fcfebc5d598cd32a1c38c207896468fe8da75eb1edb1d6e7cb1eab671e4e92f139c81d79f15df2a2dc075acc982dec769e2f49aad0fdf594cb590e054616e4f4582b6c4a149ae45d844903ef68d211df2a180178e178b7c7a5012ccf8a1e677586588620365e6111f5192ecfdbd97e2284128de02e08ebc13d4bb4d114faa1e6c16c51c12da2c52d68f73640ce866ce4e794b9fafdc392c91c1f824bc301b3069a02b9c86d2ffac3ed63ddee130cbc248d6a3345d3f9553db78077072d569a6633f8bdbdb1a209a8be9b6830225994f9021b57ddd6a44e8ea40b205c6cf437f45bffaef053a5916dcc6de62ee02bdb8ce3acec8ad97fc95dab1307d254790c71f32e4678957cf0121dccabe73a03c6cacbcbdaad8801b04d9836555a982c357a06e2db7e9bf62aed8cdebbb7a71a2410b929015b61f16e54bffd038996a717b9c7cc3696d8a1205e8266bf782c3a45b0e31461d6a3ed62396088833f69248b24fbf6f81dcc08b98826c3bd2325ade54f614f2d4a153e3e3527d93978483f2bfeada6b64bc43f2a725c30e843d13e6ab34cfc38d488b3ef50cd04318fac1f89905f017644cfa2de058ad399871d1316264813c2289d0b6cfeddfbca36ce93fd4a1bfc93bb74453cfbb9c6ca22320ffc9cb0a3fff046a5678c066e617cd3ac024dfead04b99877f448b78208938585c7563efe815ff0cc47da5fff521d9730ddc89f4aeceadd06f2ea6b9ae72c9407aa550a0155db3b4bc6aaa382a30552f699cb6a1af9972a8ccc483f98952dfbde3d712ea8673eacdbb77490d833fc90f0f02e7c073d2917db70831496a88defc10667dc4c1b7399191bdc7857eb090e79c332bf9f71bb5377178e6232800c93d22318dc5ab8d5dfa2f074a6c23acb61c89f2f078ec91e9817e11a4c8295c19634b5ca2df74"}}}}}, 0x0) 1.502716654s ago: executing program 1 (id=3949): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) shutdown(r1, 0x0) write(r1, 0x0, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) writev(r0, &(0x7f00000035c0)=[{&(0x7f0000000100)="13", 0x1}], 0x1) close(r0) 1.251210295s ago: executing program 0 (id=3951): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) socket$inet6(0xa, 0x800000000000002, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vxcan0\x00', 0x0}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x6, 0x4, &(0x7f0000000640)=ANY=[@ANYRES64=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r1}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r2, r3, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa348100000086dd60910100001011fffe8000000000000000000000000000bbfe8000000000000000000000000000aa00000e28001090780203000000000000"], 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r4}, &(0x7f0000000080), &(0x7f0000000280)=r5}, 0x20) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r5, r7, 0x25, 0x2}, 0x3a) syz_emit_ethernet(0x36, &(0x7f0000000580)=ANY=[], 0x0) r8 = socket(0x2, 0x80805, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000340)=[@in6={0xa, 0x4e20, 0xbb, @private1, 0x1d}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r8, 0x84, 0x11, &(0x7f0000000000)={r10, 0x10000fff}, &(0x7f0000000040)=0x8) r11 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r12 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r11}, 0x8) close(r12) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000004c0)={r12, 0x20, &(0x7f0000000480)={&(0x7f0000000380)=""/188, 0xbc, 0x0, &(0x7f0000000440)=""/30, 0x1e}}, 0x10) r13 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000004c0)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb35", 0x6}], 0x2}, 0x80) r14 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmmsg$inet(r14, &(0x7f0000000c80)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000040)="7f", 0x1}, {0x0}], 0x2}}], 0x1, 0x48000) socket$inet6_sctp(0xa, 0x1, 0x84) 1.057171467s ago: executing program 1 (id=3954): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000000)={'team_slave_0\x00', {0x2, 0x4e20, @rand_addr=0x64010102}}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x604, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0xfff1, 0x7}, {0x10, 0x8}, {0x6, 0xfff1}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r2) r4 = socket$inet6(0xa, 0x1, 0x80) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x800, 0x4) getsockname$packet(r4, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r2) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000b00)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000340)={0x758, r5, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8, 0xc}}}}, [@NL80211_ATTR_TX_RATES={0x1f4, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x3c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x9, 0x8, 0x32, 0x8, 0x101, 0x17, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x8, 0x4, 0x1ff, 0x7, 0x1, 0x0, 0x7fff]}}]}, @NL80211_BAND_60GHZ={0x5c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xb, 0xb9a, 0x6, 0x3ff, 0xff, 0xfbff, 0x8, 0xca84]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd7, 0x5, 0x7, 0xe, 0x3, 0x9, 0x81, 0xff32]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x16, 0x4, 0x18, 0x36, 0x9, 0xc, 0x36, 0x9, 0x12, 0x3, 0xb, 0x48, 0x16, 0x60]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffd, 0xa65, 0xe2, 0x75, 0x401, 0x0, 0x4, 0x2]}}]}, @NL80211_BAND_60GHZ={0x38, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x48, 0x12, 0x60, 0x48, 0x24, 0x16, 0x2, 0x12, 0x1b, 0x48, 0x1a, 0x6c, 0x4, 0x12, 0x0, 0x1b, 0x18, 0xb, 0xb8fd9cf11a3755f1, 0x6c, 0x2, 0x1b, 0x16, 0x2, 0xc, 0x30, 0x1b]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x5, 0x1ff, 0x9, 0xd, 0xc5f, 0x0, 0x1]}}]}, @NL80211_BAND_2GHZ={0x90, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x18, 0x1, [0x48, 0x5, 0x48, 0x6c, 0x3, 0x48, 0x60, 0x9, 0x36, 0x16, 0xc, 0x3, 0x3, 0xc, 0x16, 0x4, 0x30, 0x0, 0x5, 0x9]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0xc33, 0x0, 0xfffe, 0x101, 0x2, 0x7, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7fff, 0x1, 0x18, 0x7, 0x7ff, 0x3ff, 0x2, 0x1ff]}}, @NL80211_TXRATE_HT={0xe, 0x2, [{0x5, 0x6}, {0x1, 0x7}, {0x7, 0x1}, {0x5, 0x5}, {0x6, 0x6}, {0x4, 0x6}, {0x3, 0x9}, {}, {0x0, 0x2}, {0x1, 0x8}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x22, 0x1, [0x9, 0x3, 0x18, 0x6, 0x30, 0x6, 0x60, 0x18, 0x36, 0x4, 0x1, 0x24, 0x6, 0x6c, 0x3, 0x60, 0xc, 0x3, 0x12, 0x60, 0x4, 0x30, 0x3, 0xa9, 0x30, 0x5, 0x16, 0x6c, 0xb, 0x16]}]}, @NL80211_BAND_60GHZ={0x3c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x1a, 0x2, [{0x6, 0x7}, {0x6, 0x6}, {0x0, 0x9}, {0x3, 0x6}, {0x2, 0x3}, {0x0, 0x5}, {0x0, 0xa}, {0x6, 0x6}, {0x6, 0x1}, {0x3, 0x1}, {0x7, 0x1}, {}, {0x2, 0x3}, {0x0, 0x1}, {0x1, 0xa}, {0x6, 0x7}, {0x3, 0xa}, {0x1, 0x7}, {0x6}, {}, {0x4, 0x2}, {0x0, 0x6}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xa8a, 0x5, 0x2a5, 0x1ff, 0x7, 0x5, 0x5, 0x3ff]}}]}, @NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x81e, 0x3, 0x3, 0xedb9, 0x3, 0x9, 0x1, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x40, 0x2139, 0x9, 0x3, 0x4, 0x401, 0xfff]}}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x8, 0x8001, 0x42c, 0x3ff, 0x4, 0x1, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x1f8, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x58, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x12, 0x1, [0x36, 0xc, 0x1, 0x36, 0x5, 0x48, 0x30, 0x1b, 0x2, 0x30, 0x1, 0x2, 0x4, 0x24]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8000, 0x62, 0x6de, 0x4e77, 0x5, 0xc, 0x1ff, 0x9]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x4, 0x9, 0xb6, 0x66, 0xca, 0xc, 0x5]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x8c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2f, 0x2, [{0x6, 0x7}, {0x6, 0x4}, {0x7, 0x3}, {0x1, 0x3}, {0x7, 0x9}, {0x0, 0x8}, {0x4, 0x2}, {0x6, 0x7}, {0x3, 0x3}, {0x1}, {0x2, 0x1}, {0x2, 0xa}, {0x2, 0x8}, {0x0, 0x7}, {0x3}, {0x5, 0xa}, {0x1, 0x2}, {0x0, 0x7}, {0x3, 0x5}, {0x6, 0x8}, {0x0, 0x3}, {0x7, 0x9}, {0x0, 0x2}, {0x5, 0x5}, {0x7, 0x9}, {0x7, 0x3}, {0x7, 0x1}, {0x7, 0x5}, {0x5, 0x2}, {0x7, 0x7}, {0x6, 0xa}, {0x2, 0x2}, {0x6, 0xa}, {0x4, 0x8}, {0x6, 0x2}, {0x0, 0xa}, {0x0, 0x2}, {0x2, 0x1}, {0x0, 0x9}, {0x7}, {0x7, 0x1}, {0x2, 0xa}, {0x0, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x100, 0x1, 0x2, 0xa, 0x5, 0x8000, 0x16f, 0x40]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x98, 0x400, 0x1, 0x6, 0x1000, 0x1, 0x40, 0x32]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc, 0x0, 0x3, 0x28, 0x7, 0xe, 0xfc, 0x4]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x0, 0x9, 0x5, 0x1, 0xcc46, 0x46e, 0x9]}}]}, @NL80211_BAND_6GHZ={0x74, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0x0, 0x5, 0xb, 0x16, 0x18, 0x6, 0x1e, 0x3, 0x1b, 0x60, 0x36, 0x1b, 0x4, 0x36, 0x6, 0x9]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x32, 0x2, [{0x4, 0x3}, {0x2, 0x2}, {0x6, 0x3}, {0x6, 0x4}, {}, {0x6, 0x2}, {0x2, 0x8}, {0x3, 0x3}, {0x4, 0x1}, {0x4, 0x7}, {0x6, 0x7}, {0x2, 0xa}, {0x7}, {}, {0x5, 0x1}, {0x7, 0x1}, {0x0, 0x1}, {0x3, 0x9}, {0x4, 0x8}, {0x4}, {0x7, 0x2}, {0x6, 0x5}, {0x6, 0x1}, {0x7, 0x7}, {0x3, 0x6}, {0x3, 0x5}, {0x2, 0x4}, {0x6, 0x9}, {0x1, 0x3}, {0x0, 0x1}, {0x0, 0x4}, {0x1, 0x6}, {0x4}, {0x4, 0x3}, {0x4, 0xa}, {0x0, 0x1}, {0x5, 0x6}, {0x5, 0x5}, {0x6, 0x8}, {0x0, 0x6}, {0x1, 0x2}, {0x1, 0x1}, {0x3, 0x2}, {0x0, 0x6}, {0x4, 0x3}, {0x7, 0xa}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_6GHZ={0x9c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6d4, 0x101, 0x6, 0x0, 0x5, 0x80, 0x5, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6, 0x5, 0x18, 0xb, 0x60, 0x6, 0xb, 0x16, 0x5, 0x3, 0x1b, 0x1b, 0x30, 0x18, 0x24, 0x7f76c51c943c7e66, 0xf, 0x6c, 0xb, 0x16, 0x24, 0x4, 0x0, 0x2, 0x18, 0x1b, 0x1b, 0x18, 0x30]}, @NL80211_TXRATE_HT={0x1b, 0x2, [{0x4, 0x5}, {0x7, 0x6}, {0x6, 0x6}, {0x1, 0x8}, {0x4, 0x7}, {0x4, 0x4}, {0x6, 0x1}, {0x3, 0x4}, {0x6}, {0x4}, {0x2, 0x1}, {0x5, 0x9}, {0x3}, {0x5, 0xa}, {0x7, 0x9}, {0x3, 0x2}, {0x4, 0x8}, {0x6, 0x8}, {0x3, 0x5}, {0x1, 0x9}, {0x1, 0xa}, {0x0, 0x6}, {}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x22, 0x1, [0x12, 0x5, 0x36, 0x9, 0x4, 0x6, 0x7d, 0x6, 0x9, 0x1, 0x60, 0x24, 0x2d, 0x4, 0x48, 0x1, 0x12, 0x36, 0x5, 0x30, 0x6, 0x3, 0x5, 0x5, 0xc, 0xc, 0x9, 0x18, 0x5, 0xc]}, @NL80211_TXRATE_HE_LTF={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x190, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4}, @NL80211_BAND_5GHZ={0x38, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x15, 0x2, [{0x1, 0x6}, {0x2, 0x8}, {0x2, 0x1}, {0x4, 0x4}, {0x3, 0x5}, {0x7, 0x4}, {0x3, 0x7}, {0x2, 0x3}, {0x1, 0x5}, {0x4, 0x6}, {0x6, 0x1}, {0x2, 0x4}, {0x0, 0x1}, {0x3, 0x9}, {0x2, 0x6}, {0x1, 0xa}, {}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x8, 0x5, 0x1, 0x6, 0xe, 0xd0b, 0x401]}}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_6GHZ={0xb8, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x32, 0x2, [{0x3, 0x2}, {0x5, 0x3}, {0x1, 0x9}, {0x6, 0x1}, {}, {0x5, 0x6}, {0x7, 0x6}, {0x3, 0x1}, {0x4, 0xa}, {0x4, 0x4}, {0x0, 0x7}, {0x2, 0x3}, {0x1, 0x2}, {0x7, 0x2}, {0x5, 0x8}, {0x0, 0xa}, {0x0, 0x1}, {0x0, 0x9}, {0x4, 0x3}, {0x4, 0x4}, {0x1, 0x9}, {0x5, 0x8}, {0x6, 0xa}, {0x3, 0x1}, {0x3, 0x6}, {0x3, 0x6}, {0x6, 0x4}, {0x0, 0x1}, {0x5, 0xa}, {0x0, 0xa}, {0x4, 0x5}, {}, {0x3, 0x5}, {0x3, 0x7}, {0x0, 0x5}, {0x7, 0x2}, {0x0, 0x9}, {0x1, 0x5}, {0x1}, {0x7, 0x8}, {0x2, 0x1}, {0x2}, {0x6, 0x7}, {0x4, 0xa}, {0x0, 0x7}, {0x2, 0x9}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x40, 0x2, [{0x7, 0x4}, {0x6, 0x8}, {0x5, 0x7}, {0x7, 0x6}, {0x3, 0x7}, {0x7, 0x9}, {0x0, 0x3}, {0x5, 0x8}, {0x5, 0x5}, {0x1, 0x3}, {0x4, 0x5}, {0x3}, {0x5, 0x8}, {0x3, 0x6}, {0x2, 0x9}, {0x3, 0x8}, {0x7, 0xa}, {0x0, 0x9}, {0x1, 0x2}, {0x3, 0x5}, {0x7, 0x6}, {0x4, 0x4}, {0x2, 0x3}, {0x5, 0x2}, {0x2, 0x9}, {0x0, 0x5}, {0x7}, {0x6, 0x8}, {0x0, 0x7}, {0x4, 0xa}, {0x1, 0x6}, {0x7, 0x8}, {0x0, 0x2}, {0x3, 0x3}, {0x1, 0x7}, {0x0, 0x6}, {0x0, 0xa}, {0x5}, {0x0, 0xa}, {0x3, 0x8}, {0x5, 0x2}, {0x7, 0x9}, {0x2, 0x3}, {0x4, 0x9}, {0x6, 0x7}, {0x4, 0x4}, {0x0, 0x1}, {0x1, 0x4}, {0x3, 0x1}, {0x3, 0x6}, {0x3, 0x5}, {0x3, 0x4}, {0x3, 0x2}, {0x3, 0x7}, {0x1, 0x1}, {0x7, 0x4}, {0x5, 0x5}, {0x5, 0x5}, {0x0, 0xa}, {0x0, 0x2}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x401, 0x5, 0x8, 0x1, 0x7, 0x0, 0x2]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x1a, 0x2, [{0x5, 0x2}, {0x4, 0x6}, {0x7, 0x3}, {0x4, 0x6}, {0x0, 0x8}, {0x0, 0x1}, {0x5, 0x9}, {0x0, 0x4}, {0x1, 0x4}, {0x7, 0xa}, {0x3}, {0x0, 0x8}, {0x3, 0xa}, {0x0, 0x2}, {0x2, 0x7}, {0x2, 0x7}, {0x3, 0x9}, {0x6, 0x4}, {0x4, 0x5}, {0x2, 0x9}, {0x5, 0x6}, {0x7, 0x7}]}]}, @NL80211_BAND_6GHZ={0x84, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x41, 0x2, [{0x6, 0x6}, {0x2}, {0x7, 0x9}, {0x2, 0x4}, {0x4, 0x9}, {}, {0x0, 0x5}, {0x1, 0x1}, {0x2, 0x5}, {0x5, 0x9}, {0x6, 0x4}, {0x3, 0x4}, {0x0, 0x8}, {0x0, 0x1}, {0x0, 0xa}, {0x2, 0x8}, {}, {0x7, 0xa}, {0x1, 0x5}, {0x1}, {0x4, 0x6}, {0x1, 0x9}, {0x2}, {0x1, 0x3}, {0x0, 0x4}, {0x6, 0x8}, {0x0, 0xa}, {0x7, 0x3}, {0x3, 0x3}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x5}, {0x4, 0x7}, {0x7, 0x2}, {0x6, 0xa}, {0x0, 0x6}, {0x5, 0x5}, {0x3, 0x9}, {0x0, 0x9}, {0x3, 0x3}, {0x5, 0x1}, {0x6, 0x5}, {0x6, 0x2}, {0x3, 0x7}, {0x1, 0x9}, {0x2}, {0x0, 0x8}, {0x1, 0x2}, {0x4, 0x3}, {0x2, 0x1}, {0x6, 0x5}, {0x2, 0x6}, {0x1, 0x2}, {0x1, 0x9}, {0x7, 0x6}, {0x5, 0x4}, {0x7, 0x7}, {0x0, 0x4}, {0x3, 0x9}, {0x3, 0x4}, {0x2, 0x9}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4071, 0xfff3, 0x4, 0x101, 0x2c8, 0xee, 0x800, 0x3]}}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x3, 0x1b, 0x24, 0x48, 0xb, 0x16, 0x1, 0x48, 0xb, 0xa3ddd9af248ca6fd, 0x24, 0xd, 0x1, 0x6c, 0x1b, 0x4, 0x1, 0x18, 0x6c, 0x1]}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x4}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}]}, @NL80211_ATTR_TX_RATES={0xe8, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0xe4, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x8, 0x1, 0xfff, 0x3, 0x4, 0xe, 0x9]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x6, 0x2, 0x7, 0x6, 0x9, 0x1, 0xa47b]}}, @NL80211_TXRATE_HT={0x2a, 0x2, [{0x7, 0x7}, {0x0, 0x4}, {0x5, 0x3}, {0x6, 0x7}, {0x3}, {0x4, 0x6}, {0x3, 0x7}, {0x5, 0x6}, {0x4, 0xa}, {0x6, 0x2}, {0x2, 0x6}, {0x1}, {0x1, 0x6}, {0x1, 0x2}, {0x4, 0x1}, {0x2, 0x4}, {0x7, 0x8}, {0x1, 0x8}, {0x7, 0x4}, {0x3, 0x1}, {0x4, 0xa}, {0x5, 0x2}, {0x5, 0x6}, {0x0, 0x7}, {0x0, 0x6}, {0x4, 0x7}, {0x0, 0x6}, {0x0, 0x4}, {0x4, 0x9}, {0x6, 0x8}, {0x4, 0x2}, {0x1, 0x5}, {0x5, 0x7}, {0x1, 0x4}, {0x1, 0x9}, {0x6, 0x5}, {0x3}, {0x2}]}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x24, 0x16, 0x30, 0xb, 0x6, 0x0, 0x30, 0x6c, 0x36, 0x30, 0xa9307fb1cdee8176, 0xb, 0x2, 0x6, 0x12, 0x3, 0x1, 0x5, 0x2, 0x6c, 0x16, 0x6, 0x5, 0x4, 0x12, 0x24]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x43, 0x2, [{}, {0x7, 0x3}, {0x5, 0x6}, {0x1, 0x3}, {0x1, 0x7}, {0x0, 0x8}, {0x7, 0x5}, {0x1, 0x3}, {0x3, 0x3}, {0x5, 0x6}, {0x7, 0xa}, {0x6, 0x9}, {0x2, 0x1}, {0x7, 0x7}, {0x5, 0x7}, {0x3, 0x4}, {0x2, 0x3}, {0x1, 0x3}, {0x6, 0x5}, {0x0, 0x1}, {0x4, 0x4}, {0x6, 0x8}, {0x0, 0x4}, {0x6, 0x4}, {0x6, 0x4}, {0x4}, {0x7, 0x1}, {0x4, 0xa}, {0x5, 0x1}, {0x4, 0x6}, {0x0, 0x4}, {0x4}, {0x5, 0x2}, {0x6, 0x4}, {0x1, 0x5}, {0x1, 0x9}, {0x2, 0x4}, {0x1, 0x6}, {0x5, 0x3}, {0x1, 0x7}, {0x2, 0xa}, {0x0, 0x4}, {0x4, 0x7}, {0x3, 0x7}, {0x1}, {0x2, 0xa}, {0x1, 0x1}, {0x0, 0x4}, {0x7, 0x9}, {0x0, 0x3}, {0x4}, {0x0, 0x2}, {0x0, 0x9}, {0x6, 0x9}, {0x4, 0x9}, {0x0, 0x8}, {}, {0x5, 0x6}, {0x3, 0x2}, {0x1, 0x4}, {0x2, 0x4}, {0x6, 0x7}, {0x1, 0x5}]}]}]}, @NL80211_ATTR_TX_RATES={0x84, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x80, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xacb9, 0x0, 0x1194, 0x8000, 0xf, 0x371, 0x8, 0x2]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x46, 0x2, [{0x6, 0x5}, {0x3, 0xa}, {0x1, 0x1}, {0x4}, {0x6, 0x1}, {0x4, 0x4}, {0x3, 0x8}, {0x3, 0x5}, {0x7, 0x19}, {0x6, 0x4}, {0x7, 0x8}, {0x2, 0x4}, {0x7, 0x7}, {0x4, 0x5}, {0x7}, {0x1, 0x3}, {}, {0x0, 0x4}, {0x4, 0x8}, {0x1, 0x1}, {0x1, 0x8}, {0x0, 0x7}, {0x5, 0x7}, {0x6, 0x8}, {0x4, 0x9}, {0x3, 0x7}, {0x7}, {0x1, 0x7}, {0x0, 0x8}, {0x2, 0xa}, {0x1, 0xa}, {0x0, 0x4}, {0x7, 0x9}, {0x4, 0xa}, {0x4, 0x7}, {0x3, 0x4}, {0x2, 0x7}, {0x4, 0x2}, {0x7, 0x8}, {0x7, 0x4}, {}, {0x4, 0x6}, {0x5, 0x8}, {0x0, 0x3}, {0x5, 0x5}, {0x5, 0x3}, {0x2, 0x2}, {0x7, 0x4}, {0x1, 0x7}, {0x2}, {0x5, 0xa}, {0x6, 0x1}, {0x1, 0x6}, {0x7, 0xa}, {0x0, 0x6}, {0x0, 0xa}, {0x2, 0x4}, {0x1, 0x7}, {0x4, 0x3}, {0x4, 0x6}, {0x1, 0x6}, {0x6, 0x9}, {0x0, 0x9}, {0x3, 0x6}, {0x1, 0x2}, {0x4, 0x9}]}]}]}, @NL80211_ATTR_TX_RATES={0x50, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x28, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x6, 0x8000, 0x6, 0xb, 0xb, 0x7, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x24, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x18, 0x1, [0x60, 0x6, 0x18, 0x4e, 0x0, 0x12, 0x16, 0x60, 0x1b, 0xc, 0x5, 0xc, 0x2, 0x6, 0x12, 0xb, 0x1, 0x18, 0x36, 0xc]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}]}]}, 0x758}, 0x1, 0x0, 0x0, 0xc0}, 0x40000) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b80)={0x5c, r3, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9244}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff45}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4010046}, 0x4000040) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000cc0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000000e00)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x98, r5, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_CQM={0x4}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x3b}]}, @NL80211_ATTR_CQM={0x60, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0xe}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x4e4}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8}, @NL80211_ATTR_CQM_RSSI_THOLD={0x2c, 0x1, [0x3, 0x0, 0x5, 0x1, 0x7, 0xd, 0xffff0001, 0x4, 0x7996, 0x10d]}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x6e2}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x44b}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5c9}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x440}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x800}, 0x40000) accept(r2, &(0x7f0000000e40)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000000ec0)=0x80) sendmsg$NL80211_CMD_TDLS_OPER(r7, &(0x7f0000000fc0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x28, r5, 0x20, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x44000}, 0x54) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001080)={{0x1, 0xffffffffffffffff}, &(0x7f0000001000), &(0x7f0000001040)}, 0x20) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r8, 0x40047211, &(0x7f00000010c0)=0x8) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001200)={&(0x7f0000001140)={0x9c, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x44, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast1}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0xffffff65, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x92d}]}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x37}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffc01}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffff8000}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4044880}, 0x20000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000001280)) bind$tipc(r7, &(0x7f00000012c0)=@nameseq={0x1e, 0x1, 0x2, {0x1, 0x3, 0x2}}, 0x10) r9 = accept4$vsock_stream(r7, &(0x7f0000001300), 0x10, 0x1c0800) r10 = accept4(r9, &(0x7f0000001340)=@can, &(0x7f00000013c0)=0x80, 0x0) pread64(r4, &(0x7f0000001400)=""/66, 0x42, 0x95) syz_genetlink_get_family_id$tipc(&(0x7f0000001480), r10) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r7, 0x84, 0x1a, &(0x7f00000014c0)={0x0, 0xe1, "21951c5087eb0674c0c7e17a9c061c8832c156e2d404df4c0c1d6dd8f8f9c29fc58b18dd3c423f11ce43cf076b227d13aca4b2351f9c87f3324a2b0a3c8b1ec337aed4807134b82360e3b4c09dc294489ac16fbcb1ebe7dab480b7f7404c938ba5f9e4a4ce95bfab0916f86765fe51a0d8affc7aa1fbc91404b83d8bc8ecace1351fa5bfe1326f1d5ab3f3fcc28b7f012ed491284fbec881de02ea4fa3f9292fc01df485b197aa6ee4d8e1fa80f18110aa1f000b962e1c301f35267a45d8f3aff9f7dd66422abe6c2c9e99b3230060aa533ed23d239c6625ff0ef27c622cf91f58"}, &(0x7f00000015c0)=0xe9) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r11 = accept4(0xffffffffffffffff, &(0x7f0000001600)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, &(0x7f0000001680)=0x80, 0x80000) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r11, &(0x7f0000001780)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001740)={&(0x7f0000001700)={0x34, r5, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x6f}}}}, [@NL80211_ATTR_TIMEOUT={0x8, 0x110, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x8800}, 0x4040) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001b80)={{r8}, &(0x7f00000017c0), &(0x7f0000001b40)}, 0x20) 775.167205ms ago: executing program 2 (id=3956): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x5b) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000001ff0), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000f"], 0x20000078}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x5, 0x0, 0x0, {}, {}, {}, 0x7, @can={{}, 0x0, 0x0, 0x0, 0x0, "8bc7e9385559d457"}}, 0x48}}, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x800) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x170bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd22, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x58, 0x2, [@TCA_FLOW_ACT={0x54, 0x9, 0x0, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0xffffffff, 0x4000004, 0x20000001, 0x4, 0x2}, 0x1, r5}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x47, 0x7f}}]}, 0x90}}, 0x40850) sendmmsg$alg(r2, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000003c0)="96e6e14d06cd2cd1dc6969313336a9017d94", 0x12}, {&(0x7f0000000400)="499b7fee4035c5b8beb1f70453870f0783c185665f5661dc54c5a1a1ad65e127a695fb29eb758e857595e5277fdfcd8246da633a7d6ed7e05fe75f4f36c670e755ca5142914fdc83650da6c01c7a06ebf495fbe36b151a4c207d9347308484a5891ad7c14310bd", 0x67}, {&(0x7f0000000640)="7caba4f81ffec1c44c4691773da226d91a54e9721f1f4c8f4d4f19a73292612c8ad72d40ac83e55148f6700815e6d140cfab03adc719caee1f3feed087bc616c3bc19a510350d0befe495457b7d16c139c6e6850f1e32a661bd7cc91e333472aae3e3eb8815a38aa8fea91788c44336c8437a86f885f3546456df377a81b43b22f543cad111ff0", 0x87}], 0x3, 0x0, 0x0, 0x40088c0}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0xff1f}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) setsockopt$packet_int(r4, 0x107, 0x7, &(0x7f00000002c0)=0x8, 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000400000022bf000000040000", @ANYRES32, @ANYBLOB='\x00'/12, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x2, 0x82011, r6, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000fcffffff00000000000040001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000080850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r7, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mmap(&(0x7f0000fa3000/0x3000)=nil, 0x3000, 0x0, 0x13, r6, 0x0) 561.531213ms ago: executing program 2 (id=3957): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000013c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000000340)={0x3c, r2, 0x601, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0xdf}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14, 0x30, "bd70e04747e702016a3e185ab2fc8a4a"}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x8044) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000180)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x400c800}, 0x40) 544.576254ms ago: executing program 2 (id=3958): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 510.328641ms ago: executing program 1 (id=3959): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, &(0x7f00000000c0)=0x9b) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@loopback}}, &(0x7f0000000180)=0xe8) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000300)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r5, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$int_in(r6, 0x5452, &(0x7f0000000000)=0xf4e) writev(r6, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0xffffff5c}, {&(0x7f00000197c0)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}], 0x2) pselect6(0x40, &(0x7f0000000180)={0x5, 0x0, 0x401, 0xfffffffffffffffa, 0x100000001, 0x3, 0x4, 0x4}, 0x0, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) connect$bt_rfcomm(r5, &(0x7f0000000040)={0x1f, @none, 0x15}, 0xa) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@ipv6_getaddrlabel={0x24, 0x1e, 0x492dfc465ae32a8d, 0x1000000, 0x25dfdbfd, {}, [@IFAL_LABEL={0x8, 0x2, 0x3}]}, 0x24}}, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r7, 0x0, 0x81, &(0x7f0000000200)={'nat\x00', 0x0, 0x0, 0x0, [0x1, 0x10000, 0x8, 0xffffffffffffffff, 0x6, 0x1000], 0x6, &(0x7f00000001c0)=[{}, {}], 0x0, [{}, {}, {}, {}, {}, {}]}, 0xd8) r8 = gettid() ioctl$sock_FIOSETOWN(r5, 0x8901, &(0x7f00000000c0)=r8) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="901900003600010000070000ffdbdf25010100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd000000a80238800a019f806e0012002b3e95e8ae7584210d1caa7a2618b5ce87fdcfe56537364e280392e840a0b943ad915ba7bc05d323932bc7ab072b46e739aeaa0484df5bef73fa3595e188306bf0524e19bd9fba8783c19ac62939a5ebbb679a8f3b1c1e7afb238a05c72f47a14d979522f6142c8ce71600000400f78041170bf699993934da52c9445a69f9f07026729ed0b29e7fcc3f4bbb1095f03fda0446c6b27f0e0f0849090393385ce3cbc41b65044f0fe6dc7285e633c737387493948e528922aaf8cf7188d10324522b98e1183f255fd22c8bc1351c8e367d0e9592f5967908003f00", @ANYRES32=r2, @ANYBLOB="04006f000a00f9005e212de12300000005000d00000000000400240004003a80040081800000ea14ac2439fed385ec3ff336b7d12f90355ff8884839b2c132206b4dee084c5cb67312192d08c1de2a85f180b1728972fb1c9115ad550ea764814c4ebd165b905e3a0120ef6f2b6aa6f8defcbb28efc55cdba5e36474599f4ff5c2edfd0a4290663a20a6d127e3465327c00d05657f5ca3c541185fa6079db7122d6cfcc7377aa8555709f2600b0a1132b26cdfcb4e9a63f47251cb5374aa9b14feda7ac53764de79a61fdbf62f0f9a729fa29dc6800bc514d2283dfa2fda4d303d933b711469442eebd286bc10378c911d77ed55e2568c7a9b0615649d758f3f39cc0c6b0cbf58bb34924ae6b44f32ca8516ab0c00288004007f8004001e8006232c5e79476f698fb225e10609f35b5d680e28d808bc02348bfdad93474f558f566306d05cc7fc0358d6b9eb57823b1a5d5de877088da0d572dce09aeb560acb5bd8a8603f9e3e54428204ab0d44e1ad3c7a4702dd47dcabf95453660450c1248e481e1436aa56c65252924b3f7f02a066c6bf1c247c78fda015c4913cee1563115a07af40d9dfae2567318b0e9166e4769c458fa8688dfc6c8699b5ca34c79eebacb635cb10f432970dea5cf5842db30b622505c4f815c0c5046dd8d3fcf0b432eaad3b226d144dd6602105203b3ad8810a2104627442ec85858d663e48d2b31632ffe0507ceeb7528ddfbe6153c4e4f87e8e9260f0bf102330a645fc33b83a0a39678db879fbdb0944f294c3c7f43b345991839af4b4a0dae66183867ac4a180602ad0727bf516a247692e91183afc7720425145148bbd962e8a6e4c6b03b07e72f7bfd933588f3f5a3a2a98318d5f6c2fef38714bee52012a50a4ac71ecd2e7d3697544d6ad36a4df2712b51c03a50b14278e6e84c4606a9eff25ee6fe5ca258b79c80d8fbd4752a36d8d5cc65289d0b9c050dc1477800800a900e00000029d01378054b0db6d6e38ea6eca1658bf9ffe2cef138f49c742cded60dba5887eeec1ede18c221c329b117a14ddc8d0d38370834b358f89219e9a2b9e783197032f5f63ca2ad8731386998b38788d0de11c839ab8df95b978482086e4d2eb52a6b3174b2766ca790e23fa4503d0c64f28fdbf23792c35497b52e477b2da3acfd79ddec1d7798023b5ba6a39e5109f84fe5ef563697af6e714e0dd1411e907d0c912c633f5e5b7f5264a7c01a953b2dbd7dea6e3d056f8287fb231afe683fdcf1bd08b78bec605555629d98491085feb9ad3214686e9dfece24fd27efb82e206e5690cf71a91fe12b95b61525c8341f2150a17b225ff7d087e79899659894158df94be7f08cd1912c11a1912ec739f5f4469b71eafd65903c7945f63b8f72a983712bee6648c5830d77de78629c65b5275797b0270a1f5d2e60c46bba466ad8a8d047b4a3703186638164a2e6762142492fad714356997b34c969b9d92d2d9314360bc4d6d8d7538d5b8ce80277414c865228788cf9a4a5ed2c70df1cab19d3faca9feba9b87c324988de4d91a1f040002800c00ab00060000000000000000000008003a00", @ANYRES32=r3, @ANYBLOB="8300850059fff2e5bd17f4a64fdf4051ce4a1cd6d61ceaa93102acb4d355e29d61c2c93dd5b63a9625c34621b3c38b72258b518acecf304417346856d27169db664cf20b9d5fef8f8373e592bdea1cb7cd2e40a05af863c0af08b6439e463ecdec1fd92bc686e8df89b62c74c052aabaa736a7d798c0a150b94032973821db93c065a600120085800400308004003e802157ef0614b0000008001000", @ANYRES32=r2, @ANYBLOB="39005180efc211bf7cdd497fb755c1ecd96cc51f94b7c7bf71804f6889d6e51c549a8304cd0c004100519e00000000000008003900ac1e01010000003d112d8008004c00e43f8648e65df43a7de88cbd49110c73ad4a5d6e7b4ecf41e049a71800ff9f123b25486aabec3c28b11d166ddc88d05c878bc7028276a77281abd806753144f8f45e39efcf3628b63330c10bbefdc5c83cd7fe9b367f113ff137990bb3cd32fb9525dbe4284db4b8ab6e65b20095bcf7ddb65a4d22a5f179c34839cec3a50464df4c8fdec87a5f33bdfe299e56f10000000000000000000000000000f9018a9ff712ec32d03a78977cf670089edcbaf00d34c7bfa6798c65", @ANYRES32=r4, @ANYBLOB="04004880153376096c7ac01afc32ac981341469152c04900469336e1f58ea0228a298e9f6b1b5b0ecd6c52eb81d1be72d20b061bfa932b198ad5ac686b66311541a0541d56be2f227a28b4e54d828ea47e273f9c1469e7577086ce72045a8adba76916827a66ea88c90819e03d54926de132df7f37871d5a68aa7b25f5b445af3d92d0b86a334473d8af25062d6f8cf3a15a060d4027dff16d11b22dd6214204786b2b536451445a81acea93328ae10fbcda864b6b32cf6cfc47cfb29b6d6b114985b9bcf3eba4d3c2b014df62839547ded4d5547d540186a8ced42fb87dc1b3e0094b8901a0b40953d106ef4662cd072dc988bb98d39e15485152a4152172d884d9437afdac79eca42558d3f2625c8f0bc3f12f68958c75fb5237d70fa3828cd8640f91ad289666ebefc4388eaa62f505278a5169a9f0114963911632a28481fd4431916c8562fa49cfede1d0c138a27f1d06a10f625b8e1209ac27cbdf4079c136f46eddb5c4e0ba3136d62947f9d01a7556365ca62c7170a992cf0db214e5189bda16270f20ddfcb864bc578ced668bd052355f4b558d92ff7da0c7b8dcf118255d8280f837205629f75de058c5e4869b83d946c2831560a303d999473a3c71548be5a26947056ea63a145656d817d6bc34499bb839c6f44d934c673dbdb736a1e595d05b9e813efe8fc0092542e04898d00bfa82f01d9329b62343e0e6d2d5aab49316ef0781c37263ef75dd0c25cb34db646d332e7d5785cd3fe1761b98d87b672b119ab2c536c6b17613b9053ca5fdc77d60c85e62e63f14eb224e3f135fb70edd251bee959196c0eacf5e7b2d6bd33358c611c20ba058b9e7e78f1032939b291cd4866bc809d223a85a787753bb07c7462e27b50a73f1132c65c96a83f9a915c151b7b5f9ddc39513a1cb24e7f11eb6d4aa5228aab3a821cf2289a12f07e0eda8f48f6ecfb646e5ca22565c5a1957c271ec684fa8a7249bfbb86a346d4d9d1dfe3f314a4c1e7a84412d2bb41b6e51d4c36dc0c4afb0e9cb2fc99b0616aaa7759f7ddf2b11751954c0bcf4315f113dae25bcaf4d0c92f12b65e24c2abb4c73eb355c3edd71c97dbce9ad25efa2ac5cf51fc5e65c04c89324ff5ce0ef56aa85f1ce4f1107f02e6b652fc377bdf96daecfe58013215b930af66af3d46ce545f086c91e14d2b134ec2f5a4ef0556ddce873a6b1c43137e6e33ad50b41370007af4d300540fd6730f92bac49431f1cf684cb91b261fb671a41aa324cdc044fb8ca98746fc48da0fa372aa1d6c7bf6fab84fa7e6a42c9fe5c6fd9c7b6254d222b22af22590c4c7279a089f2915a2c204c0e81fd0b501e80d9626eb1aa63d01d900dc5a026b0480ad9ddfac443b23a4ee3a4d479a56ba2bbf6b04991f34211ccb64868fbd28d9dc06814a623bbb70291e6fcdcd4ebd36dbd11f3b91c7898e549846ebf2f1ef4d0a335894e0bbea730b156cf4d32f7e0543e15cd575631e76160f7374198890ceccaaa02a77a5535f8c513dfce8c8788d8fc3ec1b8cd6d812ef49a5343a0411e94605923cbff9036b5b57e15fc814c0e3165dbeb0f723a34c22b17907b8a96b945f4a94ad2afb318670234e214bb6333bd54edfe390d2265dcf7975eb0dd2c6526312dccb7bdec5118a94c7f48f83dcd2773e00e224def16da1e27b961209a59d75b941c59a9263153b8f55f7b76331c18edca33887082a18dbfbc762a558377182753fd0bc82a21b68b255854f4c7dcbbbbfbec09608dad3534f7f86526315a65807e8bc3ea5c182902eb6d1c124efb3751688ae3c8ad5de60a71d4a5d1645aa32304f7bedc72d5f3ffa147e0ac976d9c78c8d0850775f2147e4e74ce8c63422c72b8990f8582e503cfb2cbfbae584dbc9cb4763270165b4ba26c897f4c6cb29a4d16928174c19ee04031497800508e2b27518489ad4bbaf101296a4a58bf2980fbe398d4bd9829d76f870db04070f2bd0e87ce492f90a26f118725b163cc6b24ecbf522dfc85e05f4aa5674430f04ec0ba3c2337aa9259375e9ad349660d0f7f5c600f68703d4583b6079a6013e4cc90bd3ecff265eb5d325a67438f80b6318449e7f6dfd2b4a1be84448808ddb67fde3368fd3057a42e716e56becdc4b8547cb5f3268de0274d1ce1b8f277d068fb58c1ef58537910aa3a55249a90761f9b6eb1f1f27c7423d97e3218f3d2b02182da7c8672a8683f43f2840c66e7075ce0777555c395c8b9b041f72223ee73f806fd2322022b03c793b2ba171ac7cd3cf50e25b05a9aed2819ed329f495e6a1fd970ab41cfaefa0da7e765aff17896f4213261b09f9048547c6b48d1769c4238146795c93aee05a4f989cea7c9a5394d5cbd68112f499f64886883f056b138eca56762ad77209b7db3d4f99de908854f85ae1add0723c7e0480eb574965495743f745b477082a3a500709b478224f6cd29c03a08117ea57e525f663d7cfef3b47485714720040237919955e2f4653442dcb00bff1fbb1ca8bdd8bdee9eb70a92e0c85dc415737df7016c449a1a1212294056edde490179ab636230b4a011c493378838e47a63fe16b1993ba9434855273aa92e79923bd289f6ce18dc615aaee3179c73625f232376efe438f0874920cd5d867cafe6ed871bf1959d27342d15c9734776af9423474b0e235f07441bc2c4c3fd75a2ffac21cf00a688ac8f9d10049099fa3236a7063a69fababda003008465861f2fd8c071eba8c83b9aa278fd870af971de43a05ffbb02bd50c70a31deb86f37df52fece1395ef3064316e958147aacff9f67b46f82d24a371fbfef13bef43a57f31c2d1acc7c6ff8a8f7c295e88b38480852410f48ee63e78cefdfcb5ed86045c4751d89e296db3fbd272456820396ec2f36ca4e75df1c72903705c419123d286c2d86b1c27bb873defa2ef6dfb9fe95bdd1afecd7ddbeca734421c7f51781702fc44c18a0d535ddc3b120ffd4066d122ca9eae001fa6424d6aa26130360cd8f9af0404a7093d19d2b6857b21b261f76d40260fd315647ba38b8ab4cb1372538692c094720ca413b52d9f53d449f3f84e84b67ec64c285b3ef9396faf17c06eebec7ff61b67b611cddab13fb068289a9215adb87049e62e0566170b4f3952fa9cc7831c879e9e2cb1e6adbc2f75b32344da32afa8821c4a2f7bbacdd7946dc5d9f2faf09ebee1a1badbc012827258a0492e222d114564a17c14d3110f2a6f3497751f1a598b071543d3e27cc70c63b0ebde4109a3cb6907928c5ac73db301e74f353feaa9783959009e5cc79048e6d8498efd02bb13316fff503f1fb209ff306a73c762d3e3644fb467237d53b7b89c89033c683aa392a18d228e563db85126d31e7c6939dd9b853c38db4b9f4ccbd91a50e6d374bdcd76bb73d7b80f27213febfd67c0b619486fb5b497c3f843a7009b3cd2a20f8ba06ea7e9b2f1d77eeceb916231ef1e232da62144a427a128df0694ee1ea75519bb452a427cbe0598dff388f0ee2f7799a3c8a1583773a283a0cdf3ef0c07cd69c48ea103a2c9f86f4d1d534fac4f9fa2fa9703295cbb16e12410e944635ea73e6a8d8bbb0bd868eae45b9dc52530e7adc92e4b9394bb91aeb18d28c17b1ed56c4857dc4e05c13536343303eaac549f930bcd38f121dc0ee8830bddca8c2807de1bab54ff9f98a6e3fe561a1c60a9ca7212bbef7b898da8659e8fc58e84bbe1ba21dd0ea263e96ae9cc04d3eadbca81a8679e83ff67f6866727242a4fb363b73ba4c498ac952cdcb31f42abe2cbf30b2034fb666e5345a3af008d0cf6ec253e91f5ffa407c11725605aa9fceffe6caf52e97c99b9f9a0424e500fa6300031fec4757b10c3b5e46dadf1d8a598f2b5a082238dfbafcd9e7077904d43bef0c144ec0557442c1cf29714d73760b4737e14718d89bc30677713fc678b9209ce629bc80e29904c990bd2d7501ffd593a8ec66d5028683cfacc30917576713b8da58addcbde8462aee3e4e4a95e54bbddf2ad6398fa4e89fa3536f859891d468a44e6abdd3b48f3cef9707cae5cfed8cb2ae6f98fd6872512121b0f8437843c4981ef2f238ec0b29c88b807aa25f4d4a8ee36f8cf65b0f12f2ae5de9aa7d314e48f95faaffa2adec6a5a9985e76695a2a6cdbf084a552e5642575b38b68d198e587163c90345b958e155fa2ef6af0d469c018a2d1aa56d78514deddfce3ad2948290041f4669f281027689365232e12993a1f8a59a1b3fc0f453129870c398c7c67736e08ef01c367dcb591b77c4aab8fb6da8d4bcb0bebf005463e257264336672f9b4d025637f224ee5f0d7f8fdc3e8ec95c97e2f7e44744a24a1ede50e1c008fa881a27a7ad4eb006510850e776f5b053f3e966d36bbe6416785b2ad3d50b3ab6c61f239fde143f2948405acc8b99629f7d142e064a5bed5eaa49d87916237625941770b9182fd7b0cff6b220cb97d212fb84d7f22657e2e376984c2f77fe38e4a7f40abb3b6b254512a01ae928f79842291b7e8eb4cbad59e2c942c30e572323ae7abe9a4f28e1b196419a5753242aff938e87fbfd523268aee22a4f975805b7a3a8fe05ccab0effe9ad2d0ce88f3d9d167d08866071e969e9fc78f62d1865065b45ef24e4928ebf8507c22fef58f7797b8696f5d65190b7bc62ec47336c0be48d07cffc2cd031575a0d8125252a015c5d32179ef6d1f748d36008e390df5e7a11b348ee32438d1e8268a838df0d1a111cc0fae2a48736b77f56dc8bd78209fe14485ea9943be7d663ecd1361a0cec82ce9ebbe6a556867fefc1f97b6872c21e1f5fae33cfda181bd3ac49ae0dbe0fddfa979ef388c5f3e0c7275dc5d8a5f07feeb96d1e1c1495312d0c7d97ec57290e1d3799f25bdfbf94cbaa31ef51cc450200fdd00dcaa462b524c8982f4fc00692bbace230eb704992aad9badd1ceb421df2cc7b9324c6ddb2e25042779a253c75449a030d17be5a6be9942b5e5b31889c471620b572cbcc83eed0620e99d4e5240fa59b1e7b27e9e9f83b94dcbe47c95a427fcb4f4db7a68ae6b311f98ecf6e9611a8ad3c747e1d1e36284754b9a8ba057ca49c091ff848817e2692e90c24805720abcf88ae2696a0b7f22b41ffa68551f1abb1171821538fd2f71a8743d2f0b2d3d0f91c6894904bb8ba12156c813c87cfd1f5f2d9ca44e58d6f51d5baf63b1eb50156927b137c6239b2fd2a6e16b997f8213e4b4238cb44e9170ed3bb88f9e369558cd9dd802a0e8d57df52a3270ef02d41d678079b0908d42676bd88b36bc3172e031a68b8020dfefd42af53c6e69aaa2b65fa5fc22018885cfa8575eefd3ea2cabea2ea07a9544b2f7fba76d20ae3694f553f793d046c0c047d5456f373b2b8c5a5d4802024af4c31937166bcf7949ecd40ea465dd8802b9293e800e9475ce9ca7ac9a1801f546d1003a9519487113e10ad79e8837e07cc643530e3f745d183842afd7b0962317df71dc002722bdc9c0fd0b31b3ce61ba779221b99f62001d887a18768a9d90ff2be3f4ef44fb77dbaa3cc26ec9aebea583adf383f6dde9abae76fecc3d01218469552e1b518714cd2feef89d50932fecbe2ebdc388927d658f204e2d278f04a9bc5a3e656c5870d2cc7fe2015c5578efa5e8dfa5f8fa9dc8fe8287cce8d1af9cacea1df2f4bd28a23c562d2f480d3d6ba47ab4f6e62a4e031481fedc052a3e840e622d22b656eecf70fe8dbb68039d760c9c76c119fe1281a0342b11e38d2d0173ef3cf209cf573af88d36f78e3d54877e561e3326c4fb34080fd2b5a8ff0835ae570afd443063a29645d9f907f33029dce8d09ccab411dc53842ef689cf8c390616c938de8a3399dc8478c5001df05b695e8963a82372d4cdb0426df573c56e06363516380a4d7ee3e0e33bfc203b7cd1d62e5c92567df41a50ab82213a08e99e1fa735a3e57f08fe50c51913fd97f5f05367091f8a1879eb06ca9eaf1f724ea83bddb1981090a1c042508c242b54de6b947775add25e4100f480d74fa7c9b1679ae84db02461273a8681ba45bd56b6a878b7a58dde671e30d89b772196527fa9c02709461268b978c004fbadd5b2548d74183e8c65ce18ec62f401c6a941f900f69f17b494c2741a7f68efb7c838b5f0da2b2a33b287bf1d345ba95b4aa1806f9dea67b5dee7ba878df546be69ed281a804e70648a73ad37e32246afe70d971731c018097033daefb6c194c1983d41f4b538d78babdedf6d982955100000003018a80060019002600000008005d00070000000700af005b2700000400508004001e800400ec800800e000", @ANYRES32=r8, @ANYBLOB="77c95a377e6dbb0fae8a70961ced80ca07dfef33d37a2ec8c46c49f631bfdcd8e533613b6bc6c4f2de445dc041d98ad06e273f9bce54dffa804a14f71b0a808fe2d38ee3cf4bd50eced0b74fa058a03146d6077562391f07651175426df20d4e64ecd9d9a016bcf2425ddb30fcb9963bf519ba8e87dc61a268e39ee9bad28b41a4f0873eb291b909e41bc909eb985defbe6c13f40844d35edf61c624224015b188420738b82653682b76f9d017ce8206876177d172a48b81ce507412a9296eb9e26bbdd5a89ce30c00bb0001000000000000000006001400210000000000"], 0x1990}], 0x1}, 0x0) 446.153183ms ago: executing program 2 (id=3960): socket(0x1d, 0x2, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000640)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x1ff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r4 = accept$alg(r3, 0x0, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1f1cbe23", "ecba06893bcdc493"}, 0x28) writev(r6, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007", 0x4}], 0x1) close(0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000005c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="f400000009060300000000000000000005deb8d5bc266e6000000805000100070000000900020073797a3000000000540007800c00018008000140ac1414aa08000840000000200c00184000000000000000ff08001c400000000008000b400000037f140017006d6163767461703000000000000000000c001b40000000000000000144000880100007800c00194000000000000000040c000780050007000c000000e001078014001700627269646765300000000000000000000c000780080006400000000808000940ffff00002c0007801800018014000240fc000000000000000000000000000000060005404e2100000500150005000000"], 0xf4}, 0x1, 0x0, 0x0, 0x1001}, 0x1) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0x20, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}}, 0x0, 0x0, 0x1b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4f5d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) recvmmsg(r4, &(0x7f0000003540)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000012c0)=""/4096, 0x1000}], 0x1}, 0xffffff0b}], 0x2, 0x2001, 0x0) splice(r0, 0x0, r1, 0x0, 0x6, 0x0) r8 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r8, &(0x7f00000000c0)={0x1d, r9}, 0x10) sendmsg$can_bcm(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0100"/16, @ANYRES64=r5, @ANYRES64=r6, @ANYRES64=0x0, @ANYRES16, @ANYBLOB="0000000001000000000200000000000000976ac6acd41fd8"], 0x48}}, 0x4008004) sendmsg$can_bcm(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="01000000220900"/16, @ANYRES32=r3, @ANYRES8=r1, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x80}}, 0x0) sendmsg$can_bcm(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[@ANYBLOB="0100000000000000feffffff00000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0009000003"], 0x48}}, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000f40)=ANY=[], 0x10448) 380.516681ms ago: executing program 0 (id=3961): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000036000000180100006420002500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x7, 0xfff3}, {0xb, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) (async, rerun: 32) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5}]}}}]}, 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000800) (async) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) (async) getuid() r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xd, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000040000000000ecff9aaa000018140000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000a07b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010010008500000015000000850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async, rerun: 64) r4 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, 0x3a, 0x209a0}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x40}}, 0x800) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r4, 0x40049366, &(0x7f0000000340)) (async) sendmsg$AUDIT_TTY_SET(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x3f9, 0x20, 0x70bd27, 0x25dfdbfc, {0x0, 0x1}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000044}, 0x8000851) 321.10097ms ago: executing program 2 (id=3962): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x4, 0x3f0, 0x110, 0x110, 0x110, 0x308, 0x308, 0x308, 0x4, &(0x7f0000000080), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xf}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local, @empty, @rand_addr=0x30000, @rand_addr=0x64010102, 0x8}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x9}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0x5, &(0x7f0000000840)=ANY=[@ANYBLOB="850000007b00000085000000af00000085100000feffffff18170000", @ANYRES32, @ANYBLOB="8887af4de611b1b809715c51bb73e14c49fcb4fdeeca47e28d818805849caadcbe66654c05cd75402670a011b5bfdba276d725a1344dc1260ac543931cb156b83d8cae8112c40e868451417bafa0f1efdece640b5f8d579030a29285e0a88450640c57ef15303f875b6b2312bc0bf0e28299e47d3586b203ce680abc004e3e4d99404593bc6e3e7c7c611f8179ab47cdc7206892b08a88172057206bf40086f48b1edb988e"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x4a}, 0x94) (async) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r2) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)) (async) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[], 0x1c}}, 0x20008081) write$nci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="7103b3"], 0xb6) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) (async) unshare(0x2a020400) (async) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r7, 0xffffffffffffffff}, 0x4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r9, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000680)="76389e6a65585578f830e9000000", 0x0, 0x10001, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x0, @none, 0x7}, 0xe) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18020000fbffffff000008000000000000000000bc000000950000000000000024df89"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000240)=@generic={&(0x7f0000000200)='./file0\x00', r10}, 0x18) connect$bt_l2cap(r6, &(0x7f0000000240)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) (async) r11 = socket$netlink(0x10, 0x3, 0x0) writev(r11, &(0x7f0000000080)=[{&(0x7f0000000380)="3900000013000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) 185.114644ms ago: executing program 2 (id=3963): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[], 0x64}}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r2 = socket$nl_rdma(0x10, 0x3, 0x14) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x12, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000016"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @cgroup_sock_addr=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0) unshare(0x2c020400) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) socket$packet(0x11, 0x3, 0x300) socket(0x2, 0xa, 0x300) bind$802154_dgram(r0, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000540)=@newtfilter={0x70, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r7, {0x9, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x40, 0x2, [@TCA_FLOW_EMATCHES={0x2c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x1c, 0x1, 0x0, 0x0, {{0x8005, 0x2, 0x4}, {0x7, 0xa, 0x65494358c887d6ea, "2acb3efa46c4226d64fe"}}}]}]}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) 146.79901ms ago: executing program 0 (id=3964): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x3, &(0x7f0000000280)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x8, 0xfffff00c}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fddbdf250300000008000100000000001c0007800c00018008000100", @ANYRES32=r3, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="340007800c00018008000100", @ANYRES32=r3, @ANYBLOB="0c804202083e6005", @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB], 0x6c}, 0x1, 0x0, 0x0, 0x4004850}, 0x10) ioctl$sock_FIOGETOWN(r3, 0x8903, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f00000004c0)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$unix(0x1, 0x2, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x5ea000, 0xb, 0x4}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) getgid() ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000040)={'tunl0\x00'}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000500)={{{@in=@loopback, @in6=@private1}}, {{@in=@local}, 0x0, @in6}}, &(0x7f0000000700)=0xe8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000000) 0s ago: executing program 4 (id=3965): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x15, 0xa, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018000000", @ANYRES32=r0, @ANYBLOB="0000000000000000de8000000000000018000000000001000000000000000000950000000000000095"], &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) kernel console output (not intermixed with test programs): eg 1 prio class 2 [ 434.413231][ C1] Buffer I/O error on dev nbd2, logical block 0, async page read [ 434.422029][ T1616] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 434.431717][ T1616] Buffer I/O error on dev nbd2, logical block 0, async page read [ 434.444776][ T1616] Buffer I/O error on dev nbd2, logical block 1, async page read [ 434.454594][ T1616] Buffer I/O error on dev nbd2, logical block 2, async page read [ 434.466212][ T1616] Buffer I/O error on dev nbd2, logical block 3, async page read [ 434.488856][ T1616] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 434.499439][ T1616] Buffer I/O error on dev nbd2, logical block 0, async page read [ 434.508468][ T1616] Buffer I/O error on dev nbd2, logical block 1, async page read [ 434.517278][ T1616] Buffer I/O error on dev nbd2, logical block 2, async page read [ 434.525237][ T1616] Buffer I/O error on dev nbd2, logical block 3, async page read [ 434.533733][ T1616] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 434.543384][ T1616] Buffer I/O error on dev nbd2, logical block 0, async page read [ 434.552395][ T1465] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 434.562387][ T1465] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 434.572384][ T1465] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 434.583062][ T1465] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 434.597515][T14473] ldm_validate_partition_table(): Disk read failed. [ 434.617063][ T1465] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 434.626924][ T1465] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 434.639017][T14473] Dev nbd2: unable to read RDB block 0 [ 434.662185][T14473] nbd2: unable to read partition table [ 434.724115][T17484] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3106'. [ 434.742984][T14473] ldm_validate_partition_table(): Disk read failed. [ 434.780458][T14473] Dev nbd2: unable to read RDB block 0 [ 434.803103][T17484] xt_hashlimit: Unknown mode mask FFF88A7B, kernel too old? [ 434.828875][T17487] netlink: 'syz.1.3105': attribute type 10 has an invalid length. [ 434.830200][T14473] nbd2: unable to read partition table [ 434.908218][T17471] 8021q: adding VLAN 0 to HW filter on device bond21 [ 434.947355][T17487] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3105'. [ 435.038839][T17494] netlink: 'syz.2.3110': attribute type 5 has an invalid length. [ 435.058773][T17473] bond21: (slave veth21): Enslaving as an active interface with a down link [ 435.123590][T17480] team0: Port device dummy0 removed [ 435.153869][T17480] bond21: (slave dummy0): Enslaving as an active interface with a down link [ 435.187475][T17487] dummy0: entered promiscuous mode [ 435.210438][T17487] bond21: (slave dummy0): Releasing active interface [ 435.283510][ T13] bridge_slave_1: left allmulticast mode [ 435.304942][ T13] bridge_slave_1: left promiscuous mode [ 435.321386][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.346528][ T13] bridge_slave_0: left allmulticast mode [ 435.371180][ T13] bridge_slave_0: left promiscuous mode [ 435.384176][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.608629][ T13] bond9 (unregistering): (slave gretap1): Releasing active interface [ 435.634359][ T13] bond7 (unregistering): (slave gre2): Releasing backup interface [ 435.642690][ T13] gre2 (unregistering): left promiscuous mode [ 435.765253][ T13] bond16 (unregistering): (slave bridge6): Releasing active interface [ 435.795998][ T13] bond0 (unregistering): left promiscuous mode [ 435.808056][ T13] bond_slave_0: left promiscuous mode [ 435.813730][ T13] bond_slave_1: left promiscuous mode [ 435.820875][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 435.831286][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 435.841254][ T13] bond0 (unregistering): Released all slaves [ 435.856371][ T13] bond1 (unregistering): (slave veth5): Releasing active interface [ 435.864403][ T13] batadv1: entered promiscuous mode [ 435.888317][ T13] bond1 (unregistering): (slave batadv1): Releasing active interface [ 435.904964][ T13] bond1 (unregistering): Released all slaves [ 435.950550][ T13] bond2 (unregistering): Released all slaves [ 435.974886][ T13] bond3 (unregistering): (slave veth7): Releasing active interface [ 435.984422][ T13] bond3 (unregistering): (slave batadv2): Releasing active interface [ 435.996995][ T13] bond3 (unregistering): Released all slaves [ 436.019079][ T13] bond4 (unregistering): (slave veth9): Releasing active interface [ 436.027932][ T13] bond4 (unregistering): Released all slaves [ 436.047038][ T13] bond5 (unregistering): Released all slaves [ 436.070085][ T13] bond6 (unregistering): (slave veth11): Releasing active interface [ 436.079951][ T13] bond6 (unregistering): Released all slaves [ 436.098394][ T13] bond7 (unregistering): Released all slaves [ 436.115645][ T13] bond8 (unregistering): Released all slaves [ 436.139895][ T13] bond9 (unregistering): Released all slaves [ 436.160493][ T13] bond10 (unregistering): (slave veth13): Releasing active interface [ 436.171121][ T13] bond10 (unregistering): Released all slaves [ 436.196091][ T13] bond11 (unregistering): (slave veth15): Releasing active interface [ 436.206561][ T13] bond11 (unregistering): Released all slaves [ 436.226601][ T13] bond12 (unregistering): (slave veth17): Releasing active interface [ 436.242918][ T13] bond12 (unregistering): Released all slaves [ 436.263523][ T13] bond13 (unregistering): Released all slaves [ 436.293082][ T13] bond14 (unregistering): (slave veth19): Releasing active interface [ 436.310176][ T13] bond14 (unregistering): Released all slaves [ 436.337511][ T13] bond15 (unregistering): Released all slaves [ 436.369000][ T13] bond16 (unregistering): Released all slaves [ 436.389441][ T13] bond17 (unregistering): (slave veth21): Releasing active interface [ 436.405776][ T13] bond17 (unregistering): Released all slaves [ 436.425111][ T13] bond18 (unregistering): Released all slaves [ 436.444978][ T13] bond19 (unregistering): (slave veth25): Releasing active interface [ 436.457328][ T13] bond19 (unregistering): Released all slaves [ 436.477349][ T13] bond20 (unregistering): Released all slaves [ 436.494670][ T13] bond21 (unregistering): (slave veth27): Releasing active interface [ 436.505167][ T13] bond21 (unregistering): Released all slaves [ 436.529879][ T13] bond22 (unregistering): (slave veth29): Releasing active interface [ 436.539900][ T13] bond22 (unregistering): Released all slaves [ 436.834477][T17520] syzkaller0: entered promiscuous mode [ 436.862593][T17520] syzkaller0: entered allmulticast mode [ 437.416737][T17537] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3122'. [ 437.446071][T17545] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3125'. [ 437.471290][T17548] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3126'. [ 437.494096][T17548] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3126'. [ 437.670116][T17545] bridge0: port 4(macvtap0) entered blocking state [ 437.683999][T17545] bridge0: port 4(macvtap0) entered disabled state [ 437.698118][T17557] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3124'. [ 437.741632][T17545] macvtap0: entered allmulticast mode [ 437.747513][T17561] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3127'. [ 437.804640][T17567] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3127'. [ 437.816987][T17545] macvtap0: left allmulticast mode [ 437.896984][T17567] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3127'. [ 437.923409][T17567] netlink: 'syz.3.3127': attribute type 12 has an invalid length. [ 437.945967][T17567] netlink: 'syz.3.3127': attribute type 13 has an invalid length. [ 438.068863][T17551] bond22: option miimon: invalid value (18446744073709551615) [ 438.098039][T17551] bond22: option miimon: allowed values 0 - 2147483647 [ 438.136472][T17551] bond22 (unregistering): Released all slaves [ 438.339479][T17582] bond15 (unregistering): Released all slaves [ 438.449885][T17012] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 438.462578][T17585] syzkaller1: entered promiscuous mode [ 438.471182][T17585] syzkaller1: entered allmulticast mode [ 438.551691][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.560258][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.568894][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.577420][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.585996][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.594515][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.701520][T17599] netlink: 'syz.2.3131': attribute type 1 has an invalid length. [ 438.802015][T17599] 8021q: adding VLAN 0 to HW filter on device bond2 [ 438.827589][T17598] bond2: (slave ip6gretap0): making interface the new active one [ 438.843041][T17598] bond2: (slave ip6gretap0): Enslaving as an active interface with an up link [ 439.211517][ T13] batadv0: left promiscuous mode [ 439.301821][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 439.319838][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 439.755520][ T30] audit: type=1107 audit(1786466667.336:5): pid=17629 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 439.781268][ T5725] hid-generic 0005:15C2:5505.0002: collection stack underflow [ 439.823591][ T5725] hid-generic 0005:15C2:5505.0002: item 0 2 0 12 parsing failed [ 439.835652][ T5725] hid-generic 0005:15C2:5505.0002: probe with driver hid-generic failed with error -22 [ 440.079312][ T13] team0 (unregistering): Port device team_slave_1 removed [ 440.100237][ T13] team0 (unregistering): Port device team_slave_0 removed [ 440.262808][T17619] bond22: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 440.280794][T17619] bond22 (unregistering): Released all slaves [ 440.671714][T17012] veth0_vlan: entered promiscuous mode [ 440.686263][T17012] veth1_vlan: entered promiscuous mode [ 440.818409][T17664] netlink: 'syz.1.3141': attribute type 2 has an invalid length. [ 440.833655][T17665] __nla_validate_parse: 2 callbacks suppressed [ 440.833674][T17665] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3145'. [ 441.136374][T17677] netlink: 'syz.3.3147': attribute type 1 has an invalid length. [ 441.148841][T17012] veth0_macvtap: entered promiscuous mode [ 441.175295][T17012] veth1_macvtap: entered promiscuous mode [ 441.329118][T17677] 8021q: adding VLAN 0 to HW filter on device bond15 [ 441.399950][T17696] netlink: 'syz.3.3147': attribute type 10 has an invalid length. [ 441.443655][T17696] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3147'. [ 441.465793][T17698] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3156'. [ 441.479110][T17698] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3156'. [ 441.488316][T17698] netlink: 'syz.0.3156': attribute type 11 has an invalid length. [ 441.496425][T17698] netlink: 'syz.0.3156': attribute type 13 has an invalid length. [ 441.509683][T17685] bond15: (slave veth13): Enslaving as an active interface with a down link [ 441.526306][T17700] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3156'. [ 441.535647][T17700] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3156'. [ 441.544693][T17700] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3156'. [ 441.554351][T17700] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3156'. [ 441.563518][T17700] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3156'. [ 441.573673][T17689] bond15: (slave dummy0): making interface the new active one [ 441.588968][T17689] bond15: (slave dummy0): Enslaving as an active interface with an up link [ 441.599926][T17696] dummy0: entered promiscuous mode [ 441.611026][T17696] bond15: (slave dummy0): Releasing active interface [ 441.620951][ T13] IPVS: stop unused estimator thread 0... [ 441.770604][T17012] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 441.832676][T17012] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 441.896728][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.961505][ T5792] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.989281][T17718] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3164'. [ 442.038368][ T12] IPVS: starting estimator thread 0... [ 442.112204][ T5792] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.157295][T17720] IPVS: using max 29 ests per chain, 69600 per kthread [ 442.222071][ T5792] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.351306][T17727] tipc: Resetting bearer [ 442.694322][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 442.751463][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 442.906555][T17755] netdevsim netdevsim0: Direct firmware load for .® failed with error -2 [ 442.929117][T17755] netdevsim netdevsim0: Falling back to sysfs fallback for: .® [ 442.954884][ T8876] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.012197][ T8876] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.150806][T17763] batadv_slave_1: entered promiscuous mode [ 443.246521][T17764] batadv_slave_1: left promiscuous mode [ 443.266572][T17771] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 443.433830][T17773] nbd4: detected capacity change from 0 to 63 [ 443.569144][ T4922] block nbd4: Receive control failed (result -104) [ 443.600567][T16571] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 443.616474][T16571] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 443.625806][T16571] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 443.634172][T16571] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 443.643809][T16571] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 444.000301][T17796] bridge17: entered promiscuous mode [ 444.002485][ T4922] Bluetooth: hci5: command 0x0405 tx timeout [ 444.012798][T17796] bridge17: entered allmulticast mode [ 444.034733][T17796] team0: Port device bridge17 added [ 444.098186][T17796] bridge0: port 1(team0) entered blocking state [ 444.108676][T17796] bridge0: port 1(team0) entered disabled state [ 444.120000][T17796] team0: entered allmulticast mode [ 444.144803][T17796] team0: entered promiscuous mode [ 444.410289][T17810] bond22: entered promiscuous mode [ 444.423283][T17810] 8021q: adding VLAN 0 to HW filter on device bond22 [ 444.503130][T17810] 8021q: adding VLAN 0 to HW filter on device bond22 [ 444.510230][T17810] bond22: (slave ipip1): The slave device specified does not support setting the MAC address [ 444.522715][T17810] bond22: (slave ipip1): Error -95 calling set_mac_address [ 444.561672][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.571697][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.580171][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.588641][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.101129][T17832] bridge0: port 2(veth0_virt_wifi) entered blocking state [ 445.109801][T17832] bridge0: port 2(veth0_virt_wifi) entered disabled state [ 445.120166][T17832] veth0_virt_wifi: entered allmulticast mode [ 445.132925][T17832] veth0_virt_wifi: entered promiscuous mode [ 445.139560][T17832] bridge0: port 2(veth0_virt_wifi) entered blocking state [ 445.147079][T17832] bridge0: port 2(veth0_virt_wifi) entered forwarding state [ 445.752802][ T4922] Bluetooth: hci1: command tx timeout [ 445.888869][T17883] __nla_validate_parse: 121 callbacks suppressed [ 445.888892][T17883] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3203'. [ 446.157890][T17893] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 446.170038][T17894] syzkaller0: entered promiscuous mode [ 446.178757][T17894] syzkaller0: entered allmulticast mode [ 446.484720][T17903] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3209'. [ 446.494292][T17903] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3209'. [ 446.783124][T17910] tipc: New replicast peer: 255.255.255.255 [ 446.790620][T17910] tipc: Enabled bearer , priority 26 [ 446.904793][T17913] netlink: 'syz.4.3213': attribute type 1 has an invalid length. [ 446.968580][ T1094] bridge_slave_1: left allmulticast mode [ 446.998778][ T1094] bridge_slave_1: left promiscuous mode [ 447.014916][ T1094] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.036277][ T1094] bridge_slave_0: left allmulticast mode [ 447.052950][ T1094] bridge_slave_0: left promiscuous mode [ 447.074594][ T1094] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.369352][T17929] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3215'. [ 447.381900][T17929] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3215'. [ 447.422851][ T1094] erspan0 (unregistering): left promiscuous mode [ 447.438671][T17930] netlink: 212 bytes leftover after parsing attributes in process `syz.1.3215'. [ 447.467272][T17930] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3215'. [ 447.480704][T17930] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3215'. [ 447.534445][ T1094] bond2 (unregistering): (slave geneve2): Releasing active interface [ 447.624005][ T1094] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.634479][ T1094] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 447.647502][ T1094] bond0 (unregistering): Released all slaves [ 447.660831][ T1094] bond1 (unregistering): (slave batadv1): Releasing active interface [ 447.670664][ T1094] bond1 (unregistering): Released all slaves [ 447.687831][ T1094] bond2 (unregistering): Released all slaves [ 447.710588][ T1094] bond3 (unregistering): (slave bond4): Releasing backup interface [ 447.727378][ T1094] bond3 (unregistering): Released all slaves [ 447.744013][ T1094] bond4 (unregistering): Released all slaves [ 447.764315][ T1094] bond5 (unregistering): (slave veth3): Releasing active interface [ 447.775579][ T1094] bond5 (unregistering): Released all slaves [ 447.799721][ T1094] bond6 (unregistering): (slave veth5): Releasing active interface [ 447.809586][ T1094] bond6 (unregistering): Released all slaves [ 447.832855][ T4922] Bluetooth: hci1: command tx timeout [ 447.840370][ T1094] bond7 (unregistering): (slave veth7): Releasing active interface [ 447.849437][ T1094] bond7 (unregistering): Released all slaves [ 447.867392][ T1094] bond8 (unregistering): Released all slaves [ 447.888192][ T1094] bond9 (unregistering): (slave veth9): Releasing active interface [ 447.904950][ T1094] bond9 (unregistering): Released all slaves [ 447.923156][ T1094] bond10 (unregistering): (slave veth11): Releasing active interface [ 447.932608][ T1094] bond10 (unregistering): Released all slaves [ 447.949576][ T1094] bond11 (unregistering): Released all slaves [ 447.972629][ T1094] bond12 (unregistering): Released all slaves [ 447.991104][ T1094] bond13 (unregistering): Released all slaves [ 448.014163][ T1094] bond14 (unregistering): Released all slaves [ 448.031270][ T1094] bond15 (unregistering): (slave veth13): Releasing active interface [ 448.040310][ T1094] bond15 (unregistering): Released all slaves [ 448.101475][T17922] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 448.132248][T17925] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 448.250699][T17938] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3219'. [ 448.267383][T17408] tipc: Node number set to 2452815159 [ 448.434371][T17938] bond3: entered promiscuous mode [ 448.441876][T17938] 8021q: adding VLAN 0 to HW filter on device bond3 [ 448.539176][T17948] 8021q: adding VLAN 0 to HW filter on device bond3 [ 448.553576][T17948] bond3: (slave ipip0): The slave device specified does not support setting the MAC address [ 448.570103][T17948] bond3: (slave ipip0): Error -95 calling set_mac_address [ 448.791696][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.888387][ T1094] tipc: Disabling bearer [ 448.936255][ T1094] tipc: Disabling bearer [ 448.959040][ T1094] tipc: Left network mode [ 448.991103][T17967] netlink: 'syz.1.3222': attribute type 1 has an invalid length. [ 449.033179][T17970] netlink: 'syz.0.3229': attribute type 12 has an invalid length. [ 449.098527][T17982] netlink: 'syz.2.3230': attribute type 1 has an invalid length. [ 449.137731][T17984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3231'. [ 449.486508][T17995] smc: net device lo applied user defined pnetid SYZ2 [ 449.508151][T17995] smc: net device lo erased user defined pnetid SYZ2 [ 449.614005][T18000] bond22: entered promiscuous mode [ 449.619604][T18000] 8021q: adding VLAN 0 to HW filter on device bond22 [ 449.671680][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.680202][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.688759][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.697446][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.706022][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.791292][T18010] FAULT_INJECTION: forcing a failure. [ 449.791292][T18010] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 449.806717][T18010] CPU: 1 UID: 0 PID: 18010 Comm: syz.2.3237 Not tainted syzkaller #0 PREEMPT(full) [ 449.806749][T18010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 449.806762][T18010] Call Trace: [ 449.806771][T18010] [ 449.806781][T18010] dump_stack_lvl+0xe8/0x150 [ 449.806816][T18010] should_fail_ex+0x40c/0x560 [ 449.806845][T18010] _copy_from_iter+0x4ff/0x1660 [ 449.806882][T18010] ? l2cap_sock_alloc_skb_cb+0x28e/0x490 [ 449.806915][T18010] ? __pfx__copy_from_iter+0x10/0x10 [ 449.806944][T18010] ? __pfx_l2cap_sock_alloc_skb_cb+0x10/0x10 [ 449.806981][T18010] ? l2cap_sock_alloc_skb_cb+0x28e/0x490 [ 449.807011][T18010] ? skb_put+0x112/0x210 [ 449.807036][T18010] l2cap_skbuff_fromiovec+0x296/0x520 [ 449.807074][T18010] l2cap_chan_send+0x3e5/0x22f0 [ 449.807116][T18010] ? bt_sock_wait_ready+0x4f8/0x600 [ 449.807143][T18010] ? l2cap_sock_sendmsg+0x324/0x4d0 [ 449.807174][T18010] ? __pfx_l2cap_chan_send+0x10/0x10 [ 449.807214][T18010] ? l2cap_sock_sendmsg+0x2ce/0x4d0 [ 449.807244][T18010] ? l2cap_sock_sendmsg+0x2ce/0x4d0 [ 449.807272][T18010] ? __local_bh_enable_ip+0xd0/0x130 [ 449.807301][T18010] l2cap_sock_sendmsg+0x33a/0x4d0 [ 449.807333][T18010] ? __pfx_l2cap_sock_sendmsg+0x10/0x10 [ 449.807367][T18010] ? aa_sock_msg_perm+0xf1/0x1b0 [ 449.807404][T18010] ? __pfx_l2cap_sock_sendmsg+0x10/0x10 [ 449.807435][T18010] sock_sendmsg_nosec+0x13a/0x180 [ 449.807468][T18010] sock_write_iter+0x2de/0x3e0 [ 449.807499][T18010] ? __pfx_sock_write_iter+0x10/0x10 [ 449.807548][T18010] do_iter_readv_writev+0x612/0x8c0 [ 449.807586][T18010] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 449.807626][T18010] ? bpf_lsm_file_permission+0x9/0x20 [ 449.807649][T18010] ? security_file_permission+0x75/0x260 [ 449.807686][T18010] ? rw_verify_area+0x203/0x4c0 [ 449.807721][T18010] vfs_writev+0x343/0x990 [ 449.807757][T18010] ? __pfx_vfs_writev+0x10/0x10 [ 449.807798][T18010] ? __fget_files+0x2a/0x420 [ 449.807830][T18010] ? __fget_files+0x3a2/0x420 [ 449.807855][T18010] ? __fget_files+0x2a/0x420 [ 449.807892][T18010] do_writev+0x154/0x2e0 [ 449.807920][T18010] ? __pfx_do_writev+0x10/0x10 [ 449.807954][T18010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.807978][T18010] do_syscall_64+0x174/0x580 [ 449.808010][T18010] ? trace_irq_disable+0x3b/0x140 [ 449.808036][T18010] ? clear_bhb_loop+0x70/0xc0 [ 449.808064][T18010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.808086][T18010] RIP: 0033:0x7fdf86d9e0d9 [ 449.808106][T18010] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 449.808125][T18010] RSP: 002b:00007fdf87c05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 449.808149][T18010] RAX: ffffffffffffffda RBX: 00007fdf87025fa0 RCX: 00007fdf86d9e0d9 [ 449.808164][T18010] RDX: 0000000000000004 RSI: 00002000000035c0 RDI: 0000000000000004 [ 449.808182][T18010] RBP: 00007fdf87c05090 R08: 0000000000000000 R09: 0000000000000000 [ 449.808196][T18010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 449.808208][T18010] R13: 00007fdf87026038 R14: 00007fdf87025fa0 R15: 00007ffe2d205178 [ 449.808242][T18010] [ 450.156908][ T4922] Bluetooth: hci1: command tx timeout [ 450.299026][T18003] 8021q: adding VLAN 0 to HW filter on device bond22 [ 450.308049][T18003] bond22: (slave ipip3): The slave device specified does not support setting the MAC address [ 450.343361][T18003] bond22: (slave ipip3): Error -95 calling set_mac_address [ 451.269342][T18019] kthread_run failed with err -4 [ 451.307226][ T5267] 8021q: adding VLAN 0 to HW filter on device eth1 [ 451.450481][T18037] netlink: 'syz.2.3245': attribute type 1 has an invalid length. [ 451.535253][T18043] netlink: 'syz.1.3242': attribute type 1 has an invalid length. [ 451.546753][T18037] 8021q: adding VLAN 0 to HW filter on device bond4 [ 451.616052][T18040] bond4: (slave veth5): Enslaving as an active interface with a down link [ 451.630390][T18044] netlink: 'syz.2.3245': attribute type 10 has an invalid length. [ 451.638644][T18044] __nla_validate_parse: 5 callbacks suppressed [ 451.638679][T18044] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3245'. [ 451.733490][T18037] dummy0: left promiscuous mode [ 451.741897][T18037] bond4: (slave dummy0): making interface the new active one [ 451.750023][T18037] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 451.763694][T18044] dummy0: entered promiscuous mode [ 451.774453][T18044] bond4: (slave dummy0): Releasing active interface [ 451.798075][T17780] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.846719][T17780] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.872305][T17780] bridge_slave_0: entered allmulticast mode [ 451.899971][T17780] bridge_slave_0: entered promiscuous mode [ 451.960519][T17780] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.988937][T17780] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.022955][T17780] bridge_slave_1: entered allmulticast mode [ 452.058419][T17780] bridge_slave_1: entered promiscuous mode [ 452.231588][ T4922] Bluetooth: hci1: command tx timeout [ 452.374613][T18074] openvswitch: netlink: Flow actions attr not present in new flow. [ 452.814757][T18077] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 453.071605][ T8876] IPVS: starting estimator thread 0... [ 453.344286][T18088] IPVS: using max 25 ests per chain, 60000 per kthread [ 453.376938][T18094] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3258'. [ 453.490941][T18098] netlink: 'syz.0.3259': attribute type 1 has an invalid length. [ 453.651713][T18101] netlink: 'syz.0.3259': attribute type 10 has an invalid length. [ 453.671442][T18101] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3259'. [ 453.874405][T18106] netlink: 'syz.1.3261': attribute type 1 has an invalid length. [ 454.054533][T18111] netlink: 1624 bytes leftover after parsing attributes in process `syz.1.3261'. [ 454.791805][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.800315][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.808751][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.817203][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.876122][T17780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 454.890517][T18098] workqueue: Failed to create a rescuer kthread for wq "bond23": -EINTR [ 454.965901][T18100] dummy0: left promiscuous mode [ 454.981629][T18101] dummy0: entered promiscuous mode [ 455.004952][ T5267] 8021q: adding VLAN 0 to HW filter on device eth2 [ 455.078350][T17780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 455.109968][T18120] ip_tables: iptables: counters copy to user failed while replacing table [ 455.202290][T18115] ip6gretap0: entered allmulticast mode [ 455.302908][T17780] team0: Port device team_slave_0 added [ 455.390763][T17780] team0: Port device team_slave_1 added [ 455.453839][T18114] ip6gretap0: left allmulticast mode [ 455.508436][ T1094] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 455.558225][ T1094] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 455.621122][T18141] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3267'. [ 455.669929][T18141] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3267'. [ 455.709980][T18141] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3267'. [ 456.239155][ T1094] team0 (unregistering): Port device team_slave_1 removed [ 456.264310][ T1094] team0 (unregistering): Port device team_slave_0 removed [ 456.446452][T18148] syzkaller1: entered promiscuous mode [ 456.452608][T18148] syzkaller1: entered allmulticast mode [ 456.550896][T18170] netlink: 'syz.2.3274': attribute type 1 has an invalid length. [ 456.604848][T17780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 456.621462][T17780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.701526][T17780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 456.735146][T18175] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.3274'. [ 456.828206][T17780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 456.885467][T17780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.976584][T17780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 457.568106][T18201] ip6tnl1: entered promiscuous mode [ 457.674203][T17780] hsr_slave_0: entered promiscuous mode [ 457.703685][T17780] hsr_slave_1: entered promiscuous mode [ 457.746603][T17780] debugfs: 'hsr0' already exists in 'hsr' [ 457.768213][T17780] Cannot create hsr debugfs directory [ 457.820471][ T1094] IPVS: stop unused estimator thread 0... [ 457.842255][T18213] netlink: 'syz.4.3284': attribute type 1 has an invalid length. [ 457.929895][T18218] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3285'. [ 457.958641][T18218] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3285'. [ 458.059377][T18222] netlink: 'syz.4.3284': attribute type 10 has an invalid length. [ 458.098860][T18222] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3284'. [ 458.327539][T18232] netlink: 'syz.2.3288': attribute type 1 has an invalid length. [ 458.432884][T18222] dummy0: entered promiscuous mode [ 458.490822][T18238] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.3288'. [ 458.795650][T18249] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3292'. [ 458.807398][T18249] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3292'. [ 458.817107][T18249] netlink: 'syz.0.3292': attribute type 18 has an invalid length. [ 458.859595][T18250] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3292'. [ 458.870722][T18250] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3292'. [ 458.880000][T18250] netlink: 'syz.0.3292': attribute type 18 has an invalid length. [ 459.300836][ T5267] 8021q: adding VLAN 0 to HW filter on device eth3 [ 459.311636][ T8876] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 41344 - 0 [ 459.363723][ T8876] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 41344 - 0 [ 459.436329][ T8876] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 41344 - 0 [ 459.508631][ T8876] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 41344 - 0 [ 459.676341][T18277] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3300'. [ 459.727252][T18280] IPVS: set_ctl: invalid protocol: 50 127.0.0.1:20000 [ 459.833316][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.841933][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.850539][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.859110][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.455418][T18362] FAULT_INJECTION: forcing a failure. [ 464.455418][T18362] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 464.491411][T18362] CPU: 1 UID: 0 PID: 18362 Comm: syz.0.3318 Not tainted syzkaller #0 PREEMPT(full) [ 464.491437][T18362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 464.491448][T18362] Call Trace: [ 464.491457][T18362] [ 464.491465][T18362] dump_stack_lvl+0xe8/0x150 [ 464.491498][T18362] should_fail_ex+0x40c/0x560 [ 464.491518][T18362] _copy_to_user+0x31/0xb0 [ 464.491541][T18362] simple_read_from_buffer+0xe1/0x170 [ 464.491566][T18362] proc_fail_nth_read+0x1bb/0x230 [ 464.491592][T18362] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 464.491616][T18362] ? rw_verify_area+0x24a/0x4c0 [ 464.491640][T18362] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 464.491664][T18362] vfs_read+0x213/0xa80 [ 464.491695][T18362] ? __pfx___mutex_lock+0x10/0x10 [ 464.491722][T18362] ? __pfx_vfs_read+0x10/0x10 [ 464.491747][T18362] ? __fget_files+0x2a/0x420 [ 464.491773][T18362] ? __fget_files+0x3a2/0x420 [ 464.491794][T18362] ? __fget_files+0x2a/0x420 [ 464.491825][T18362] ksys_read+0x150/0x270 [ 464.491855][T18362] ? __pfx_ksys_read+0x10/0x10 [ 464.491880][T18362] ? fput+0xa0/0xd0 [ 464.491909][T18362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.491960][T18362] do_syscall_64+0x174/0x580 [ 464.491985][T18362] ? trace_irq_disable+0x3b/0x140 [ 464.492005][T18362] ? clear_bhb_loop+0x70/0xc0 [ 464.492026][T18362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.492044][T18362] RIP: 0033:0x7fde4bd5e90e [ 464.492061][T18362] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 464.492075][T18362] RSP: 002b:00007fde4ccd0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 464.492094][T18362] RAX: ffffffffffffffda RBX: 00007fde4ccd16c0 RCX: 00007fde4bd5e90e [ 464.492107][T18362] RDX: 000000000000000f RSI: 00007fde4ccd10a0 RDI: 0000000000000005 [ 464.492118][T18362] RBP: 00007fde4ccd1090 R08: 0000000000000000 R09: 0000000000000000 [ 464.492130][T18362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 464.492141][T18362] R13: 00007fde4c026038 R14: 00007fde4c025fa0 R15: 00007ffc3e320ca8 [ 464.492173][T18362] [ 464.855590][T18367] __nla_validate_parse: 3 callbacks suppressed [ 464.855609][T18367] netlink: 1760 bytes leftover after parsing attributes in process `syz.0.3320'. [ 465.288451][T18382] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3323'. [ 465.308774][T18382] syzkaller0: entered promiscuous mode [ 465.327499][T18382] syzkaller0: entered allmulticast mode [ 465.429052][T18386] FAULT_INJECTION: forcing a failure. [ 465.429052][T18386] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 465.453090][T18386] CPU: 0 UID: 0 PID: 18386 Comm: syz.0.3325 Not tainted syzkaller #0 PREEMPT(full) [ 465.453121][T18386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 465.453135][T18386] Call Trace: [ 465.453144][T18386] [ 465.453153][T18386] dump_stack_lvl+0xe8/0x150 [ 465.453189][T18386] should_fail_ex+0x40c/0x560 [ 465.453218][T18386] _copy_from_iter+0x1d3/0x1660 [ 465.453242][T18386] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 465.453270][T18386] ? rcu_is_watching+0x15/0xb0 [ 465.453301][T18386] ? trace_kmem_cache_alloc+0x29/0xe0 [ 465.453331][T18386] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 465.453355][T18386] ? __pfx__copy_from_iter+0x10/0x10 [ 465.453380][T18386] ? __alloc_skb+0x276/0x7a0 [ 465.453399][T18386] ? __alloc_skb+0x276/0x7a0 [ 465.453425][T18386] ? netlink_sendmsg+0x650/0xb40 [ 465.453450][T18386] ? skb_put+0x112/0x210 [ 465.453475][T18386] netlink_sendmsg+0x6c0/0xb40 [ 465.453509][T18386] ? __pfx_netlink_sendmsg+0x10/0x10 [ 465.453540][T18386] ? aa_sock_msg_perm+0xf1/0x1b0 [ 465.453577][T18386] ? __pfx_netlink_sendmsg+0x10/0x10 [ 465.453602][T18386] sock_sendmsg_nosec+0x13a/0x180 [ 465.453634][T18386] ____sys_sendmsg+0x54e/0x850 [ 465.453665][T18386] ? __pfx_____sys_sendmsg+0x10/0x10 [ 465.453699][T18386] ? import_iovec+0x73/0xa0 [ 465.453730][T18386] ___sys_sendmsg+0x2a5/0x360 [ 465.453754][T18386] ? __lock_acquire+0x683/0x2cf0 [ 465.453786][T18386] ? __pfx____sys_sendmsg+0x10/0x10 [ 465.453848][T18386] ? __fget_files+0x2a/0x420 [ 465.453875][T18386] ? __fget_files+0x3a2/0x420 [ 465.453919][T18386] __x64_sys_sendmsg+0x1b1/0x290 [ 465.453947][T18386] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 465.453990][T18386] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.454013][T18386] do_syscall_64+0x174/0x580 [ 465.454044][T18386] ? trace_irq_disable+0x3b/0x140 [ 465.454068][T18386] ? clear_bhb_loop+0x70/0xc0 [ 465.454095][T18386] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.454117][T18386] RIP: 0033:0x7fde4bd9e0d9 [ 465.454138][T18386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 465.454157][T18386] RSP: 002b:00007fde4ccd1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 465.454180][T18386] RAX: ffffffffffffffda RBX: 00007fde4c025fa0 RCX: 00007fde4bd9e0d9 [ 465.454202][T18386] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 465.454215][T18386] RBP: 00007fde4ccd1090 R08: 0000000000000000 R09: 0000000000000000 [ 465.454228][T18386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.454242][T18386] R13: 00007fde4c026038 R14: 00007fde4c025fa0 R15: 00007ffc3e320ca8 [ 465.454276][T18386] [ 465.723843][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.732424][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.740917][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.749475][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.898633][T17780] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 465.978794][T18395] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3326'. [ 466.022835][T17780] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 466.082736][T18389] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 466.107891][T17780] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 466.147263][T18395] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 466.162136][T18389] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 466.198346][T17780] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 466.264213][T17780] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 466.316513][T17780] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 466.345707][T17780] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 466.368647][T18414] netlink: 1760 bytes leftover after parsing attributes in process `syz.4.3331'. [ 466.448945][T17780] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 466.620842][T18433] FAULT_INJECTION: forcing a failure. [ 466.620842][T18433] name failslab, interval 1, probability 0, space 0, times 0 [ 466.661894][T18433] CPU: 1 UID: 0 PID: 18433 Comm: syz.1.3336 Not tainted syzkaller #0 PREEMPT(full) [ 466.661921][T18433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 466.661933][T18433] Call Trace: [ 466.661941][T18433] [ 466.661950][T18433] dump_stack_lvl+0xe8/0x150 [ 466.661983][T18433] should_fail_ex+0x40c/0x560 [ 466.662011][T18433] should_failslab+0xa8/0x100 [ 466.662043][T18433] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 466.662067][T18433] ? skb_clone+0x212/0x3a0 [ 466.662090][T18433] ? skb_clone+0x212/0x3a0 [ 466.662120][T18433] skb_clone+0x212/0x3a0 [ 466.662148][T18433] __netlink_deliver_tap+0x413/0x860 [ 466.662184][T18433] ? netlink_deliver_tap+0x2e/0x1b0 [ 466.662211][T18433] netlink_deliver_tap+0x19c/0x1b0 [ 466.662236][T18433] netlink_unicast+0x77f/0x940 [ 466.662280][T18433] netlink_sendmsg+0x813/0xb40 [ 466.662316][T18433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 466.662345][T18433] ? aa_sock_msg_perm+0xf1/0x1b0 [ 466.662381][T18433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 466.662405][T18433] sock_sendmsg_nosec+0x13a/0x180 [ 466.662436][T18433] ____sys_sendmsg+0x54e/0x850 [ 466.662466][T18433] ? __pfx_____sys_sendmsg+0x10/0x10 [ 466.662503][T18433] ? import_iovec+0x73/0xa0 [ 466.662534][T18433] ___sys_sendmsg+0x2a5/0x360 [ 466.662556][T18433] ? __lock_acquire+0x683/0x2cf0 [ 466.662588][T18433] ? __pfx____sys_sendmsg+0x10/0x10 [ 466.662649][T18433] ? __fget_files+0x2a/0x420 [ 466.662675][T18433] ? __fget_files+0x3a2/0x420 [ 466.662712][T18433] __x64_sys_sendmsg+0x1b1/0x290 [ 466.662739][T18433] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 466.662782][T18433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.662805][T18433] do_syscall_64+0x174/0x580 [ 466.662835][T18433] ? trace_irq_disable+0x3b/0x140 [ 466.662860][T18433] ? clear_bhb_loop+0x70/0xc0 [ 466.662886][T18433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.662907][T18433] RIP: 0033:0x7f4008b9e0d9 [ 466.662926][T18433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 466.662945][T18433] RSP: 002b:00007f4009a34028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 466.662967][T18433] RAX: ffffffffffffffda RBX: 00007f4008e25fa0 RCX: 00007f4008b9e0d9 [ 466.662983][T18433] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 466.662996][T18433] RBP: 00007f4009a34090 R08: 0000000000000000 R09: 0000000000000000 [ 466.663008][T18433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 466.663020][T18433] R13: 00007f4008e26038 R14: 00007f4008e25fa0 R15: 00007ffc8c122988 [ 466.663053][T18433] [ 467.128863][T17780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 467.153741][T18439] netlink: 'syz.4.3338': attribute type 1 has an invalid length. [ 467.217380][T17780] 8021q: adding VLAN 0 to HW filter on device team0 [ 467.242263][T18439] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3338'. [ 467.267585][ T83] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.274845][ T83] bridge0: port 1(bridge_slave_0) entered forwarding state [ 467.451774][ T8876] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.459018][ T8876] bridge0: port 2(bridge_slave_1) entered forwarding state [ 467.481079][T18452] netlink: 'syz.0.3341': attribute type 22 has an invalid length. [ 467.547782][T18450] syzkaller0: entered promiscuous mode [ 467.556663][T18450] syzkaller0: entered allmulticast mode [ 467.722136][T18461] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3343'. [ 467.809477][T18459] xt_hashlimit: size too large, truncated to 1048576 [ 467.844640][T18466] netlink: 'syz.2.3345': attribute type 2 has an invalid length. [ 467.964109][T18470] xt_TPROXY: Can be used only with -p tcp or -p udp [ 468.207958][T18476] FAULT_INJECTION: forcing a failure. [ 468.207958][T18476] name failslab, interval 1, probability 0, space 0, times 0 [ 468.221576][T18476] CPU: 1 UID: 0 PID: 18476 Comm: syz.4.3347 Not tainted syzkaller #0 PREEMPT(full) [ 468.221611][T18476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 468.221625][T18476] Call Trace: [ 468.221634][T18476] [ 468.221642][T18476] dump_stack_lvl+0xe8/0x150 [ 468.221676][T18476] should_fail_ex+0x40c/0x560 [ 468.221701][T18476] should_failslab+0xa8/0x100 [ 468.221731][T18476] __kmalloc_cache_noprof+0xa8/0x660 [ 468.221758][T18476] ? rtnl_newlink+0x143/0x1c30 [ 468.221777][T18476] ? rtnl_newlink+0x143/0x1c30 [ 468.221802][T18476] rtnl_newlink+0x143/0x1c30 [ 468.221823][T18476] ? kasan_save_track+0x4f/0x80 [ 468.221846][T18476] ? kasan_save_track+0x3e/0x80 [ 468.221875][T18476] ? __kasan_slab_free+0x5c/0x80 [ 468.221898][T18476] ? kmem_cache_free+0x182/0x650 [ 468.221923][T18476] ? nlmon_xmit+0xb0/0x100 [ 468.221949][T18476] ? dev_hard_start_xmit+0x2cd/0x830 [ 468.221972][T18476] ? __dev_queue_xmit+0x14c0/0x3820 [ 468.221994][T18476] ? __netlink_deliver_tap+0x5b4/0x860 [ 468.222017][T18476] ? netlink_deliver_tap+0x19c/0x1b0 [ 468.222038][T18476] ? netlink_unicast+0x77f/0x940 [ 468.222056][T18476] ? netlink_sendmsg+0x813/0xb40 [ 468.222086][T18476] ? __pfx_rtnl_newlink+0x10/0x10 [ 468.222100][T18476] ? do_syscall_64+0x174/0x580 [ 468.222122][T18476] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.222170][T18476] ? kasan_quarantine_put+0xbb/0x1f0 [ 468.222187][T18476] ? lockdep_hardirqs_on+0x7a/0x110 [ 468.222211][T18476] ? nlmon_xmit+0xb0/0x100 [ 468.222230][T18476] ? kmem_cache_free+0x182/0x650 [ 468.222256][T18476] ? __lock_acquire+0x683/0x2cf0 [ 468.222279][T18476] ? __dev_queue_xmit+0x29b/0x3820 [ 468.222298][T18476] ? __local_bh_enable_ip+0xd0/0x130 [ 468.222315][T18476] ? lockdep_hardirqs_on+0x7a/0x110 [ 468.222335][T18476] ? __dev_queue_xmit+0x29b/0x3820 [ 468.222351][T18476] ? __local_bh_enable_ip+0xd0/0x130 [ 468.222366][T18476] ? __dev_queue_xmit+0x29b/0x3820 [ 468.222388][T18476] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 468.222403][T18476] ? __pfx_rtnl_newlink+0x10/0x10 [ 468.222452][T18476] ? __pfx_rtnl_newlink+0x10/0x10 [ 468.222472][T18476] rtnetlink_rcv_msg+0x802/0xc00 [ 468.222497][T18476] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 468.222511][T18476] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 468.222524][T18476] ? ref_tracker_free+0x689/0x830 [ 468.222542][T18476] ? __pfx_ref_tracker_free+0x10/0x10 [ 468.222566][T18476] netlink_rcv_skb+0x226/0x4a0 [ 468.222583][T18476] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 468.222599][T18476] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 468.222625][T18476] ? netlink_deliver_tap+0x2e/0x1b0 [ 468.222643][T18476] ? netlink_deliver_tap+0x2e/0x1b0 [ 468.222664][T18476] netlink_unicast+0x7bb/0x940 [ 468.222686][T18476] netlink_sendmsg+0x813/0xb40 [ 468.222710][T18476] ? __pfx_netlink_sendmsg+0x10/0x10 [ 468.222730][T18476] ? aa_sock_msg_perm+0xf1/0x1b0 [ 468.222756][T18476] ? __pfx_netlink_sendmsg+0x10/0x10 [ 468.222772][T18476] sock_sendmsg_nosec+0x13a/0x180 [ 468.222795][T18476] ____sys_sendmsg+0x54e/0x850 [ 468.222815][T18476] ? __pfx_____sys_sendmsg+0x10/0x10 [ 468.222837][T18476] ? import_iovec+0x73/0xa0 [ 468.222859][T18476] ___sys_sendmsg+0x2a5/0x360 [ 468.222874][T18476] ? __lock_acquire+0x683/0x2cf0 [ 468.222895][T18476] ? __pfx____sys_sendmsg+0x10/0x10 [ 468.222936][T18476] ? __fget_files+0x2a/0x420 [ 468.222954][T18476] ? __fget_files+0x3a2/0x420 [ 468.222979][T18476] __x64_sys_sendmsg+0x1b1/0x290 [ 468.222998][T18476] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 468.223027][T18476] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.223052][T18476] do_syscall_64+0x174/0x580 [ 468.223104][T18476] ? trace_irq_disable+0x3b/0x140 [ 468.223129][T18476] ? clear_bhb_loop+0x70/0xc0 [ 468.223168][T18476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.223184][T18476] RIP: 0033:0x7f863f19e0d9 [ 468.223198][T18476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 468.223211][T18476] RSP: 002b:00007f8640105028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 468.223227][T18476] RAX: ffffffffffffffda RBX: 00007f863f425fa0 RCX: 00007f863f19e0d9 [ 468.223238][T18476] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 468.223248][T18476] RBP: 00007f8640105090 R08: 0000000000000000 R09: 0000000000000000 [ 468.223257][T18476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 468.223266][T18476] R13: 00007f863f426038 R14: 00007f863f425fa0 R15: 00007ffe1cdcf9a8 [ 468.223289][T18476] [ 469.091843][T18493] syzkaller0: entered promiscuous mode [ 469.097483][T18493] syzkaller0: entered allmulticast mode [ 469.294351][T18493] batadv4: entered promiscuous mode [ 469.327141][T18493] batadv4: entered allmulticast mode [ 469.494995][T18501] tipc: Enabled bearer , priority 0 [ 469.555949][T18510] syzkaller0: entered promiscuous mode [ 469.561794][T18510] syzkaller0: entered allmulticast mode [ 469.623887][T18523] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3359'. [ 469.836318][T18500] tipc: Resetting bearer [ 469.865975][T18500] tipc: Disabling bearer [ 470.304961][T18549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3367'. [ 470.522633][T18557] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3369'. [ 470.539054][T18557] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3369'. [ 470.553158][T18557] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3369'. [ 470.775667][T17780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 470.934650][T17780] veth0_vlan: entered promiscuous mode [ 470.959050][T17780] veth1_vlan: entered promiscuous mode [ 471.268309][T17780] veth0_macvtap: entered promiscuous mode [ 471.316584][T18584] bridge0: port 3(veth1_to_bridge) entered blocking state [ 471.324177][T18584] bridge0: port 3(veth1_to_bridge) entered disabled state [ 471.332790][T18584] veth1_to_bridge: entered allmulticast mode [ 471.347016][T18584] veth1_to_bridge: entered promiscuous mode [ 471.364771][T18584] bridge0: port 3(veth1_to_bridge) entered blocking state [ 471.372166][T18584] bridge0: port 3(veth1_to_bridge) entered forwarding state [ 471.385957][T17780] veth1_macvtap: entered promiscuous mode [ 471.431643][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.440125][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.448591][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.457028][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.538927][ T8876] batman_adv: batadv0: Interface deactivated: gretap2 [ 471.721944][ T8876] bond13 (unregistering): (slave ip6gre1): Releasing backup interface [ 471.737560][ T8876] ip6gre1 (unregistering): left promiscuous mode [ 471.970999][ T8876] batman_adv: batadv0: Removing interface: gretap1 [ 472.059056][ T8876] batman_adv: batadv0: Removing interface: gretap2 [ 472.237369][ T8876] bond2 (unregistering): (slave geneve2): Releasing active interface [ 472.326842][T18613] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3384'. [ 472.369303][ T8876] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 472.402674][ T8876] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 472.422732][ T8876] bond0 (unregistering): Released all slaves [ 472.439749][ T8876] bond1 (unregistering): (slave veth3): Releasing active interface [ 472.448886][ T8876] bond1 (unregistering): Released all slaves [ 472.488654][ T8876] bond2 (unregistering): Released all slaves [ 472.509940][ T8876] bond3 (unregistering): (slave veth5): Releasing active interface [ 472.528994][ T8876] batadv1: entered promiscuous mode [ 472.536869][ T8876] bond3 (unregistering): (slave batadv1): Releasing active interface [ 472.546021][ T8876] bond3 (unregistering): Released all slaves [ 472.565643][ T8876] bond4 (unregistering): (slave veth7): Releasing active interface [ 472.574626][ T8876] bond4 (unregistering): Released all slaves [ 472.594740][ T8876] bond5 (unregistering): Released all slaves [ 472.617466][ T8876] bond6 (unregistering): Released all slaves [ 472.637538][ T8876] bond7 (unregistering): (slave veth9): Releasing active interface [ 472.646538][ T8876] bond7 (unregistering): Released all slaves [ 472.665163][ T8876] bond8 (unregistering): Released all slaves [ 472.686688][ T8876] bond9 (unregistering): Released all slaves [ 472.711662][ T8876] bond10 (unregistering): (slave veth11): Releasing active interface [ 472.721860][ T8876] bond10 (unregistering): Released all slaves [ 472.738855][ T8876] bond11 (unregistering): (slave veth13): Releasing active interface [ 472.754406][ T8876] bond11 (unregistering): Released all slaves [ 472.772046][ T8876] bond12 (unregistering): (slave veth15): Releasing active interface [ 472.782684][ T8876] bond12 (unregistering): Released all slaves [ 472.800667][ T8876] bond13 (unregistering): Released all slaves [ 472.821174][ T8876] bond14 (unregistering): Released all slaves [ 472.844021][ T8876] bond15 (unregistering): (slave veth17): Releasing active interface [ 472.853856][ T8876] bond15 (unregistering): Released all slaves [ 472.877005][ T8876] bond16 (unregistering): (slave veth19): Releasing active interface [ 472.889337][ T8876] bond16 (unregistering): Released all slaves [ 472.908666][ T8876] bond17 (unregistering): Released all slaves [ 472.928596][ T8876] bond18 (unregistering): Released all slaves [ 472.954301][ T8876] bond19 (unregistering): (slave veth21): Releasing active interface [ 472.964278][ T8876] bond19 (unregistering): Released all slaves [ 472.981634][ T8876] bond20 (unregistering): (slave veth23): Releasing active interface [ 472.992458][ T8876] bond20 (unregistering): Released all slaves [ 473.015037][ T8876] bond21 (unregistering): (slave veth25): Releasing active interface [ 473.028933][ T8876] bond21 (unregistering): Released all slaves [ 473.055413][T18602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3384'. [ 473.682427][T17780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 473.910947][ T8876] tipc: Left network mode [ 473.986872][T17780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 474.072619][ T1465] block nbd4: Possible stuck request ffff888028004440: control (read@0,1024B). Runtime 30 seconds [ 474.087367][ T1465] block nbd4: Possible stuck request ffff888028004600: control (read@1024,1024B). Runtime 30 seconds [ 474.100343][ T1465] block nbd4: Possible stuck request ffff8880280047c0: control (read@2048,1024B). Runtime 30 seconds [ 474.113219][ T1465] block nbd4: Possible stuck request ffff888028004980: control (read@3072,1024B). Runtime 30 seconds [ 474.155002][T18656] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 474.166747][T18656] openvswitch: netlink: Duplicate or invalid key (type 0). [ 474.501778][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.510752][ T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.601776][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.947777][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.936271][T18695] syzkaller0: entered promiscuous mode [ 475.942265][T18695] syzkaller0: entered allmulticast mode [ 475.951171][ T83] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.975183][ T83] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 476.481511][T18732] netlink: 14719 bytes leftover after parsing attributes in process `syz.2.3411'. [ 476.481724][T18731] netlink: 14719 bytes leftover after parsing attributes in process `syz.2.3411'. [ 476.567030][T18737] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3412'. [ 476.593048][ T8876] hsr_slave_0: left promiscuous mode [ 476.595394][T18737] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3412'. [ 476.642663][ T8876] hsr_slave_1: left promiscuous mode [ 476.649144][T18739] netlink: 212 bytes leftover after parsing attributes in process `syz.2.3412'. [ 476.658585][T18739] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3412'. [ 476.667649][T18739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3412'. [ 476.718560][ T8876] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 476.758222][ T8876] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 476.789741][T18748] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3413'. [ 476.814910][ T8876] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 476.836676][ T8876] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 476.860777][T18748] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3413'. [ 477.273967][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.282543][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.291075][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.299604][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.448702][ T8876] team0 (unregistering): Port device team_slave_1 removed [ 477.476966][ T8876] team0 (unregistering): Port device team_slave_0 removed [ 477.627776][T18728] syzkaller0: entered promiscuous mode [ 477.634764][T18728] syzkaller0: entered allmulticast mode [ 477.704608][ T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 477.749905][ T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.934120][T18767] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3415'. [ 478.548823][T18788] netlink: 'syz.4.3419': attribute type 11 has an invalid length. [ 479.596011][ T8876] IPVS: stop unused estimator thread 0... [ 479.805225][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 479.818708][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 479.857609][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 479.868883][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 479.881131][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 480.834567][T18851] tipc: Enabling of bearer rejected, failed to enable media [ 481.897364][T18882] syzkaller0: entered promiscuous mode [ 481.903208][T18882] syzkaller0: entered allmulticast mode [ 481.912618][ T4922] Bluetooth: hci0: command tx timeout [ 481.967891][T18882] tipc: Started in network mode [ 481.975336][T18882] tipc: Node identity eaaa74da6cfb, cluster identity 4711 [ 481.985949][T18882] tipc: Enabled bearer , priority 0 [ 482.005985][T18880] tipc: Resetting bearer [ 482.030857][T18880] tipc: Disabling bearer [ 482.319654][T18894] openvswitch: netlink: IP tunnel dst address not specified [ 482.328210][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.328555][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.328855][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.329169][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.379902][T18899] netlink: 'syz.3.3453': attribute type 1 has an invalid length. [ 482.524418][T18894] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 482.555669][T18903] netlink: 'syz.3.3453': attribute type 10 has an invalid length. [ 482.580685][T18903] __nla_validate_parse: 8 callbacks suppressed [ 482.580706][T18903] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3453'. [ 482.628298][T18903] dummy0: entered promiscuous mode [ 482.959614][T18915] netlink: 'syz.3.3457': attribute type 1 has an invalid length. [ 482.971150][T18811] bridge0: port 1(bridge_slave_0) entered blocking state [ 482.978802][T18811] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.986268][T18811] bridge_slave_0: entered allmulticast mode [ 482.994734][T18811] bridge_slave_0: entered promiscuous mode [ 483.004114][T18811] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.011676][T18811] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.019388][T18811] bridge_slave_1: entered allmulticast mode [ 483.027441][T18811] bridge_slave_1: entered promiscuous mode [ 483.071956][T18811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 483.086110][T18811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 483.150985][T18811] team0: Port device team_slave_0 added [ 483.191937][T18811] team0: Port device team_slave_1 added [ 483.313979][T18811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 483.324074][T18811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 483.353544][T18811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 483.368854][T18811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 483.384537][T18811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 483.434119][T18811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 483.605431][T18929] ip6tnl0: Caught tx_queue_len zero misconfig [ 483.629110][T18811] hsr_slave_0: entered promiscuous mode [ 483.662788][T18811] hsr_slave_1: entered promiscuous mode [ 483.682618][T18811] debugfs: 'hsr0' already exists in 'hsr' [ 483.722899][T18811] Cannot create hsr debugfs directory [ 483.727370][T18936] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3463'. [ 483.857195][T18939] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3463'. [ 483.993700][ T50] Bluetooth: hci0: command tx timeout [ 484.170081][T18954] netlink: 'syz.4.3469': attribute type 17 has an invalid length. [ 484.238984][T18956] netlink: 'syz.4.3470': attribute type 1 has an invalid length. [ 484.345132][T18811] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.356334][T18811] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 41344 - 0 [ 484.367174][T18811] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.408913][T18962] netlink: 'syz.4.3470': attribute type 10 has an invalid length. [ 484.417311][T18962] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3470'. [ 484.456505][T18956] 8021q: adding VLAN 0 to HW filter on device bond1 [ 484.522807][T18959] bond1: (slave veth3): Enslaving as an active interface with a down link [ 484.531994][T18960] dummy0: left promiscuous mode [ 484.558834][T18960] bond1: (slave dummy0): making interface the new active one [ 484.573960][T18960] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 484.606775][T18962] dummy0: entered promiscuous mode [ 484.624211][T18962] bond1: (slave dummy0): Releasing active interface [ 484.779440][T18970] netlink: 'syz.2.3474': attribute type 1 has an invalid length. [ 484.911107][T18811] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.971417][T18811] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 41344 - 0 [ 484.984021][T18811] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.406154][T18811] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.442700][T18811] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 41344 - 0 [ 485.491869][T18811] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.541541][T18986] vlan2: entered allmulticast mode [ 485.546943][T18986] bond0: entered allmulticast mode [ 485.552303][T18986] bond_slave_0: entered allmulticast mode [ 485.558251][T18986] bond_slave_1: entered allmulticast mode [ 485.715878][T19009] netlink: 'syz.2.3487': attribute type 1 has an invalid length. [ 485.890135][T19018] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.3487'. [ 485.922192][T18811] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.939882][T18811] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 41344 - 0 [ 485.962783][T18811] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.071745][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.081844][ T50] Bluetooth: hci0: command 0x040f tx timeout [ 486.306721][T19032] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3493'. [ 486.380031][T19034] bridge2: entered promiscuous mode [ 486.789275][T19051] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3499'. [ 486.815048][T18811] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 486.877441][T18811] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 486.912507][T19059] netlink: 'syz.1.3503': attribute type 2 has an invalid length. [ 486.927678][T19051] netlink: 316 bytes leftover after parsing attributes in process `syz.4.3499'. [ 487.001228][T18811] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 487.017530][T18811] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 487.044844][T18811] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 487.127772][T18811] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 487.167447][T18811] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 487.188661][T18811] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 487.660400][T18811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 487.732129][T18811] 8021q: adding VLAN 0 to HW filter on device team0 [ 487.767542][ T1094] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.774834][ T1094] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.819567][T19096] netlink: 'syz.4.3514': attribute type 1 has an invalid length. [ 487.846640][T19096] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3514'. [ 487.874750][T19098] team0 (unregistering): Port device team_slave_0 removed [ 487.887965][T19098] team0 (unregistering): Port device team_slave_1 removed [ 487.917672][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.924978][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 487.934200][T19099] netlink: 'syz.4.3514': attribute type 1 has an invalid length. [ 488.029510][T19102] syzkaller0: entered promiscuous mode [ 488.035551][T19102] syzkaller0: entered allmulticast mode [ 488.071710][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.080250][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.088738][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.097291][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.118114][T19102] tipc: Started in network mode [ 488.123262][T19102] tipc: Node identity f656beced489, cluster identity 4711 [ 488.130653][T19102] tipc: Enabled bearer , priority 0 [ 488.151565][ T50] Bluetooth: hci0: command 0x040f tx timeout [ 488.168347][T19101] tipc: Resetting bearer [ 488.192115][T19101] tipc: Disabling bearer [ 488.291126][T18811] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 488.373482][T19108] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3521'. [ 488.395767][T19108] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3521'. [ 488.539000][T19113] syzkaller0: entered promiscuous mode [ 488.557182][T19113] syzkaller0: entered allmulticast mode [ 488.567312][T19116] syzkaller0: entered promiscuous mode [ 488.573286][T19116] syzkaller0: entered allmulticast mode [ 488.580570][T19114] syzkaller0: entered promiscuous mode [ 488.590625][T19114] syzkaller0: entered allmulticast mode [ 488.728898][T19118] tipc: Enabled bearer , priority 0 [ 489.008353][T19128] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3525'. [ 489.244787][T19145] netlink: 'syz.2.3528': attribute type 1 has an invalid length. [ 489.304539][T19111] tipc: Resetting bearer [ 489.372585][T19148] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.3528'. [ 489.402806][T19111] tipc: Disabling bearer [ 489.600080][T19154] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3531'. [ 489.609614][T19154] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3531'. [ 489.622336][T19154] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3531'. [ 489.667955][T19154] team0: Port device team_slave_0 removed [ 489.692159][T19157] syzkaller1: entered promiscuous mode [ 489.697762][T19157] syzkaller1: entered allmulticast mode [ 489.737766][T19127] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 489.927246][T18811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 490.052498][T18811] veth0_vlan: entered promiscuous mode [ 490.092882][T18811] veth1_vlan: entered promiscuous mode [ 490.153192][T18811] veth0_macvtap: entered promiscuous mode [ 490.165035][T18811] veth1_macvtap: entered promiscuous mode [ 490.187042][T18811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 490.203431][T18811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 490.259002][ T8876] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.286249][ T8876] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.295168][ T8876] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.322943][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.671672][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 491.680222][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 491.688770][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 491.697198][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.570793][T19162] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 492.674472][T19183] netlink: 'syz.2.3538': attribute type 1 has an invalid length. [ 492.689717][ T5792] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 492.713689][ T5792] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 492.886446][T19188] sctp: [Deprecated]: syz.3.3539 (pid 19188) Use of int in max_burst socket option. [ 492.886446][T19188] Use struct sctp_assoc_value instead [ 492.940690][ T5792] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 492.968128][ T5792] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 493.112311][T19197] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3545'. [ 493.267028][T19203] syzkaller0: entered promiscuous mode [ 493.276400][T19203] syzkaller0: entered allmulticast mode [ 493.362767][T19208] FAULT_INJECTION: forcing a failure. [ 493.362767][T19208] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 493.466230][T19208] CPU: 0 UID: 0 PID: 19208 Comm: syz.3.3544 Not tainted syzkaller #0 PREEMPT(full) [ 493.466260][T19208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 493.466275][T19208] Call Trace: [ 493.466284][T19208] [ 493.466294][T19208] dump_stack_lvl+0xe8/0x150 [ 493.466331][T19208] should_fail_ex+0x40c/0x560 [ 493.466457][T19208] _copy_to_user+0x31/0xb0 [ 493.466631][T19208] simple_read_from_buffer+0xe1/0x170 [ 493.466665][T19208] proc_fail_nth_read+0x1bb/0x230 [ 493.466699][T19208] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 493.466733][T19208] ? rw_verify_area+0x24a/0x4c0 [ 493.466766][T19208] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 493.466795][T19208] vfs_read+0x213/0xa80 [ 493.466831][T19208] ? __pfx___mutex_lock+0x10/0x10 [ 493.466900][T19208] ? __pfx_vfs_read+0x10/0x10 [ 493.466933][T19208] ? __fget_files+0x2a/0x420 [ 493.466965][T19208] ? __fget_files+0x3a2/0x420 [ 493.466990][T19208] ? __fget_files+0x2a/0x420 [ 493.467027][T19208] ksys_read+0x150/0x270 [ 493.467061][T19208] ? __pfx_ksys_read+0x10/0x10 [ 493.467101][T19208] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.467125][T19208] do_syscall_64+0x174/0x580 [ 493.467204][T19208] ? trace_irq_disable+0x3b/0x140 [ 493.467230][T19208] ? clear_bhb_loop+0x70/0xc0 [ 493.467262][T19208] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.467284][T19208] RIP: 0033:0x7fde54d5e90e [ 493.467304][T19208] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 493.467322][T19208] RSP: 002b:00007fde55c2efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 493.467345][T19208] RAX: ffffffffffffffda RBX: 00007fde55c2f6c0 RCX: 00007fde54d5e90e [ 493.467361][T19208] RDX: 000000000000000f RSI: 00007fde55c2f0a0 RDI: 0000000000000007 [ 493.467375][T19208] RBP: 00007fde55c2f090 R08: 0000000000000000 R09: 0000000000000000 [ 493.467389][T19208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 493.467402][T19208] R13: 00007fde55026038 R14: 00007fde55025fa0 R15: 00007ffe53672108 [ 493.467436][T19208] [ 493.945977][T19220] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 494.290554][T19235] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3555'. [ 494.486335][ T4922] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 494.497881][ T4922] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 494.535326][ T4922] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 494.551797][ T4922] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 494.560928][ T4922] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 494.691557][T19249] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3558'. [ 494.950309][T19252] syzkaller0: entered promiscuous mode [ 494.961869][T19252] syzkaller0: entered allmulticast mode [ 495.111786][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.120367][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.039309][ T36] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.555985][T19311] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3571'. [ 496.632407][ T4922] Bluetooth: hci2: command tx timeout [ 497.432661][ T36] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.580329][T19335] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3575'. [ 497.604475][ T36] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.634668][T19336] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3575'. [ 497.860248][T19341] netlink: 'syz.2.3578': attribute type 1 has an invalid length. [ 497.883282][ T36] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.711915][ T4922] Bluetooth: hci2: command tx timeout [ 498.871928][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.880442][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.888935][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.897384][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.022300][T19371] netlink: 3840 bytes leftover after parsing attributes in process `syz.4.3581'. [ 499.110597][T19374] syzkaller0: entered promiscuous mode [ 499.132073][T19374] syzkaller0: entered allmulticast mode [ 499.215456][T19390] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3584'. [ 499.260841][T19390] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3584'. [ 499.315304][T19398] netlink: 212 bytes leftover after parsing attributes in process `syz.3.3584'. [ 499.324779][T19398] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3584'. [ 499.335808][T19398] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3584'. [ 499.998121][T19419] openvswitch: netlink: Multiple metadata blocks provided [ 500.158598][T19419] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3589'. [ 500.497642][ T36] vlan3: left allmulticast mode [ 500.506967][T19450] netlink: 'syz.3.3600': attribute type 1 has an invalid length. [ 500.530260][ T36] batadv0: left allmulticast mode [ 500.554779][ T36] vlan3: left promiscuous mode [ 500.573797][ T36] batadv0: left promiscuous mode [ 500.595180][ T36] bridge0: port 3(vlan3) entered disabled state [ 500.624386][ T36] bridge_slave_1: left allmulticast mode [ 500.630599][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.667764][ T36] bridge_slave_0: left allmulticast mode [ 500.688902][ T36] bridge_slave_0: left promiscuous mode [ 500.707835][T19465] netlink: 'syz.3.3600': attribute type 10 has an invalid length. [ 500.719493][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.728090][T19465] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3600'. [ 500.793590][ T4922] Bluetooth: hci2: command tx timeout [ 500.907824][T19475] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 500.926711][T19475] netlink: 'syz.2.3603': attribute type 2 has an invalid length. [ 501.269813][ T36] bond7 (unregistering): (slave gretap1): Removing an active aggregator [ 501.282427][ T36] bond7 (unregistering): (slave gretap1): Releasing backup interface [ 501.311504][ T36] bond11 (unregistering): (slave ipip0): Releasing backup interface [ 501.319706][ T36] ipip0 (unregistering): left promiscuous mode [ 501.387069][ T36] team0: Port device bridge7 removed [ 501.415724][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 501.427045][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 501.441603][ T36] bond0 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 501.452983][ T36] bond0 (unregistering): Released all slaves [ 501.465894][ T36] bond1 (unregistering): (slave bond2): Releasing backup interface [ 501.474969][ T36] bond1 (unregistering): Released all slaves [ 501.494794][ T36] bond2 (unregistering): Released all slaves [ 501.516019][ T36] bond3 (unregistering): (slave veth3): Releasing active interface [ 501.524248][ T36] batadv1: entered promiscuous mode [ 501.531091][ T36] bond3 (unregistering): (slave batadv1): Releasing active interface [ 501.547188][ T36] bond3 (unregistering): Released all slaves [ 501.565021][ T36] bond4 (unregistering): (slave veth5): Releasing active interface [ 501.573871][ T36] bond4 (unregistering): Released all slaves [ 501.589503][ T36] bond5 (unregistering): Released all slaves [ 501.617957][ T36] bond6 (unregistering): (slave veth7): Releasing active interface [ 501.632248][ T36] batadv2: entered promiscuous mode [ 501.639652][ T36] bond6 (unregistering): (slave batadv2): Releasing active interface [ 501.648876][ T36] bond6 (unregistering): Released all slaves [ 501.664693][ T36] bond7 (unregistering): Released all slaves [ 501.682167][ T36] bond8 (unregistering): (slave veth9): Releasing active interface [ 501.690235][ T36] batadv3: entered promiscuous mode [ 501.703846][ T36] bond8 (unregistering): (slave batadv3): Releasing active interface [ 501.714712][ T36] bond8 (unregistering): Released all slaves [ 501.732457][ T36] bond9 (unregistering): Released all slaves [ 501.749003][ T36] bond10 (unregistering): Released all slaves [ 501.771628][ T36] bond11 (unregistering): Released all slaves [ 501.789149][ T36] bond12 (unregistering): (slave veth11): Releasing active interface [ 501.798856][ T36] bond12 (unregistering): Released all slaves [ 501.820164][ T36] bond13 (unregistering): (slave veth13): Releasing active interface [ 501.829773][ T36] bond13 (unregistering): Released all slaves [ 501.845671][ T36] bond14 (unregistering): Released all slaves [ 501.867857][ T36] bond15 (unregistering): (slave veth15): Releasing active interface [ 501.877970][ T36] bond15 (unregistering): Released all slaves [ 501.897388][ T36] bond16 (unregistering): (slave veth17): Releasing active interface [ 501.908426][ T36] bond16 (unregistering): Released all slaves [ 501.925379][ T36] bond17 (unregistering): Released all slaves [ 501.941279][ T36] bond18 (unregistering): Released all slaves [ 501.957378][ T36] bond19 (unregistering): Released all slaves [ 501.980835][ T36] bond20 (unregistering): (slave veth19): Releasing active interface [ 501.997271][ T36] bond20 (unregistering): Released all slaves [ 502.015237][ T36] bond21 (unregistering): (slave veth21): Releasing active interface [ 502.025940][ T36] bond21 (unregistering): Released all slaves [ 502.042082][ T36] bond22 (unregistering): Released all slaves [ 502.059982][T19450] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 502.097044][T19460] dummy0: left promiscuous mode [ 502.131030][T19465] dummy0: entered promiscuous mode [ 502.169750][T19475] : entered promiscuous mode [ 502.242052][T19487] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3605'. [ 502.252666][T19487] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3605'. [ 502.874250][ T4922] Bluetooth: hci2: command tx timeout [ 504.181586][ T1465] block nbd4: Possible stuck request ffff888028004440: control (read@0,1024B). Runtime 60 seconds [ 504.192429][ T1465] block nbd4: Possible stuck request ffff888028004600: control (read@1024,1024B). Runtime 60 seconds [ 504.205727][ T1465] block nbd4: Possible stuck request ffff8880280047c0: control (read@2048,1024B). Runtime 60 seconds [ 504.216795][ T1465] block nbd4: Possible stuck request ffff888028004980: control (read@3072,1024B). Runtime 60 seconds [ 504.689952][ T36] : left promiscuous mode [ 504.769736][T19506] geneve2: entered promiscuous mode [ 504.775341][T19506] geneve2: entered allmulticast mode [ 504.786542][ T8876] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.899475][ T8876] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 505.007032][ T36] tipc: Disabling bearer [ 505.038078][ T36] tipc: Left network mode [ 505.117742][T19519] syzkaller0: entered promiscuous mode [ 505.123420][T19519] syzkaller0: entered allmulticast mode [ 505.233695][T19532] netlink: 'syz.4.3613': attribute type 1 has an invalid length. [ 505.252307][T19532] __nla_validate_parse: 2 callbacks suppressed [ 505.252327][T19532] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3613'. [ 505.783588][T19561] Cannot find del_set index 1 as target [ 505.797105][T19561] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3619'. [ 507.816999][ T8869] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 507.839263][ T8869] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 507.890339][T19589] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3622'. [ 508.071180][T19600] FAULT_INJECTION: forcing a failure. [ 508.071180][T19600] name failslab, interval 1, probability 0, space 0, times 0 [ 508.086556][T19600] CPU: 0 UID: 0 PID: 19600 Comm: syz.2.3627 Not tainted syzkaller #0 PREEMPT(full) [ 508.086584][T19600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 508.086597][T19600] Call Trace: [ 508.086606][T19600] [ 508.086615][T19600] dump_stack_lvl+0xe8/0x150 [ 508.086649][T19600] should_fail_ex+0x40c/0x560 [ 508.086677][T19600] should_failslab+0xa8/0x100 [ 508.086708][T19600] __kmalloc_noprof+0xfe/0x720 [ 508.086734][T19600] ? sk_prot_alloc+0xe7/0x210 [ 508.086835][T19600] ? sk_prot_alloc+0xe7/0x210 [ 508.086862][T19600] sk_prot_alloc+0xe7/0x210 [ 508.086882][T19600] ? sk_alloc+0x27/0x390 [ 508.086905][T19600] sk_alloc+0x3a/0x390 [ 508.086930][T19600] bpf_prog_test_run_skb+0x3a6/0x2230 [ 508.086985][T19600] ? kstrtouint+0x6e/0xe0 [ 508.087011][T19600] ? __might_fault+0xaf/0x130 [ 508.087053][T19600] ? __might_fault+0xaf/0x130 [ 508.087088][T19600] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 508.087114][T19600] bpf_prog_test_run+0x2c5/0x340 [ 508.087147][T19600] __sys_bpf+0xa22/0xd90 [ 508.087180][T19600] ? vfs_write+0x930/0xba0 [ 508.087211][T19600] ? __pfx___sys_bpf+0x10/0x10 [ 508.087270][T19600] ? ksys_write+0x1fc/0x270 [ 508.087304][T19600] ? __pfx_ksys_write+0x10/0x10 [ 508.087341][T19600] __x64_sys_bpf+0xba/0xd0 [ 508.087372][T19600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.087396][T19600] do_syscall_64+0x174/0x580 [ 508.087428][T19600] ? trace_irq_disable+0x3b/0x140 [ 508.087454][T19600] ? clear_bhb_loop+0x70/0xc0 [ 508.087480][T19600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.087502][T19600] RIP: 0033:0x7fdf86d9e0d9 [ 508.087522][T19600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.087541][T19600] RSP: 002b:00007fdf87c05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 508.087564][T19600] RAX: ffffffffffffffda RBX: 00007fdf87025fa0 RCX: 00007fdf86d9e0d9 [ 508.087581][T19600] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 508.087595][T19600] RBP: 00007fdf87c05090 R08: 0000000000000000 R09: 0000000000000000 [ 508.087609][T19600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.087623][T19600] R13: 00007fdf87026038 R14: 00007fdf87025fa0 R15: 00007ffe2d205178 [ 508.087657][T19600] [ 508.409471][T19609] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3628'. [ 508.472244][T19242] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.502864][T19611] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3629'. [ 508.771485][T19242] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.785531][T19242] bridge_slave_0: entered allmulticast mode [ 508.794810][T19242] bridge_slave_0: entered promiscuous mode [ 508.805053][T19242] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.813817][T19242] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.821104][T19242] bridge_slave_1: entered allmulticast mode [ 508.829591][T19242] bridge_slave_1: entered promiscuous mode [ 509.140873][T19630] bond5: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 509.248191][T19630] bond5 (unregistering): Released all slaves [ 509.283287][T19242] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.378386][T19634] ipvlan2: entered promiscuous mode [ 509.462754][T19646] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 509.464115][T19242] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.758773][T19242] team0: Port device team_slave_0 added [ 509.894533][ T36] hsr_slave_0: left promiscuous mode [ 509.925819][ T36] hsr_slave_1: left promiscuous mode [ 509.944829][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 509.963568][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 509.985965][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 510.005889][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 510.045191][ T36] veth1_vlan: left promiscuous mode [ 510.062515][ T36] veth0_vlan: left promiscuous mode [ 510.186318][T19669] ip6t_srh: unknown srh invflags BA61 [ 511.233624][ T36] team0 (unregistering): Port device team_slave_1 removed [ 511.249636][ T36] team0 (unregistering): Port device team_slave_0 removed [ 511.406828][T19242] team0: Port device team_slave_1 added [ 511.470320][T19671] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 511.500793][ T5267] 8021q: adding VLAN 0 to HW filter on device eth1 [ 511.628625][T19242] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 511.782230][T19242] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 511.814027][T19242] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 511.827478][T19242] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 511.860789][T19242] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 511.901173][T19242] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 511.959356][T19706] syz_tun: entered promiscuous mode [ 511.983436][T19706] vlan2: entered promiscuous mode [ 512.287194][T19242] hsr_slave_0: entered promiscuous mode [ 512.312232][T19242] hsr_slave_1: entered promiscuous mode [ 512.345244][T19242] debugfs: 'hsr0' already exists in 'hsr' [ 512.351201][T19242] Cannot create hsr debugfs directory [ 512.678036][ T36] IPVS: stop unused estimator thread 0... [ 513.061079][T19755] syzkaller0: entered promiscuous mode [ 513.067313][T19755] syzkaller0: entered allmulticast mode [ 513.110819][T19753] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3661'. [ 513.253999][T19762] tipc: Enabled bearer , priority 0 [ 513.278186][T19754] tipc: Resetting bearer [ 513.327663][T19754] tipc: Disabling bearer [ 513.555923][T19781] syzkaller1: entered promiscuous mode [ 513.561775][T19781] syzkaller1: entered allmulticast mode [ 513.840718][T19791] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3672'. [ 513.999811][T19795] netlink: 'syz.0.3674': attribute type 6 has an invalid length. [ 514.009232][T19795] IPv6: NLM_F_CREATE should be specified when creating new route [ 514.027694][T19795] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3674'. [ 514.082912][T19795] 8021q: adding VLAN 0 to HW filter on device bond1 [ 514.086598][T19798] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3674'. [ 514.144350][T19795] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3674'. [ 514.371249][T19795] bond1 (unregistering): Released all slaves [ 514.581193][T19820] netlink: 'syz.2.3680': attribute type 5 has an invalid length. [ 514.682898][T19827] FAULT_INJECTION: forcing a failure. [ 514.682898][T19827] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 514.696230][T19827] CPU: 0 UID: 0 PID: 19827 Comm: syz.2.3681 Not tainted syzkaller #0 PREEMPT(full) [ 514.696259][T19827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 514.696272][T19827] Call Trace: [ 514.696281][T19827] [ 514.696290][T19827] dump_stack_lvl+0xe8/0x150 [ 514.696326][T19827] should_fail_ex+0x40c/0x560 [ 514.696355][T19827] _copy_to_user+0x31/0xb0 [ 514.696387][T19827] sctp_getsockopt_local_addrs+0xd2a/0xf20 [ 514.696522][T19827] ? __pfx_sctp_getsockopt_local_addrs+0x10/0x10 [ 514.696557][T19827] ? do_raw_spin_lock+0x12b/0x2f0 [ 514.696579][T19827] ? lock_sock_nested+0x6a/0x100 [ 514.696616][T19827] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 514.696650][T19827] ? __local_bh_enable_ip+0xd0/0x130 [ 514.696679][T19827] sctp_getsockopt+0x68f/0xb90 [ 514.696743][T19827] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 514.696776][T19827] do_sock_getsockopt+0x51d/0x7e0 [ 514.696842][T19827] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 514.696884][T19827] ? __fget_files+0x3a2/0x420 [ 514.696912][T19827] ? __fget_files+0x2a/0x420 [ 514.696946][T19827] __x64_sys_getsockopt+0x1a4/0x240 [ 514.696977][T19827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.697001][T19827] do_syscall_64+0x174/0x580 [ 514.697033][T19827] ? trace_irq_disable+0x3b/0x140 [ 514.697059][T19827] ? clear_bhb_loop+0x70/0xc0 [ 514.697086][T19827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.697108][T19827] RIP: 0033:0x7fdf86d9e0d9 [ 514.697129][T19827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 514.697149][T19827] RSP: 002b:00007fdf87c05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 514.697172][T19827] RAX: ffffffffffffffda RBX: 00007fdf87025fa0 RCX: 00007fdf86d9e0d9 [ 514.697188][T19827] RDX: 000000000000006d RSI: 0000000000000084 RDI: 0000000000000004 [ 514.697201][T19827] RBP: 00007fdf87c05090 R08: 0000200000001040 R09: 0000000000000000 [ 514.697214][T19827] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 514.697228][T19827] R13: 00007fdf87026038 R14: 00007fdf87025fa0 R15: 00007ffe2d205178 [ 514.697262][T19827] [ 514.956063][T19830] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3682'. [ 515.243343][T19830] bond0: Unable to set down delay as MII monitoring is disabled [ 515.489195][T19848] IPv6: addrconf: prefix option has invalid lifetime [ 515.496064][T19848] IPv6: addrconf: prefix option has invalid lifetime [ 516.305940][T19242] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 516.371955][T19242] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 516.436609][T19242] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 516.476028][T19242] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 516.512780][T19889] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3697'. [ 516.523391][T19242] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 516.552367][T19242] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 516.590339][T19242] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 516.643179][T19242] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 517.076978][T19921] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3704'. [ 517.558168][T19242] 8021q: adding VLAN 0 to HW filter on device bond0 [ 517.969001][T19905] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3700'. [ 518.004807][T19242] 8021q: adding VLAN 0 to HW filter on device team0 [ 518.024350][T19905] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3700'. [ 518.103215][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.110438][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 518.154022][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.161286][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 519.075408][T19983] syzkaller0: entered promiscuous mode [ 519.081060][T19983] syzkaller0: entered allmulticast mode [ 521.514790][T19995] syzkaller0: entered promiscuous mode [ 521.520444][T19995] syzkaller0: entered allmulticast mode [ 521.530083][T20002] tipc: Enabled bearer , priority 0 [ 521.548214][T19990] tipc: Resetting bearer [ 521.588371][T19990] tipc: Disabling bearer [ 522.084407][T20044] __nla_validate_parse: 1 callbacks suppressed [ 522.084427][T20044] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3738'. [ 522.258056][T20058] netlink: 'syz.0.3742': attribute type 1 has an invalid length. [ 522.310381][T20058] 8021q: adding VLAN 0 to HW filter on device bond1 [ 522.340631][T20064] bond1: (slave veth3): Enslaving as an active interface with a down link [ 522.378616][T20058] bond1: (slave dummy0): making interface the new active one [ 522.408161][T20058] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 522.408738][T20064] netlink: 'syz.0.3742': attribute type 10 has an invalid length. [ 522.425661][T20064] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3742'. [ 522.461921][T20064] dummy0: entered promiscuous mode [ 522.470134][T20064] bond1: (slave dummy0): Releasing active interface [ 522.586721][T20076] IPVS: rr: UDP 127.0.0.1:10000 - no destination available [ 522.603354][T20076] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3748'. [ 522.726480][T20085] tipc: Enabled bearer , priority 0 [ 522.737411][T20085] syzkaller0: entered promiscuous mode [ 522.743255][T20085] syzkaller0: entered allmulticast mode [ 522.752265][T20085] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 522.867768][T20085] tipc: Resetting bearer [ 522.876185][T20084] tipc: Resetting bearer [ 522.917398][T20084] tipc: Disabling bearer [ 523.108007][T19242] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 523.267256][T20110] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3753'. [ 523.383461][T19242] veth0_vlan: entered promiscuous mode [ 523.457516][T19242] veth1_vlan: entered promiscuous mode [ 523.587280][T20117] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3755'. [ 523.671688][T19242] veth0_macvtap: entered promiscuous mode [ 523.682308][T19242] veth1_macvtap: entered promiscuous mode [ 523.701156][T20120] netlink: 'syz.2.3757': attribute type 1 has an invalid length. [ 523.797246][T20120] 8021q: adding VLAN 0 to HW filter on device bond5 [ 523.809804][T20120] dummy0: left promiscuous mode [ 523.822510][T20120] bond5: (slave dummy0): making interface the new active one [ 523.834259][T20120] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 523.846120][T20120] netlink: 'syz.2.3757': attribute type 10 has an invalid length. [ 523.855101][T20120] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3757'. [ 523.884953][T20129] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3759'. [ 523.989981][T20134] netlink: 548 bytes leftover after parsing attributes in process `syz.0.3759'. [ 524.241764][T20125] bond5: (slave veth9): Enslaving as an active interface with a down link [ 524.288390][T20120] dummy0: entered promiscuous mode [ 524.295761][T20120] bond5: (slave dummy0): Releasing active interface [ 524.305399][T20120] bond5: (slave dummy0): the permanent HWaddr of slave - aa:aa:aa:aa:aa:24 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 524.349510][T20132] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3759'. [ 524.454016][T20145] netlink: 'syz.0.3762': attribute type 1 has an invalid length. [ 524.466637][T19242] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 524.601229][T20154] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3765'. [ 524.612836][T19242] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 524.722137][T20159] netlink: 'syz.4.3763': attribute type 10 has an invalid length. [ 525.558168][T20159] geneve2: entered promiscuous mode [ 525.573937][T20159] geneve2: entered allmulticast mode [ 525.832421][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.134251][ T4972] udevd[4972]: worker [14473] /devices/virtual/block/nbd4 is taking a long time [ 527.151781][ T146] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.162366][ T146] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.171223][ T146] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.425211][ T8869] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.453119][ T8869] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.521072][T20188] netlink: 'syz.2.3776': attribute type 1 has an invalid length. [ 527.774917][ T5792] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.784019][ T5792] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 528.033775][T20213] tc_dump_action: action bad kind [ 528.322870][T20235] __nla_validate_parse: 3 callbacks suppressed [ 528.322890][T20235] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3787'. [ 528.360953][T20235] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 528.377134][T20239] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3788'. [ 528.397825][T20239] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3788'. [ 528.428948][T20239] netlink: 212 bytes leftover after parsing attributes in process `syz.0.3788'. [ 528.440306][T20239] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3788'. [ 528.449587][T20239] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3788'. [ 528.661454][T20247] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3792'. [ 528.778976][ T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 528.815088][ T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 529.452612][T20275] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3801'. [ 529.641688][T20280] netlink: 'syz.2.3802': attribute type 1 has an invalid length. [ 529.650088][T20280] netlink: 65015 bytes leftover after parsing attributes in process `syz.2.3802'. [ 529.730688][T20283] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3804'. [ 531.432893][ T50] Bluetooth: hci2: command 0x0405 tx timeout [ 531.549502][T20274] tipc: Enabled bearer , priority 26 [ 531.659229][T20295] pimreg: entered allmulticast mode [ 531.666012][T20295] pimreg: left allmulticast mode [ 532.184809][T20327] team0: Port device team_slave_1 removed [ 532.343097][T20330] netlink: 'syz.0.3819': attribute type 3 has an invalid length. [ 532.370561][T20335] syz_tun: entered promiscuous mode [ 532.445604][T20339] syz_tun: left promiscuous mode [ 532.527230][T20346] 8021q: adding VLAN 0 to HW filter on device bond0 [ 532.540282][T20346] 8021q: adding VLAN 0 to HW filter on device team0 [ 532.555990][T20346] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 532.574436][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.585379][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.599446][ T146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.610445][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.623425][ T5696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.636902][ T5724] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.647109][ T5724] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.655363][ T5724] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.663886][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.673486][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.687396][T20346] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 532.701761][T20346] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 532.712352][T20346] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 532.730077][T20346] veth1_vlan: left promiscuous mode [ 532.741104][T20346] veth0_vlan: left promiscuous mode [ 532.749513][T20346] veth0_vlan: entered promiscuous mode [ 532.758913][T20346] veth1_vlan: entered promiscuous mode [ 532.777945][T20346] veth0_macvtap: left promiscuous mode [ 532.785924][T20346] veth0_macvtap: entered promiscuous mode [ 532.800138][T20346] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 532.810773][T20346] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 532.821836][T20346] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 532.833089][T20346] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 532.844854][T20346] 8021q: adding VLAN 0 to HW filter on device bond1 [ 532.859083][T20346] 8021q: adding VLAN 0 to HW filter on device bond2 [ 532.904225][T20346] 8021q: adding VLAN 0 to HW filter on device bond3 [ 532.914372][T20346] 8021q: adding VLAN 0 to HW filter on device bond4 [ 533.013697][ T13] bond4: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 533.026049][ T13] bond4: (slave veth5): making interface the new active one [ 533.037279][ T13] bond4: active interface up! [ 533.100236][ T8876] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.107776][ T8876] bridge0: port 1(bridge_slave_0) entered forwarding state [ 533.120286][ T8876] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.127585][ T8876] bridge0: port 2(bridge_slave_1) entered forwarding state [ 533.198882][ T10] tipc: Node number set to 585088718 [ 533.325718][ T146] bond5: (slave veth9): link status definitely up, 10000 Mbps full duplex [ 533.363440][ T146] bond5: (slave veth9): making interface the new active one [ 533.415128][ T146] bond5: active interface up! [ 533.552647][T20374] team0 (unregistering): Port device team_slave_0 removed [ 533.584207][T20374] team0 (unregistering): Port device team_slave_1 removed [ 533.689795][ T8869] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 533.699497][ T8869] bond1: (slave veth3): making interface the new active one [ 533.721028][ T8869] bond1: active interface up! [ 533.780163][T20392] netlink: 'syz.3.3828': attribute type 4 has an invalid length. [ 534.040387][T20403] x_tables: duplicate underflow at hook 1 [ 534.049705][T20404] netlink: 'syz.4.3831': attribute type 30 has an invalid length. [ 534.236653][ T1465] block nbd4: Possible stuck request ffff888028004440: control (read@0,1024B). Runtime 90 seconds [ 534.247711][ T1465] block nbd4: Possible stuck request ffff888028004600: control (read@1024,1024B). Runtime 90 seconds [ 534.266836][ T1465] block nbd4: Possible stuck request ffff8880280047c0: control (read@2048,1024B). Runtime 90 seconds [ 534.282762][ T1465] block nbd4: Possible stuck request ffff888028004980: control (read@3072,1024B). Runtime 90 seconds [ 534.322033][T20404] bond2: option arp_missed_max: invalid value (0) [ 534.347134][T20404] bond2: option arp_missed_max: allowed values 1 - 255 [ 534.381282][T20404] bond2 (unregistering): Released all slaves [ 534.625542][T20423] __nla_validate_parse: 5 callbacks suppressed [ 534.625564][T20423] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3835'. [ 534.843436][T20437] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3842'. [ 534.949448][T20450] sctp: [Deprecated]: syz.3.3838 (pid 20450) Use of struct sctp_assoc_value in delayed_ack socket option. [ 534.949448][T20450] Use struct sctp_sack_info instead [ 535.173107][ T13] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 535.225909][T20466] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3847'. [ 535.254428][T20466] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3847'. [ 535.298248][ T13] bond1: (slave veth3): making interface the new active one [ 535.390391][ T13] bond1: active interface up! [ 535.418502][T20474] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3851'. [ 535.573825][T20482] FAULT_INJECTION: forcing a failure. [ 535.573825][T20482] name failslab, interval 1, probability 0, space 0, times 0 [ 535.586603][T20482] CPU: 0 UID: 0 PID: 20482 Comm: syz.4.3849 Not tainted syzkaller #0 PREEMPT(full) [ 535.586631][T20482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 535.586644][T20482] Call Trace: [ 535.586652][T20482] [ 535.586661][T20482] dump_stack_lvl+0xe8/0x150 [ 535.586694][T20482] should_fail_ex+0x40c/0x560 [ 535.586719][T20482] should_failslab+0xa8/0x100 [ 535.586748][T20482] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 535.586773][T20482] ? skb_clone+0x212/0x3a0 [ 535.586882][T20482] ? skb_clone+0x212/0x3a0 [ 535.586913][T20482] skb_clone+0x212/0x3a0 [ 535.586941][T20482] bpf_clone_redirect+0x170/0x4b0 [ 535.587033][T20482] ? bpf_test_run+0x1d1/0x830 [ 535.587057][T20482] bpf_prog_7203902e05d69e09+0x22/0x2a [ 535.587079][T20482] bpf_test_run+0x354/0x830 [ 535.587127][T20482] ? __pfx_bpf_test_run+0x10/0x10 [ 535.587175][T20482] ? csum_partial+0x239/0x2c0 [ 535.587244][T20482] ? skb_dst_set+0x72/0x140 [ 535.587271][T20482] bpf_prog_test_run_skb+0xe35/0x2230 [ 535.587299][T20482] ? kstrtouint+0x6e/0xe0 [ 535.587323][T20482] ? __might_fault+0xaf/0x130 [ 535.587348][T20482] ? __might_fault+0xaf/0x130 [ 535.587382][T20482] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 535.587414][T20482] bpf_prog_test_run+0x2c5/0x340 [ 535.587446][T20482] __sys_bpf+0xa22/0xd90 [ 535.587478][T20482] ? vfs_write+0x930/0xba0 [ 535.587507][T20482] ? __pfx___sys_bpf+0x10/0x10 [ 535.587566][T20482] ? ksys_write+0x1fc/0x270 [ 535.587599][T20482] ? __pfx_ksys_write+0x10/0x10 [ 535.587634][T20482] __x64_sys_bpf+0xba/0xd0 [ 535.587658][T20482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.587682][T20482] do_syscall_64+0x174/0x580 [ 535.587712][T20482] ? trace_irq_disable+0x3b/0x140 [ 535.587736][T20482] ? clear_bhb_loop+0x70/0xc0 [ 535.587762][T20482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.587783][T20482] RIP: 0033:0x7f863f19e0d9 [ 535.587802][T20482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.587821][T20482] RSP: 002b:00007f86400e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 535.587844][T20482] RAX: ffffffffffffffda RBX: 00007f863f426090 RCX: 00007f863f19e0d9 [ 535.587859][T20482] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 535.587872][T20482] RBP: 00007f86400e4090 R08: 0000000000000000 R09: 0000000000000000 [ 535.587885][T20482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 535.587897][T20482] R13: 00007f863f426128 R14: 00007f863f426090 R15: 00007ffe1cdcf9a8 [ 535.587930][T20482] [ 536.807668][T20529] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3866'. [ 537.099396][T20527] netlink: 'syz.2.3867': attribute type 4 has an invalid length. [ 537.107564][T20527] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3867'. [ 537.872928][ T36] net_ratelimit: 20 callbacks suppressed [ 537.872948][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.889112][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.905035][ T146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.914085][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.987346][T20570] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.998950][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.009259][ T5724] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.072577][ T8869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.082682][ T8869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.090810][ T8869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.274909][T20591] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 538.433821][T20597] syzkaller0: entered promiscuous mode [ 538.440366][T20597] syzkaller0: entered allmulticast mode [ 538.493000][T20597] tipc: Enabled bearer , priority 0 [ 538.505205][T20596] tipc: Resetting bearer [ 538.564572][T20596] tipc: Disabling bearer [ 538.585720][T20602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3882'. [ 538.819532][T20602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3882'. [ 539.515067][ T50] Bluetooth: hci4: command 0x0406 tx timeout [ 539.602802][T20645] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3894'. [ 539.707213][T20653] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3896'. [ 539.733341][T20650] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3894'. [ 539.908410][T20657] syzkaller0: entered promiscuous mode [ 539.914754][T20657] syzkaller0: entered allmulticast mode [ 539.956903][T20657] tipc: Enabled bearer , priority 0 [ 540.003750][T20656] tipc: Resetting bearer [ 540.240407][T20656] tipc: Disabling bearer [ 540.405446][T20676] netlink: 'syz.2.3904': attribute type 1 has an invalid length. [ 540.421206][T20673] FAULT_INJECTION: forcing a failure. [ 540.421206][T20673] name failslab, interval 1, probability 0, space 0, times 0 [ 540.433975][T20673] CPU: 0 UID: 0 PID: 20673 Comm: syz.3.3902 Not tainted syzkaller #0 PREEMPT(full) [ 540.434003][T20673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 540.434015][T20673] Call Trace: [ 540.434024][T20673] [ 540.434033][T20673] dump_stack_lvl+0xe8/0x150 [ 540.434067][T20673] should_fail_ex+0x40c/0x560 [ 540.434094][T20673] should_failslab+0xa8/0x100 [ 540.434126][T20673] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 540.434151][T20673] ? skb_clone+0x212/0x3a0 [ 540.434173][T20673] ? skb_clone+0x212/0x3a0 [ 540.434221][T20673] skb_clone+0x212/0x3a0 [ 540.434250][T20673] bpf_clone_redirect+0x170/0x4b0 [ 540.434289][T20673] ? bpf_test_run+0x1d1/0x830 [ 540.434314][T20673] bpf_prog_1e32fd1da8924237+0x22/0x2a [ 540.434336][T20673] bpf_test_run+0x5c9/0x830 [ 540.434384][T20673] ? __pfx_bpf_test_run+0x10/0x10 [ 540.434421][T20673] ? csum_partial+0x239/0x2c0 [ 540.434470][T20673] ? skb_dst_set+0x72/0x140 [ 540.434497][T20673] bpf_prog_test_run_skb+0xe35/0x2230 [ 540.434526][T20673] ? kstrtouint+0x6e/0xe0 [ 540.434552][T20673] ? __might_fault+0xaf/0x130 [ 540.434577][T20673] ? __might_fault+0xaf/0x130 [ 540.434612][T20673] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 540.434638][T20673] bpf_prog_test_run+0x2c5/0x340 [ 540.434670][T20673] __sys_bpf+0xa22/0xd90 [ 540.434708][T20673] ? vfs_write+0x930/0xba0 [ 540.434738][T20673] ? __pfx___sys_bpf+0x10/0x10 [ 540.434799][T20673] ? ksys_write+0x1fc/0x270 [ 540.434832][T20673] ? __pfx_ksys_write+0x10/0x10 [ 540.434869][T20673] __x64_sys_bpf+0xba/0xd0 [ 540.434893][T20673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.434918][T20673] do_syscall_64+0x174/0x580 [ 540.434948][T20673] ? trace_irq_disable+0x3b/0x140 [ 540.434975][T20673] ? clear_bhb_loop+0x70/0xc0 [ 540.435001][T20673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.435023][T20673] RIP: 0033:0x7fde54d9e0d9 [ 540.435042][T20673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.435060][T20673] RSP: 002b:00007fde55c2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 540.435084][T20673] RAX: ffffffffffffffda RBX: 00007fde55025fa0 RCX: 00007fde54d9e0d9 [ 540.435101][T20673] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 540.435115][T20673] RBP: 00007fde55c2f090 R08: 0000000000000000 R09: 0000000000000000 [ 540.435129][T20673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 540.435142][T20673] R13: 00007fde55026038 R14: 00007fde55025fa0 R15: 00007ffe53672108 [ 540.435176][T20673] [ 540.699602][T20668] vlan3: entered promiscuous mode [ 540.704938][T20668] macvlan0: entered promiscuous mode [ 540.784868][T20676] 8021q: adding VLAN 0 to HW filter on device bond6 [ 540.834869][T20677] team0: Device xfrm0 is of different type [ 540.870433][T20685] netlink: 'syz.2.3904': attribute type 10 has an invalid length. [ 540.879085][T20685] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3904'. [ 541.130211][T20680] bond6: (slave veth11): Enslaving as an active interface with a down link [ 541.155057][T20676] dummy0: left promiscuous mode [ 541.167387][T20676] bond6: (slave dummy0): making interface the new active one [ 541.175852][T20676] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 541.197721][T20685] dummy0: entered promiscuous mode [ 541.211279][T20685] bond6: (slave dummy0): Releasing active interface [ 541.582747][T20692] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 541.816359][T20730] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3914'. [ 541.910174][T20734] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3915'. [ 541.938468][T20736] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3916'. [ 541.948656][T20734] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3915'. [ 542.188227][T20745] netlink: 6024 bytes leftover after parsing attributes in process `syz.1.3917'. [ 542.294960][T20750] syzkaller0: entered promiscuous mode [ 542.318157][T20750] syzkaller0: entered allmulticast mode [ 542.490244][T20759] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3920'. [ 543.097031][T20782] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3927'. [ 543.192161][ T8876] net_ratelimit: 59 callbacks suppressed [ 543.192180][ T8876] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.206579][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.445039][ T5724] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.718514][T20813] bridge_slave_0: left allmulticast mode [ 543.739930][T20813] bridge_slave_0: left promiscuous mode [ 543.755228][T20813] bridge0: port 1(bridge_slave_0) entered disabled state [ 543.800955][T20813] bridge_slave_1: left allmulticast mode [ 543.832802][ T1094] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.842316][ T1094] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.850690][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.859446][ T1094] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.867824][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.919421][T20813] bridge_slave_1: left promiscuous mode [ 543.937219][T20813] bridge0: port 2(bridge_slave_1) entered disabled state [ 543.964371][T20813] bond0: (slave bond_slave_0): Releasing backup interface [ 543.982955][T20813] bond_slave_0: left allmulticast mode [ 544.026511][T20813] bond0: (slave bond_slave_1): Releasing backup interface [ 544.037107][T20813] bond_slave_1: left allmulticast mode [ 544.062554][T20813] team0: Port device team_slave_0 removed [ 544.084419][T20813] team0: Port device team_slave_1 removed [ 544.098273][T20813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 544.115215][T20813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 544.125359][T20813] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 544.135578][T20813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 544.146244][T20813] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 544.236367][T20836] FAULT_INJECTION: forcing a failure. [ 544.236367][T20836] name failslab, interval 1, probability 0, space 0, times 0 [ 544.251218][T20836] CPU: 1 UID: 0 PID: 20836 Comm: syz.0.3939 Not tainted syzkaller #0 PREEMPT(full) [ 544.251244][T20836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 544.251257][T20836] Call Trace: [ 544.251266][T20836] [ 544.251276][T20836] dump_stack_lvl+0xe8/0x150 [ 544.251313][T20836] should_fail_ex+0x40c/0x560 [ 544.251341][T20836] should_failslab+0xa8/0x100 [ 544.251372][T20836] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 544.251397][T20836] ? skb_clone+0x212/0x3a0 [ 544.251421][T20836] ? skb_clone+0x212/0x3a0 [ 544.251452][T20836] skb_clone+0x212/0x3a0 [ 544.251474][T20836] ? dev_queue_xmit_nit+0x25c/0xac0 [ 544.251583][T20836] dev_queue_xmit_nit+0x28d/0xac0 [ 544.251605][T20836] ? dev_queue_xmit_nit+0x2d/0xac0 [ 544.251635][T20836] dev_hard_start_xmit+0x1c1/0x830 [ 544.251679][T20836] __dev_queue_xmit+0x14c0/0x3820 [ 544.251704][T20836] ? bpf_prog_test_run+0x2c5/0x340 [ 544.251731][T20836] ? __sys_bpf+0xa22/0xd90 [ 544.251767][T20836] ? __dev_queue_xmit+0x29b/0x3820 [ 544.251804][T20836] ? __pfx___dev_queue_xmit+0x10/0x10 [ 544.251856][T20836] ? skb_release_data+0x30f/0xab0 [ 544.251893][T20836] __bpf_redirect+0xc5b/0x1250 [ 544.251939][T20836] bpf_clone_redirect+0x319/0x4b0 [ 544.251976][T20836] ? bpf_test_run+0x1d1/0x830 [ 544.252002][T20836] bpf_prog_1e32fd1da8924237+0x22/0x2a [ 544.252024][T20836] bpf_test_run+0x354/0x830 [ 544.252071][T20836] ? __pfx_bpf_test_run+0x10/0x10 [ 544.252116][T20836] ? csum_partial+0x239/0x2c0 [ 544.252163][T20836] ? skb_dst_set+0x72/0x140 [ 544.252209][T20836] bpf_prog_test_run_skb+0xe35/0x2230 [ 544.252244][T20836] ? kstrtouint+0x6e/0xe0 [ 544.252271][T20836] ? __might_fault+0xaf/0x130 [ 544.252296][T20836] ? __might_fault+0xaf/0x130 [ 544.252333][T20836] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 544.252359][T20836] bpf_prog_test_run+0x2c5/0x340 [ 544.252393][T20836] __sys_bpf+0xa22/0xd90 [ 544.252433][T20836] ? vfs_write+0x930/0xba0 [ 544.252463][T20836] ? __pfx___sys_bpf+0x10/0x10 [ 544.252527][T20836] ? ksys_write+0x1fc/0x270 [ 544.252561][T20836] ? __pfx_ksys_write+0x10/0x10 [ 544.252598][T20836] __x64_sys_bpf+0xba/0xd0 [ 544.252624][T20836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.252649][T20836] do_syscall_64+0x174/0x580 [ 544.252680][T20836] ? trace_irq_disable+0x3b/0x140 [ 544.252706][T20836] ? clear_bhb_loop+0x70/0xc0 [ 544.252733][T20836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.252755][T20836] RIP: 0033:0x7f5db839e0d9 [ 544.252776][T20836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 544.252795][T20836] RSP: 002b:00007f5db91b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 544.252818][T20836] RAX: ffffffffffffffda RBX: 00007f5db8625fa0 RCX: 00007f5db839e0d9 [ 544.252833][T20836] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 544.252847][T20836] RBP: 00007f5db91b5090 R08: 0000000000000000 R09: 0000000000000000 [ 544.252859][T20836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 544.252871][T20836] R13: 00007f5db8626038 R14: 00007f5db8625fa0 R15: 00007ffc39f8d158 [ 544.252905][T20836] [ 544.602915][ T5724] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 545.039432][T20854] IPVS: set_ctl: invalid protocol: 94 172.30.0.1:20000 [ 545.048896][T20855] netlink: 'syz.2.3944': attribute type 3 has an invalid length. [ 545.361791][T20873] __nla_validate_parse: 3 callbacks suppressed [ 545.361811][T20873] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3945'. [ 545.452776][T20862] IPVS: set_ctl: invalid protocol: 94 127.0.0.1:20002 [ 545.656452][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 545.719291][T20884] tipc: New replicast peer: 255.255.255.255 [ 545.784799][T20888] Bluetooth: MGMT ver 1.23 [ 545.822287][T20884] tipc: Enabled bearer , priority 26 [ 545.895105][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 545.927610][T20894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3950'. [ 545.937447][T20895] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3950'. [ 545.949461][T20895] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3950'. [ 545.959282][T20894] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3950'. [ 545.968519][ T4922] Bluetooth: hci2: link tx timeout [ 545.975157][ T4922] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 545.989684][ T4922] Bluetooth: hci2: link tx timeout [ 545.997705][ T4922] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 546.101614][T20888] xt_hashlimit: size too large, truncated to 1048576 [ 546.193562][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 547.039628][ T29] tipc: Node number set to 2253485274 [ 547.162932][T20958] block nbd0: reconnected socket [ 547.199453][T20955] netlink: 'syz.1.3959': attribute type 1 has an invalid length. [ 547.222286][T20958] tipc: Started in network mode [ 547.227294][T20958] tipc: Node identity 92aa6ac869ed, cluster identity 4711 [ 547.236142][T20958] tipc: Enabled bearer , priority 0 [ 547.254376][T20955] netlink: 6492 bytes leftover after parsing attributes in process `syz.1.3959'. [ 547.268394][T20958] syzkaller0: entered promiscuous mode [ 547.280964][T20958] syzkaller0: entered allmulticast mode [ 547.443683][T20963] tipc: Resetting bearer [ 547.451693][T20874] infiniband syz0: set active [ 547.458683][T20874] infiniband syz0: added xfrm0 [ 547.468308][T20874] [ 547.470707][T20874] ====================================================== [ 547.477752][T20874] WARNING: possible circular locking dependency detected [ 547.484837][T20874] syzkaller #0 Not tainted [ 547.489286][T20874] ------------------------------------------------------ [ 547.496332][T20874] syz.3.3946/20874 is trying to acquire lock: [ 547.502446][T20874] ffffffff8ec5ed80 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x231/0x1900 [ 547.512069][T20874] [ 547.512069][T20874] but task is already holding lock: [ 547.519462][T20874] ffffffff8e9f6d00 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0xa9c/0x2060 [ 547.528827][T20874] [ 547.528827][T20874] which lock already depends on the new lock. [ 547.528827][T20874] [ 547.539288][T20874] [ 547.539288][T20874] the existing dependency chain (in reverse order) is: [ 547.548321][T20874] [ 547.548321][T20874] -> #8 (wq_pool_mutex){+.+.}-{4:4}: [ 547.555818][T20874] __mutex_lock+0x19d/0x1550 [ 547.560962][T20874] __alloc_workqueue+0xa9c/0x2060 [ 547.566529][T20874] alloc_workqueue_noprof+0xe3/0x210 [ 547.572394][T20874] padata_alloc+0xbe/0x360 [ 547.577353][T20874] pcrypt_init_padata+0x27/0x100 [ 547.582938][T20874] pcrypt_init+0x60/0xc0 [ 547.587762][T20874] do_one_initcall+0x250/0x870 [ 547.593068][T20874] do_initcall_level+0x10a/0x1a0 [ 547.598573][T20874] do_initcalls+0x59/0xa0 [ 547.603433][T20874] kernel_init_freeable+0x29d/0x3e0 [ 547.609192][T20874] kernel_init+0x1d/0x1d0 [ 547.614062][T20874] ret_from_fork+0x514/0xb70 [ 547.619192][T20874] ret_from_fork_asm+0x1a/0x30 [ 547.624509][T20874] [ 547.624509][T20874] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 547.632260][T20874] cpus_read_lock+0x42/0x160 [ 547.637391][T20874] static_key_slow_inc+0x12/0x30 [ 547.642874][T20874] nbd_genl_reconfigure+0x1301/0x1e80 [ 547.648876][T20874] genl_family_rcv_msg_doit+0x233/0x340 [ 547.655008][T20874] genl_rcv_msg+0x614/0x7a0 [ 547.660055][T20874] netlink_rcv_skb+0x226/0x4a0 [ 547.665349][T20874] genl_rcv+0x28/0x40 [ 547.669872][T20874] netlink_unicast+0x7bb/0x940 [ 547.675271][T20874] netlink_sendmsg+0x813/0xb40 [ 547.680590][T20874] sock_sendmsg_nosec+0x13a/0x180 [ 547.686198][T20874] ____sys_sendmsg+0x54e/0x850 [ 547.691504][T20874] ___sys_sendmsg+0x2a5/0x360 [ 547.696718][T20874] __x64_sys_sendmsg+0x1b1/0x290 [ 547.702229][T20874] do_syscall_64+0x174/0x580 [ 547.707366][T20874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.713833][T20874] [ 547.713833][T20874] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 547.721533][T20874] __mutex_lock+0x19d/0x1550 [ 547.726692][T20874] nbd_queue_rq+0x373/0x1150 [ 547.731832][T20874] blk_mq_dispatch_rq_list+0x499/0x1990 [ 547.738012][T20874] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 547.744923][T20874] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 547.751466][T20874] blk_mq_run_work_fn+0x16c/0x300 [ 547.757060][T20874] process_scheduled_works+0xa8e/0x14e0 [ 547.763143][T20874] worker_thread+0xa47/0xfb0 [ 547.768273][T20874] kthread+0x388/0x470 [ 547.772888][T20874] ret_from_fork+0x514/0xb70 [ 547.778020][T20874] ret_from_fork_asm+0x1a/0x30 [ 547.783321][T20874] [ 547.783321][T20874] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 547.790545][T20874] __mutex_lock+0x19d/0x1550 [ 547.795678][T20874] nbd_queue_rq+0xc1/0x1150 [ 547.800722][T20874] blk_mq_dispatch_rq_list+0x499/0x1990 [ 547.806807][T20874] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 547.813682][T20874] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 547.820207][T20874] blk_mq_run_work_fn+0x16c/0x300 [ 547.825776][T20874] process_scheduled_works+0xa8e/0x14e0 [ 547.831860][T20874] worker_thread+0xa47/0xfb0 [ 547.837007][T20874] kthread+0x388/0x470 [ 547.841614][T20874] ret_from_fork+0x514/0xb70 [ 547.846745][T20874] ret_from_fork_asm+0x1a/0x30 [ 547.852063][T20874] [ 547.852063][T20874] -> #4 (set->srcu){.+.+}-{0:0}: [ 547.859218][T20874] __synchronize_srcu+0xc9/0x2f0 [ 547.864694][T20874] elevator_switch+0x1e8/0x7b0 [ 547.870066][T20874] elevator_change+0x2fa/0x480 [ 547.875373][T20874] elevator_set_default+0x375/0x440 [ 547.881119][T20874] blk_register_queue+0x3f3/0x4e0 [ 547.886748][T20874] __add_disk+0x6cb/0xe30 [ 547.891618][T20874] add_disk_fwnode+0x100/0x3a0 [ 547.896917][T20874] nbd_dev_add+0x733/0xb60 [ 547.901902][T20874] nbd_init+0x15f/0x1e0 [ 547.906641][T20874] do_one_initcall+0x250/0x870 [ 547.911942][T20874] do_initcall_level+0x10a/0x1a0 [ 547.917448][T20874] do_initcalls+0x59/0xa0 [ 547.922317][T20874] kernel_init_freeable+0x29d/0x3e0 [ 547.928059][T20874] kernel_init+0x1d/0x1d0 [ 547.932927][T20874] ret_from_fork+0x514/0xb70 [ 547.938056][T20874] ret_from_fork_asm+0x1a/0x30 [ 547.943360][T20874] [ 547.943360][T20874] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 547.951197][T20874] __mutex_lock+0x19d/0x1550 [ 547.956333][T20874] elevator_change+0x1af/0x480 [ 547.961637][T20874] elevator_set_none+0xb5/0x140 [ 547.967026][T20874] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 547.973375][T20874] nbd_start_device+0x189/0xb30 [ 547.978772][T20874] nbd_genl_connect+0x1597/0x1c10 [ 547.984341][T20874] genl_family_rcv_msg_doit+0x233/0x340 [ 547.990429][T20874] genl_rcv_msg+0x614/0x7a0 [ 547.995473][T20874] netlink_rcv_skb+0x226/0x4a0 [ 548.000778][T20874] genl_rcv+0x28/0x40 [ 548.005316][T20874] netlink_unicast+0x7bb/0x940 [ 548.010615][T20874] netlink_sendmsg+0x813/0xb40 [ 548.016008][T20874] sock_sendmsg_nosec+0x13a/0x180 [ 548.021580][T20874] ____sys_sendmsg+0x54e/0x850 [ 548.026898][T20874] ___sys_sendmsg+0x2a5/0x360 [ 548.032112][T20874] __x64_sys_sendmsg+0x1b1/0x290 [ 548.037583][T20874] do_syscall_64+0x174/0x580 [ 548.042712][T20874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.049137][T20874] [ 548.049137][T20874] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 548.057762][T20874] blk_alloc_queue+0x544/0x690 [ 548.063070][T20874] __blk_mq_alloc_disk+0x194/0x390 [ 548.068720][T20874] nbd_dev_add+0x494/0xb60 [ 548.073683][T20874] nbd_init+0x15f/0x1e0 [ 548.078402][T20874] do_one_initcall+0x250/0x870 [ 548.083708][T20874] do_initcall_level+0x10a/0x1a0 [ 548.089190][T20874] do_initcalls+0x59/0xa0 [ 548.094047][T20874] kernel_init_freeable+0x29d/0x3e0 [ 548.099784][T20874] kernel_init+0x1d/0x1d0 [ 548.104653][T20874] ret_from_fork+0x514/0xb70 [ 548.109791][T20874] ret_from_fork_asm+0x1a/0x30 [ 548.115094][T20874] [ 548.115094][T20874] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 548.122350][T20874] fs_reclaim_acquire+0x71/0x100 [ 548.127826][T20874] prepare_alloc_pages+0x15b/0x650 [ 548.133473][T20874] __alloc_frozen_pages_noprof+0x12f/0x380 [ 548.139822][T20874] __alloc_pages_noprof+0x10/0x100 [ 548.145470][T20874] pcpu_populate_chunk+0x181/0xb30 [ 548.151119][T20874] pcpu_alloc_noprof+0xbca/0x1900 [ 548.156680][T20874] __alloc+0x80/0x170 [ 548.161207][T20874] alloc_bulk+0x314/0x4e0 [ 548.166075][T20874] bpf_mem_alloc_init+0x4a5/0xc90 [ 548.171639][T20874] htab_map_alloc+0x8a5/0xc90 [ 548.176852][T20874] map_create+0xf2a/0x1b90 [ 548.181817][T20874] __sys_bpf+0xaea/0xd90 [ 548.186616][T20874] __x64_sys_bpf+0xba/0xd0 [ 548.191562][T20874] do_syscall_64+0x174/0x580 [ 548.196694][T20874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.203117][T20874] [ 548.203117][T20874] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 548.210867][T20874] __lock_acquire+0x1520/0x2cf0 [ 548.216284][T20874] lock_acquire+0x106/0x350 [ 548.221371][T20874] __mutex_lock+0x19d/0x1550 [ 548.226526][T20874] pcpu_alloc_noprof+0x231/0x1900 [ 548.232090][T20874] __alloc_workqueue+0xb2c/0x2060 [ 548.237656][T20874] alloc_workqueue_noprof+0xe3/0x210 [ 548.243484][T20874] ib_mad_init_device+0x993/0x2150 [ 548.249238][T20874] add_client_context+0x37c/0x7b0 [ 548.254853][T20874] enable_device_and_get+0x19c/0x3e0 [ 548.260676][T20874] ib_register_device+0x10af/0x1380 [ 548.266410][T20874] rxe_register_device+0x1e3/0x350 [ 548.272098][T20874] rxe_net_add+0x81/0x110 [ 548.277005][T20874] rxe_newlink+0xf4/0x1c0 [ 548.281914][T20874] nldev_newlink+0x5bc/0x650 [ 548.287052][T20874] rdma_nl_rcv+0x6ef/0xa40 [ 548.292003][T20874] netlink_unicast+0x7bb/0x940 [ 548.297306][T20874] netlink_sendmsg+0x813/0xb40 [ 548.302635][T20874] sock_sendmsg_nosec+0x13a/0x180 [ 548.308202][T20874] ____sys_sendmsg+0x54e/0x850 [ 548.313516][T20874] ___sys_sendmsg+0x2a5/0x360 [ 548.318756][T20874] __x64_sys_sendmsg+0x1b1/0x290 [ 548.324249][T20874] do_syscall_64+0x174/0x580 [ 548.329431][T20874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.335894][T20874] [ 548.335894][T20874] other info that might help us debug this: [ 548.335894][T20874] [ 548.346166][T20874] Chain exists of: [ 548.346166][T20874] pcpu_alloc_mutex --> cpu_hotplug_lock --> wq_pool_mutex [ 548.346166][T20874] [ 548.359237][T20874] Possible unsafe locking scenario: [ 548.359237][T20874] [ 548.366709][T20874] CPU0 CPU1 [ 548.372094][T20874] ---- ---- [ 548.377478][T20874] lock(wq_pool_mutex); [ 548.381739][T20874] lock(cpu_hotplug_lock); [ 548.388795][T20874] lock(wq_pool_mutex); [ 548.395577][T20874] lock(pcpu_alloc_mutex); [ 548.400098][T20874] [ 548.400098][T20874] *** DEADLOCK *** [ 548.400098][T20874] [ 548.408269][T20874] 6 locks held by syz.3.3946/20874: [ 548.413491][T20874] #0: ffffffff9ab21468 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv+0x33d/0xa40 [ 548.423542][T20874] #1: ffffffff8fd86768 (link_ops_rwsem){++++}-{4:4}, at: nldev_newlink+0x429/0x650 [ 548.432992][T20874] #2: ffffffff8fd77c28 (devices_rwsem){++++}-{4:4}, at: enable_device_and_get+0xff/0x3e0 [ 548.442943][T20874] #3: ffffffff8fd77f28 (clients_rwsem){++++}-{4:4}, at: enable_device_and_get+0x165/0x3e0 [ 548.452966][T20874] #4: ffff88807651c620 (&device->client_data_rwsem){++++}-{4:4}, at: add_client_context+0x33e/0x7b0 [ 548.463872][T20874] #5: ffffffff8e9f6d00 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0xa9c/0x2060 [ 548.473662][T20874] [ 548.473662][T20874] stack backtrace: [ 548.479571][T20874] CPU: 0 UID: 0 PID: 20874 Comm: syz.3.3946 Not tainted syzkaller #0 PREEMPT(full) [ 548.479593][T20874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 548.479605][T20874] Call Trace: [ 548.479612][T20874] [ 548.479620][T20874] dump_stack_lvl+0xe8/0x150 [ 548.479647][T20874] print_circular_bug+0x2e1/0x300 [ 548.479677][T20874] check_noncircular+0x12e/0x150 [ 548.479706][T20874] __lock_acquire+0x1520/0x2cf0 [ 548.479730][T20874] ? check_path+0x21/0x40 [ 548.479755][T20874] ? check_noncircular+0xda/0x150 [ 548.479781][T20874] ? add_lock_to_list+0xc7/0x100 [ 548.479807][T20874] ? lockdep_unlock+0x5d/0xd0 [ 548.479825][T20874] ? __lock_acquire+0x13e8/0x2cf0 [ 548.479861][T20874] ? pcpu_alloc_noprof+0x231/0x1900 [ 548.479879][T20874] lock_acquire+0x106/0x350 [ 548.479900][T20874] ? pcpu_alloc_noprof+0x231/0x1900 [ 548.479941][T20874] __mutex_lock+0x19d/0x1550 [ 548.479968][T20874] ? pcpu_alloc_noprof+0x231/0x1900 [ 548.479988][T20874] ? __pfx___mutex_trylock_common+0x10/0x10 [ 548.480017][T20874] ? pcpu_alloc_noprof+0x231/0x1900 [ 548.480035][T20874] ? trace_contention_end+0x3d/0x140 [ 548.480061][T20874] ? __pfx___mutex_lock+0x10/0x10 [ 548.480087][T20874] ? __mutex_lock+0x30d/0x1550 [ 548.480119][T20874] ? __pfx___mutex_lock+0x10/0x10 [ 548.480145][T20874] pcpu_alloc_noprof+0x231/0x1900 [ 548.480165][T20874] ? __kmalloc_cache_node_noprof+0x3ce/0x630 [ 548.480192][T20874] __alloc_workqueue+0xb2c/0x2060 [ 548.480222][T20874] alloc_workqueue_noprof+0xe3/0x210 [ 548.480253][T20874] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 548.480278][T20874] ? __ib_alloc_pd+0x4d6/0x6d0 [ 548.480382][T20874] ? __ib_alloc_pd+0x181/0x6d0 [ 548.480409][T20874] ib_mad_init_device+0x993/0x2150 [ 548.480447][T20874] ? __pfx_ib_mad_init_device+0x10/0x10 [ 548.480470][T20874] ? _raw_spin_unlock+0x3f/0x50 [ 548.480528][T20874] add_client_context+0x37c/0x7b0 [ 548.480550][T20874] ? __pfx_add_client_context+0x10/0x10 [ 548.480568][T20874] ? xa_find+0x25b/0x2b0 [ 548.480589][T20874] enable_device_and_get+0x19c/0x3e0 [ 548.480608][T20874] ? __pfx_enable_device_and_get+0x10/0x10 [ 548.480629][T20874] ? device_add+0x6f6/0xb80 [ 548.480683][T20874] ib_register_device+0x10af/0x1380 [ 548.480705][T20874] ? __pfx_ib_register_device+0x10/0x10 [ 548.480726][T20874] ? xa_load+0x60/0x210 [ 548.480741][T20874] ? xa_load+0x60/0x210 [ 548.480756][T20874] ? xa_load+0x60/0x210 [ 548.480772][T20874] ? xa_load+0x1db/0x210 [ 548.480790][T20874] ? ib_device_set_netdev+0x5c9/0x6d0 [ 548.480813][T20874] rxe_register_device+0x1e3/0x350 [ 548.480833][T20874] rxe_net_add+0x81/0x110 [ 548.480851][T20874] rxe_newlink+0xf4/0x1c0 [ 548.480876][T20874] nldev_newlink+0x5bc/0x650 [ 548.480904][T20874] ? __pfx_nldev_newlink+0x10/0x10 [ 548.480980][T20874] ? bpf_lsm_capable+0x9/0x20 [ 548.481001][T20874] ? security_capable+0x7e/0x2c0 [ 548.481073][T20874] ? __pfx_nldev_newlink+0x10/0x10 [ 548.481098][T20874] rdma_nl_rcv+0x6ef/0xa40 [ 548.481120][T20874] ? __pfx_rdma_nl_rcv+0x10/0x10 [ 548.481145][T20874] ? netlink_deliver_tap+0x2e/0x1b0 [ 548.481165][T20874] ? netlink_deliver_tap+0x2e/0x1b0 [ 548.481186][T20874] netlink_unicast+0x7bb/0x940 [ 548.481207][T20874] netlink_sendmsg+0x813/0xb40 [ 548.481231][T20874] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.481259][T20874] ? aa_sock_msg_perm+0xf1/0x1b0 [ 548.481343][T20874] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.481363][T20874] sock_sendmsg_nosec+0x13a/0x180 [ 548.481388][T20874] ____sys_sendmsg+0x54e/0x850 [ 548.481408][T20874] ? __pfx_____sys_sendmsg+0x10/0x10 [ 548.481430][T20874] ? import_iovec+0x73/0xa0 [ 548.481500][T20874] ___sys_sendmsg+0x2a5/0x360 [ 548.481532][T20874] ? __lock_acquire+0x683/0x2cf0 [ 548.481554][T20874] ? __pfx____sys_sendmsg+0x10/0x10 [ 548.481573][T20874] ? futex_wait+0x2a2/0x390 [ 548.481603][T20874] ? __fget_files+0x2a/0x420 [ 548.481624][T20874] ? __fget_files+0x3a2/0x420 [ 548.481648][T20874] __x64_sys_sendmsg+0x1b1/0x290 [ 548.481667][T20874] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 548.481693][T20874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.481711][T20874] do_syscall_64+0x174/0x580 [ 548.481736][T20874] ? trace_irq_disable+0x3b/0x140 [ 548.481757][T20874] ? clear_bhb_loop+0x70/0xc0 [ 548.481776][T20874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.481792][T20874] RIP: 0033:0x7fde54d9e0d9 [ 548.481810][T20874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 548.481824][T20874] RSP: 002b:00007fde55c0e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 548.481843][T20874] RAX: ffffffffffffffda RBX: 00007fde55026090 RCX: 00007fde54d9e0d9 [ 548.481856][T20874] RDX: 0000000000008014 RSI: 0000200000000200 RDI: 0000000000000007 [ 548.481866][T20874] RBP: 00007fde54e35024 R08: 0000000000000000 R09: 0000000000000000 [ 548.481876][T20874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 548.481887][T20874] R13: 00007fde55026128 R14: 00007fde55026090 R15: 00007ffe53672108 [ 548.481906][T20874] [ 548.973238][ T8869] net_ratelimit: 4 callbacks suppressed [ 548.973258][ T8869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 548.987080][ T8869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 548.995277][ T8869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.000519][T16571] Bluetooth: hci2: command 0x0405 tx timeout [ 549.004306][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.011966][T20874] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 549.018059][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.020860][T20874] infiniband syz0: Couldn't open port 1 [ 549.034893][ T5724] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.040815][T20874] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 549.066522][T20874] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 549.083876][T20874] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 549.107096][T20874] RDS/IB: syz0: added [ 549.111792][T20874] smc: adding ib device syz0 with port count 1 [ 549.118005][T20874] smc: ib device syz0 port 1 has no pnetid [ 549.136062][ T5725] xfrm0 speed is unknown, defaulting to 1000 [ 549.142677][T20956] tipc: Resetting bearer [ 549.172561][T20956] tipc: Disabling bearer [ 549.183690][ T29] tipc: Node number set to 4215761608 [ 549.199291][T20966] ipip0: entered promiscuous mode [ 549.211075][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 549.217468][ T5605] xfrm0 speed is unknown, defaulting to 1000 [ 549.223718][ T4922] block nbd0: Receive control failed (result -32) [ 549.388943][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 549.505392][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 549.593024][ T8876] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.601434][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.625243][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 549.709674][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 549.785937][T20874] xfrm0 speed is unknown, defaulting to 1000 [ 550.071533][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.111864][ T6807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.191642][ T4922] Bluetooth: hci2: command 0x0405 tx timeout [ 553.271579][ T4922] Bluetooth: hci2: command 0x0405 tx timeout [ 554.072497][ T8876] net_ratelimit: 2 callbacks suppressed [ 554.072518][ T8876] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.086513][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.231815][ T6807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.631938][ T8876] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.640234][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.711884][ T8876] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.720216][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.728405][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.282869][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.312478][ T5797] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog