last executing test programs: 4.699572632s ago: executing program 0 (id=4161): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x2, {0x41}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000140)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000a40)='3', 0x1}], 0x1, 0x0, 0x0, 0x20000851}, 0x800) recvmmsg(r1, &(0x7f0000002e80)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000002c0)=""/200, 0xc8}], 0x1, &(0x7f00000003c0)=""/71, 0x47}, 0x9}], 0x1, 0x40010000, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f0000000080)={'ip6gretap0\x00', {0x2, 0x0, @broadcast}}) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a010400000000000000000100000a0900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a310000000070000000060a010400000000000000000100000008000b40004800048010000180090001006d61737100000000340001800c00010062697477697365002400028008000340000000040800014000000014080002400000001208000640000000020900010073797a3000000000140000001100010000000000000000000700000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r5}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="100000002b000b00000000000000000009000000272fb01abdede36661f89f7171f80f67318721c0f9786017d86d03099018331d2429a2f6e09836200004000000000000e07633e306f20ef556d42e88d90950a34fbe31ffa636ca3598e5f0eab8c97835fe5400570514b9ee6b462168c837a10813fff30f1241b02c9e0e929468c9adaa4b6e5e8c6d2db0c305a9ef464f2ffca21966461c83ed725e86934020d97d954874f49d588adebd7bfe3162064f31c8ef734ee2efa85f88783cf09ab7d7f9b5"], 0x14}, 0x1, 0x0, 0x0, 0x50800}, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000040), 0x4) 4.506090386s ago: executing program 0 (id=4163): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000}, 0x20) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000040)=0x20, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'ipvlan1\x00', 0x0}) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x1, r3, 0x2a, r1}, 0x10) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x109942, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000580)) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0xe, 0x7}]}) close(0x3) r5 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000c40), 0x12) write$cgroup_int(r5, &(0x7f0000000080)=0x6, 0x12) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0eff00000400000b24e695000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0x3100, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.01850281s ago: executing program 0 (id=4171): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000140)={0x0, 0xfd2e, 0x10, 0x1, 0x10000}, &(0x7f0000000180)=0x18) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000340)={r2, 0xf7, "1cfd3492a5aedf1d5d5703b2fb4477a2a396b275703fc6b2c76e51e61fb611f6ba8752d391801c1806910d3968918e2b617095e90fafdce4d85f0f4a718b62bb38e72dfc3e984bdd933554e96417fc02fd0fa07b21ed516229c4a8a519c458ee067f6beaf179a38b3141ce56c453116626a89311c9fac1f0764dd82f82513acfd7c0bef7833ef1fcb2fae3d148b936d7c0f11dc103fdd93883b9f8bc688d9b3c7d7e70096ae1ddf7c3fa207c2ed5cfaa086054c7c8819475bfeb8be5e88682d88e3929003f8841580c99f3510826091eb0e5a97141b1df76a3f8e3b9e8ab7e2f2e75e0b33fdabaf7b396dd5a590043b706178d7186d6e5"}, &(0x7f0000000200)=0xff) socket$l2tp(0x2, 0x2, 0x73) sendmmsg$inet(r0, &(0x7f0000003ec0)=[{{&(0x7f0000001180)={0x2, 0x4e22, @local}, 0x10, 0x0}}, {{&(0x7f0000001340)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001440)=[{&(0x7f0000001380)='\t\x00\x00\x00', 0x4}, {0x0}], 0x2}}], 0x2, 0x4000804) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x4, 0x3, 0x4, 0x13, 0x4e, @mcast1, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x10, 0x8, 0x6, 0x3}}) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r4) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="94000000", @ANYRES16=r5, @ANYBLOB="05072bbd7000ffdbdf2501000000680002801c0001800800010006000000080001000300000008000100060023002c000180080001000400000008000100060000000800010005000000080001000800000008000100000000001c00018008000100030000000800010001000000080001000100000018000180140002006c6f"], 0x94}, 0x1, 0x0, 0x0, 0x80}, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000080)=0x6, 0x4) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x16c, 0x10, 0x713, 0x70bd2c, 0x25dfdbfc, {{@in6=@private2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x20, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x3b, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x543}, {0x5, 0x7fffffffffffffff}, {}, 0x70bd28, 0x3500, 0xa, 0x4}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "217d66d38547aa140db8a200000000c538c7cb7a"}}, @encap={0x1c, 0x4, {0xffffffffffffffff, 0x4e24, 0x4e24, @in6=@local}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) 3.899624995s ago: executing program 0 (id=4175): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1}, 0x4) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@ldst={0x2, 0x2, 0x6, 0x0, 0x8, 0xffffffffffffffe0, 0xffffffffffffffff}, @exit]}, &(0x7f0000000fc0)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0xa}, 0x94) 3.752616115s ago: executing program 0 (id=4176): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x7, 0x4, 0x100, 0xf3e2, 0x28}, 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000001100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000040)={0x28, r2, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="f9b7b5acfe1e"}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x8000000) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x20000880) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r4 = socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r4, 0x8982, &(0x7f0000000000)={0x6, 'pim6reg0\x00', {0x5}, 0x9}) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.776561175s ago: executing program 4 (id=4193): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4024}, 0x20040884) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x0) sendmsg$NFC_CMD_DEV_DOWN(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x3c, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008005}, 0x40) r6 = socket(0x15, 0x805, 0xed9f) getsockopt$IP_SET_OP_GET_BYINDEX(r6, 0x1, 0x53, &(0x7f0000000300)={0x7, 0x7, 0x3}, &(0x7f0000000340)=0x28) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r6) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r6, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, r7, 0x100, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x35}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x25}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x6e}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x62}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40000) ioctl$BTRFS_IOC_DEFRAG(r6, 0x50009402, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xe}, @in6=@local, 0x4e24, 0x0, 0x4e21, 0x20e6, 0xa, 0x20, 0x80, 0x2f, 0x0, 0xffffffffffffffff}, {0x2, 0x7f, 0xfe36, 0xe, 0x7, 0x80000000, 0xa4, 0x8}, {0x9, 0xa, 0x1000, 0x7}, 0xb3da, 0x0, 0x0, 0x1, 0x2, 0x1}, {{@in6=@mcast1, 0x4d6, 0x6c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x18}, 0x3506, 0x1, 0x3, 0x7, 0x6c6, 0x7, 0x6}}, 0xe8) r9 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000640), r4) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x14, r9, 0x100, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x10) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000780), r4) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000007c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000800)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000840)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000940)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x64, r10, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_LEVEL={0x14, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x2}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r13}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x40081) r14 = socket$pptp(0x18, 0x1, 0x2) ioctl$PPPIOCSMRU(r14, 0x40047452, &(0x7f0000000980)=0x5) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000a00)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000a40)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x54, 0x0, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r15}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r16}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000000) sendmsg$NL80211_CMD_SET_MPATH(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x38, r7, 0x200, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x2c}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x38}, 0x1, 0x0, 0x0, 0xc0}, 0x20008001) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000cc0)="94ba74734ec8e71e7a044914a672f0be", 0x10) 1.732468799s ago: executing program 3 (id=4194): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000340)={0x1d, r6, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) sendmsg$can_j1939(r5, &(0x7f0000001240)={&(0x7f0000001000)={0x1d, r6, 0x0, {0x0, 0xff, 0x4}, 0xff}, 0x18, &(0x7f00000010c0)={0x0}}, 0x8090) sendmsg$inet6(r3, &(0x7f0000002280)={&(0x7f00000001c0)={0xa, 0x4e20, 0x8, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYRESDEC=r5], 0x5b0}, 0x20008001) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x275a, 0x0) writev(r7, &(0x7f0000000400)=[{&(0x7f00000002c0)="a6", 0x1}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x10012, r7, 0x0) sendmsg$inet6(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001840)="fa49", 0x2}], 0x1}, 0x20000044) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x44, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {}, {0xe, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x14, 0x2, [@TCA_CGROUP_POLICE={0x10, 0x2, [@TCA_POLICE_RATE64={0xc, 0x8, 0x10000}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) 1.634782s ago: executing program 0 (id=4195): syz_emit_ethernet(0x7e, &(0x7f0000003080)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @generic={0x4, 0x6, "55d759", 0x48, 0x0, 0xff, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {[@hopopts={0x89, 0x3, '\x00', [@hao={0xc9, 0x10, @mcast1}, @calipso={0x7, 0x8, {0x2, 0x0, 0x8}}]}, @hopopts={0x1}, @srh={0x21, 0x2, 0x4, 0x1, 0xab, 0x10, 0x52, [@local]}]}}}}}, 0x0) unshare(0x6a040000) syz_emit_ethernet(0x2e3, &(0x7f0000000380)={@broadcast, @remote, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "0fa56b", 0x2ad, 0x11, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @broadcast}, {[@srh={0xc, 0xa, 0x4, 0x5, 0x6e, 0x60, 0x0, [@loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, @private1, @loopback]}, @hopopts={0x5c, 0x12, '\x00', [@generic={0x3, 0x28, "b2fca3bcc039cacb49d0780c1dab4872133588ab315345331c8efcf4b03c5e3adcf36add1a06dbe7"}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @pad1, @pad1, @pad1, @calipso={0x7, 0x48, {0x1, 0x10, 0x1, 0x1, [0x1, 0x9, 0xb, 0xffffffffffffffff, 0x91b, 0x1ff, 0x9, 0x2]}}, @calipso={0x7, 0x10, {0x3, 0x2, 0x5c, 0x40, [0x8]}}]}, @dstopts={0xc, 0x3, '\x00', [@hao={0xc9, 0x10, @remote}, @enc_lim={0x4, 0x1, 0x5}, @enc_lim={0x4, 0x1, 0x5}]}, @fragment={0x0, 0x0, 0x9, 0x1, 0x0, 0x17, 0x67}, @fragment={0x3a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x65}, @routing={0x21, 0x6, 0x0, 0x50, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @dev={0xfe, 0x80, '\x00', 0x40}, @private1]}, @routing={0x0, 0x8, 0x0, 0x6, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}]}, @srh={0x5e, 0x8, 0x4, 0x4, 0x5, 0x68, 0x5, [@ipv4={'\x00', '\xff\xff', @multicast2}, @loopback, @private0, @loopback]}], {0x4e22, 0x4e24, 0xbd, 0x0, @opaque="48db51f211ed0be2a5027a12fdba5f26a7ccbbac41baad728522e81630e99e8e4cc1e845af787c03d1c02b1760f535c2b2683e14522271ee6277da5d4b3a1cb0c329673eb6708077475743c3140f2a1dc87fd342d67c42c5a74679d51fea448f0a9efd3c48217f53374f202d44afa6fc3b022af85ae124f39a2287923b38f23886cbe9ebb98fcf339a23218fcb0b56319335d61e88242a742b980c8793e77d8ab6c5d68ef702f7eb15a2140afad092361cfebeeb9d"}}}}}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) r1 = socket(0x10, 0x3, 0x2) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r1) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x138, r2, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x50, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x10001, @private1, 0xe2}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x9}}}}]}, @TIPC_NLA_NODE={0xa0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x3b, 0x3, "a37494a2c6a50bc7f748c741bd6638af1fa5524b4290d56573657f0c0d3acaa6487c51b7f84d1a24b38f017c53ebd404fa882cc2818ac3"}, @TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "5f730ca07b5ae49d71dec2abcdde948a6322def30754e2"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ID={0x17, 0x3, "deffc11882ca0704c43309b0bcf3ce5fc37146"}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x196}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x10}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x8800}, 0x8) write(r1, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) 1.452553953s ago: executing program 4 (id=4196): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4040000) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x40, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) ppoll(&(0x7f0000000500)=[{r2}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000440)={0x0, 0x0, 0x3, 0xfffffffffffffff9, 0x9, 0x0, 0x8000000000, 0x800000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r6, 0x8) r7 = accept4(r6, 0x0, 0x0, 0x80000) setsockopt(r7, 0x84, 0x7f, &(0x7f00000001c0)="020000000980ffff", 0x8) recvmmsg(r7, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x16, 0x4, 0x1, 0x1, 0x58, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}, {[@lsrr={0x83, 0x1b, 0x6b, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @multicast2]}, @ssrr={0x89, 0x7, 0x9, [@multicast1]}, @ssrr={0x89, 0x13, 0x3e, [@multicast2, @empty, @dev={0xac, 0x14, 0x14, 0x42}, @loopback]}, @rr={0x7, 0xb, 0x78, [@multicast1, @local]}, @ra={0x94, 0x4}]}}}}}) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x306, @multicast}, 0x14, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'team0\x00'}) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r4, 0x28, 0x1, &(0x7f0000000180)=0x5, 0x8) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, 0x0, 0x0) 1.452082387s ago: executing program 3 (id=4197): r0 = socket(0xa, 0x3, 0x3a) bpf$MAP_GET_NEXT_KEY(0x3, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000180), 0x0}, 0x20) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x4e21, 0x0, @local}, {0xa, 0x0, 0x0, @mcast1, 0xc70}, 0x0, {[0x0, 0x0, 0x0, 0xffffffff]}}, 0x5c) 1.403489438s ago: executing program 3 (id=4198): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000100001ff00000000000000000000000a2c000000050a01020000000000000000020000000900030073797a32000000000900010073797a300000000014000000020a031747d2140000"], 0x68}, 0x1, 0x0, 0x0, 0x4006000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) 1.241410613s ago: executing program 1 (id=4200): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@delsa={0x48, 0x12, 0x1, 0x0, 0x0, {@in=@dev}, [@srcaddr={0x14, 0xd, @in=@private=0xa010102}, @mark={0xc}]}, 0x48}}, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={0xffffffffffffffff, 0x0}, 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x190, 0x5230}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5, 0x16, 0x1}]}}}]}, 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x0) 1.17226659s ago: executing program 3 (id=4201): r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80400) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, r1, 0x8, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0xc0}, 0x1, 0x0, 0x0, 0x8080}, 0x44000004) r2 = socket$netlink(0x10, 0x3, 0x1) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xf8, r1, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4}, 0x33d8c476be693709) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000003c0)=@req3={0x800, 0x9, 0xfff, 0x10000, 0x98, 0x0, 0x4}, 0x1c) r3 = socket$alg(0x26, 0x5, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000400)={'wg1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f00000004c0)={'erspan0\x00', &(0x7f0000000440)={'erspan0\x00', r5, 0xe, 0x20, 0x7, 0x14, {{0xb, 0x4, 0x3, 0x3, 0x2c, 0x67, 0x0, 0x37, 0x29, 0x0, @remote, @rand_addr=0x64010101, {[@generic={0x88, 0x3, "a6"}, @noop, @timestamp={0x44, 0x8, 0xe5, 0x0, 0xc, [0x69d]}, @timestamp={0x44, 0xc, 0x94, 0x0, 0x0, [0x7d1, 0x2]}]}}}}}) vmsplice(r4, &(0x7f0000000680)=[{&(0x7f0000000500)="b6e415ef8f8b02edaf1278b7c3eb5b3f251754fb6f080ad7a86a73320bf4d338fa56537491d90a11e181b99771165404c1fa1c62c8c655da6075c8ea79d7fa29aee125a8a730d5c1671b1d18074de9503b2d38e412bd6676bf5dbc425eaa0d7c441a91919d7de977fa8ed16367da61f380c48671170b606603771f368076033cc5e41d4178e58ab15232dc8ef48dfe", 0x8f}, {&(0x7f00000005c0)="296de2b2d75c3de054d16a6a77a891011d9c8650e0eae6344b099bde6e2a0a208127c5c0f7abfd012791b91df61ca32c9513772d249e483eaa097e04e733e4238965cd6bfe6f3365392bd2240e7c67270c24d7e8196bc15691ac19da63fe1e1331", 0x61}, {&(0x7f0000000640)="758dd8ceb4b2d223", 0x8}], 0x3, 0x8) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000700)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000740)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000780)=0x0) sendmsg$NFC_CMD_DEP_LINK_DOWN(r6, &(0x7f0000000880)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x44, 0x0, 0x4, 0x70bd29, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}, @NFC_ATTR_TARGET_INDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0000}, 0x2404c040) recvmmsg(r0, &(0x7f0000008b80)=[{{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f00000008c0)=""/79, 0x4f}, {&(0x7f0000000940)=""/114, 0x72}, {&(0x7f00000009c0)=""/171, 0xab}, {&(0x7f0000000a80)=""/195, 0xc3}], 0x4, &(0x7f0000000bc0)=""/179, 0xb3}, 0x3}, {{&(0x7f0000000c80)=@rc, 0x80, &(0x7f0000002080)=[{&(0x7f0000000d00)=""/251, 0xfb}, {&(0x7f0000000e00)=""/4096, 0x1000}, {&(0x7f0000001e00)=""/165, 0xa5}, {&(0x7f0000001ec0)=""/255, 0xff}, {&(0x7f0000001fc0)=""/132, 0x84}], 0x5, &(0x7f0000002100)=""/230, 0xe6}, 0xa}, {{&(0x7f0000002200)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f0000002340)=[{&(0x7f0000002280)=""/178, 0xb2}], 0x1, &(0x7f0000002380)=""/4096, 0x1000}, 0x1}, {{&(0x7f0000003380)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @initdev}}, 0x80, &(0x7f0000003540)=[{&(0x7f0000003400)=""/237, 0xed}, {&(0x7f0000003500)=""/53, 0x35}], 0x2, &(0x7f0000003580)=""/4096, 0x1000}, 0xf879}, {{0x0, 0x0, &(0x7f0000008880)=[{&(0x7f0000004580)=""/4096, 0x1000}, {&(0x7f0000005580)=""/4096, 0x1000}, {&(0x7f0000006580)=""/4096, 0x1000}, {&(0x7f0000007580)=""/86, 0x56}, {&(0x7f0000007600)=""/4096, 0x1000}, {&(0x7f0000008600)=""/234, 0xea}, {&(0x7f0000008700)=""/123, 0x7b}, {&(0x7f0000008780)=""/221, 0xdd}], 0x8, &(0x7f0000008900)=""/2, 0x2}, 0xc000000}, {{&(0x7f0000008940)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000008a40)=[{&(0x7f00000089c0)=""/113, 0x71}], 0x1, &(0x7f0000008a80)=""/254, 0xfe}, 0x4}], 0x6, 0x2002, &(0x7f0000008d00)) r10 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000008d80)=@o_path={&(0x7f0000008d40)='./file0\x00', 0x0, 0x4010, r2}, 0x18) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000008ec0)={@map, 0xf, 0x0, 0x4, &(0x7f0000008dc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000008e00)=[0x0, 0x0], &(0x7f0000008e40)=[0x0], &(0x7f0000008e80)=[0x0], 0x0}, 0x40) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000008fc0)={'ip6tnl0\x00', &(0x7f0000008f40)={'syztnl2\x00', r5, 0x29, 0x1, 0x7f, 0x6, 0x40, @ipv4={'\x00', '\xff\xff', @local}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x8700, 0x1, 0x9}}) r13 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000009000)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, @void}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000008f00)={@ifindex=r12, r10, 0x3, 0x2000, 0x0, @value=r13, @void, @void, @void, r11}, 0x20) r14 = syz_genetlink_get_family_id$ipvs(&(0x7f0000009080), r0) sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000009140)={&(0x7f0000009040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000009100)={&(0x7f00000090c0)={0x1c, r14, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9610}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000000}, 0x40) r15 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000009180)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000091c0)=@bloom_filter={0x1e, 0x4, 0x8001, 0x5, 0x8, 0xffffffffffffffff, 0x1, '\x00', r5, r15, 0x2, 0x4, 0x3, 0xa}, 0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000009240)={'macsec0\x00'}) r16 = syz_genetlink_get_family_id$nfc(&(0x7f00000092c0), r6) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000009300)=0x0) sendmsg$NFC_CMD_DEV_DOWN(r6, &(0x7f0000009440)={&(0x7f0000009280), 0xc, &(0x7f0000009400)={&(0x7f0000009380)={0x64, r16, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r17}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x91}, 0x810) 1.163705426s ago: executing program 2 (id=4202): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000002000000000000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000100000085000000060000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x18000000000002a0, 0x14, 0x0, &(0x7f0000000440)="b9ff033168440372b89e14f00800", 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000600)={0x0, r1}, 0x8) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={&(0x7f0000000040)="b64b6779e728a585fc6d831c9c111ee3bf867c7fa20663508d961b5b0bc1d4eded804b84c8ee0b5e7b55af44aa8bf4a16c4d4aaf896a13f650a3b4f737945a9a179a6ceb93adadb8dd841258d0f04b02868cd415ab9bc48b055a8b3f92b143cb16138c216513a045af2101e7e3c507bedee404330f1171812cdaeed17a0e89", 0x0, 0x0, 0x0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd33fef29588362bc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000700)=0x10, 0x80000) ioctl$sock_inet_tcp_SIOCINQ(r4, 0x541b, &(0x7f0000000740)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f00000004c0)={r6, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r8, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r8, 0x84, 0xf, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e22, 0xffff0aae, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x8}}, 0xa8e, 0x3, 0x455e, 0x7, 0x9}, &(0x7f00000001c0)=0x98) sendmsg$nl_route_sched(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0x0, 0x2000001, {0x0, 0x0, 0x0, r6, {0x2}, {0x0, 0xc}, {0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4010}, 0x20048014) r9 = accept(r7, &(0x7f0000000500)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000580)=0x80) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r4, 0x8983, &(0x7f0000000780)={0x6, 'batadv0\x00', {0x9}, 0x5}) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r9, 0x84, 0x4, &(0x7f00000005c0)=0x8, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)=ANY=[@ANYBLOB="4000005c29e4e400000000000007e4", @ANYRES32=r6, @ANYBLOB="14000100fe8000000000000000000000000000aa14000200ff010000000000000000000000000001"], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x4000011) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a0b04000000000000000002000000300004802c0001800a00010071756575650000001c0002800600034011020000060002400009000006000140000b00000900010073797a30000000000900020073797a32"], 0x84}}, 0x0) 1.047529377s ago: executing program 1 (id=4203): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000180), &(0x7f00000001c0)}, 0x20) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100), 0x4) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0xfffffffe]}}, 0x5c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newtaction={0x64, 0x30, 0x9e54f29ff072a93b, 0x0, 0xfffffffd, {}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x71, 0x1, {{0x1, 0x800, 0x3, 0xd, 0x6}, 0x29}}]}, {0xfffffee7}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x81}, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000140)=@generic={&(0x7f0000000080)='./file0\x00', r1}, 0x18) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f0000000300)='GPL\x00', 0x5, 0xffd, &(0x7f00000004c0)=""/4093, 0x0, 0x1}, 0x94) 957.857151ms ago: executing program 1 (id=4204): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x20000880) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (fail_nth: 3) 897.725539ms ago: executing program 3 (id=4205): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) accept4(r0, &(0x7f00000001c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000380)=0x80, 0x800) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r3, 0x1, 0x170bd2b, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x10}, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x5, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000440)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0xe0, r3, 0x800, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x48, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x776}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x369a}]}]}, @TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3ff}, @TIPC_NLA_NODE_KEY={0x3e, 0x4, {'gcm(aes)\x00', 0x16, "f30f05b3fbc6dbb6e136be7320028755de76adf778af"}}]}, @TIPC_NLA_LINK={0x38, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x48090}, 0x20000011) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x20000880) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x3c}}, 0x20004055) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000200)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) writev(r6, &(0x7f0000000900), 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000640), r4) sendmsg$GTP_CMD_ECHOREQ(r6, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)=ANY=[@ANYBLOB='?= \x00', @ANYRES16=r7, @ANYBLOB="000328bd7000fddbdf250300000008000400e0000002"], 0x1c}, 0x1, 0x0, 0x0, 0x20040011}, 0x20000080) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) 784.243776ms ago: executing program 2 (id=4206): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x94) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c000000021301000600000600000000000000000e0003006269746d61f03a6970000000050003"], 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x63, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, {0xe, 0x3}, {0x6}, {0x4, 0x8}}}, 0x24}}, 0x40004) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r4, @ANYBLOB="010000000000000000000100000008000100000000000400048008000c8004000b800800020001000000a00008801c0007800837d73ec300000008000600000000000800050000000000240007800800050000230000000005000000000061ff05000000000008000500000000"], 0xd0}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c000000150a0102"], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 640.673911ms ago: executing program 2 (id=4207): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22}, {0x2, 0x0, @local}, {0x2, 0x0, @broadcast}, 0x87, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x10000000000, 0x5}) (async) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22}, {0x2, 0x0, @local}, {0x2, 0x0, @broadcast}, 0x87, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x10000000000, 0x5}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r1, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r5) (async) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r5) sendmsg$NLBL_MGMT_C_ADDDEF(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="0100050000000000002b90183f3d271f584a64e6686336f4a8593a5eb8dfdf65fd79669500000000e0f03ea39aeed907581258b7676c6b9f7ddfa487b53fa8a82186fb21763db78d7b566abea75dfbbbda12172d00d057c0404210ed24ef882fe6733cbe9a726b8b8843c6d8e09ec6bbfb761a422f2efb"], 0x1c}, 0x1, 0x0, 0x0, 0x4044040}, 0x8842) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000f9bf1c22000000270d5804ac9f3eee00100000a8d12910610838f7b55cf53b1a81c1ff0bedb3c7f819a79f5e50643c3aa18a477af1cc8a3a2947f73f384beb2d135d56bf4e891499f7e7c5c8d2b910dda1b6e83bd9cf443366af9c824aada6cd77c8ff2187a93f41a645c61088deae8d91842e2c4f77dc7932ada2f9f5f45d3db9a5fa26da3e08d5ec0aa41ab5c20434a000353bd3"], 0x14}}, 0x0) (async) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000f9bf1c22000000270d5804ac9f3eee00100000a8d12910610838f7b55cf53b1a81c1ff0bedb3c7f819a79f5e50643c3aa18a477af1cc8a3a2947f73f384beb2d135d56bf4e891499f7e7c5c8d2b910dda1b6e83bd9cf443366af9c824aada6cd77c8ff2187a93f41a645c61088deae8d91842e2c4f77dc7932ada2f9f5f45d3db9a5fa26da3e08d5ec0aa41ab5c20434a000353bd3"], 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x16) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x20, &(0x7f0000000180)={&(0x7f0000000440)=""/127, 0x7f, 0x0, &(0x7f00000000c0)=""/5, 0x5}}, 0x10) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x20, &(0x7f0000000180)={&(0x7f0000000440)=""/127, 0x7f, 0x0, &(0x7f00000000c0)=""/5, 0x5}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000ed1900000000b703000000000000850000000c000000b400000000000000180100002020702500000000002020207b3a48d484c91af8ff00000000bfa100000000000007010000f8ffffffb7020000080000003f0000000000000085000000"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = syz_init_net_socket$ax25(0x3, 0x3, 0x6) ioctl$SIOCAX25GETINFOOLD(r10, 0x89e9, 0xfffffffffffffffd) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r1, @ANYRES32=r7, @ANYBLOB="01000000020000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1f, 0x1f}}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}, 0x1, 0x0, 0x0, 0x20008800}, 0x48004) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}, 0x1, 0x0, 0x0, 0x20008800}, 0x48004) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched_retired(r14, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000b40)=@newchain={0x314, 0x64, 0x10, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x8, 0xa}, {0xfff2, 0xa}, {0x9, 0x10}}, [@f_rsvp={{0x9}, {0xa8, 0x2, [@TCA_RSVP_POLICE={0x9c, 0x5, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0xe}, @TCA_POLICE_TBF={0x3c, 0x1, {0x81, 0x10000000, 0x5f3, 0x0, 0xabc, {0x40, 0x2, 0x3, 0xc00, 0x200, 0xf}, {0xa7, 0x0, 0x10, 0x40, 0x81, 0x2}, 0x9, 0x5, 0x218}}, @TCA_POLICE_TBF={0x3c, 0x1, {0xce48, 0x6, 0x3, 0x3cb07822, 0x3, {0xd, 0x0, 0x4, 0x401, 0x3, 0x800}, {0x1, 0x2, 0x7f, 0x0, 0x5, 0x4}, 0x800, 0x8, 0x9}}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xd5}]}, @TCA_RSVP_SRC={0x8, 0x3, @loopback}]}}, @f_rsvp6={{0xa}, {0x24, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0x0, 0xffff8000, 0x80}, {0x99, 0x100, 0x81}, 0x33, 0x2, 0x6}}]}}, @f_rsvp={{0x9}, {0x200, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0x5, 0x601}, {0x9, 0x80000000, 0x3}, 0xff, 0x3, 0xf2}}, @TCA_RSVP_ACT={0x1dc, 0x6, [@m_tunnel_key={0xc4, 0xf, 0x0, 0x0, {{0xf}, {0x80, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_NO_CSUM={0x5}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @private1}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xc8, 0x359d, 0x6, 0x4, 0x2}, 0x2}}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private2}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @remote}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x8001, 0x2d6, 0x1, 0x10, 0x101}, 0x2}}]}, {0x17, 0x6, "e1878f04331ada8883a4ac7694123c27874660"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_mpls={0x114, 0x1d, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x389f1}]}, {0xe0, 0x6, "8fa8840436cc59c3ba5e3364cfa7a7105e063b00c06d2eef3b002455fba38ecae7211e2eb54b360d8c5d8423385ded823a8e0e430c46cea54a32bfb02e5be1a6a8ddc137069c232f43ab80426a00d83961b1d576498159bd2bcac0415a73214142d99534e7f85f534a5a917bb822ac8b829604a2573dc9abcb612430980515027a328690dd3a01745d1066d9225222e0857a9209f431f72a8097880b11ec8570088f25721ff18caaed7f99f663dab10cbbf2e82b2dfeabc1b1806eb97d62412e95df50d874e50d6508d25c7981d1d052c30515a99af66de14b22fcd9"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x314}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000040) socket$nl_generic(0x10, 0x3, 0x10) (async) r15 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x22020400) (async) unshare(0x22020400) ioctl$sock_SIOCGPGRP(r15, 0x8904, &(0x7f00000001c0)) connect$bt_l2cap(r13, &(0x7f0000000000)={0x1f, 0x8, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x62}, 0xe) (async) connect$bt_l2cap(r13, &(0x7f0000000000)={0x1f, 0x8, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x62}, 0xe) 460.505111ms ago: executing program 4 (id=4208): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) (async, rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x503, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}}, 0x0) (async, rerun: 64) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (rerun: 64) sendmmsg$alg(r3, &(0x7f0000004180)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000280)="fbc6a5886e8a141b4321b588bfd1adb3be4d7711b451dfece9da7d75d7d2c022f366af2f6d065df8c726662a61b12a668e76b98014a4b56def2960", 0x3b}], 0x1, &(0x7f00000042c0)=ANY=[@ANYBLOB="18000000000000001701000004000000040000000000000018100000000000001701000002000000001000004cebcc66bcda6130e71159ad6451a709568416165f4984b20b1676f2865076521aa2beeb997a5a7ccccb843988d1ae47095f5f9ae6b6e5baccc78ae56bdab703e4a53beccaa2f63a6954737b533a9a2624ac119cdeba2066c6b6c6a640b2639c9b776f2e1a10892556283de120231c411051a96cf084094098a85e46401006ae68f85b170c077e362ea279e870233cd311588c1b96f37d838aa5388b88b6a8073dbab8981b7babcb4aab80a18cb5b500eb284a3ef88ecd43ca31d99f843a8d09ec19da733ca3256af7aebcf404e2349ac14f5d5aadea35717ff86535b390bb6ec2461a319b1b98837b814112f101b3b491c5214686c8ba3ce34afbaf3757cdf18bf25d570f84d7d64ac37cac7de74089bf097468d13cc58093d5dc6d8bfb4ea70ac1d188a8f0c31f45abe464cfc4938523f24f56d70e22c369bb9574be734a68bb415951857aa75d2123fbe3b7955bf6a416d89949b127765a5d88234b43f69243b0c3db960bf46d70c52e451251ef1c6f1f95e8acfdff94f796f109b5038311af763adcc2df039e90f52a7429a42a34775a574fbfb74695f0677c26b7ebbea95e831a2180ed731ed1fa74578decf50d0a8713995bb9aba0d9e6a070431b07eb44652d5d8f748da1960d1f5cdcdda7bb40c71b26ec9787ef57c239b3a6e1c678d882bb5b3db9df0ad2044bb42491e1912a96c8f0753a6e95fa829fc67a85b58fbdf3e8e2781f04343fff44a46848533f719c069febdac3c61245892234eb7254a5022b2af1900e72335222547e3f4c2d94f49c4efe80c28442381193943dcaf07dea18b68038bf4d29f8314ff4d218ffd5ab6bba7409815e668ffc295ba1b8a7e1707d9573abe20f88b40bed75f24d4c1759c723251bbe0083e6b7b49688a30abf2e0a2e63077acc5f7cd079db634b8c700e102193a89ad0651ada954fe0a70ed9b24721f1b6f2b0ea63e2cf605112e2566f1ff8dba15339d598a1b40af089908479b62daae4de01c916c7c1945f5c183ceed11ee298b42549f4545f6de38c10b49bdf282d6aceb591d1aba9d6e2b4d8d1659d524fba3c6ab00a8fd36acc991e4ce22fe36c2005b8417a232c7c2f85a1b70732e1704563cf65189ec9dff65240584c1042421144ba75cf3a8e04698633a4025dd91526028e6a9888d6e43aae0f74af25386a96043e05844b039548f15bb69e319f7e3b75a29724a869a6c2c4a3f232037a3e4be0cc21e33b7a119b2a77b156d84ed2382b76e4652296e9c39a580ee9e26f13e93b03ab684b8778290dc7fc0e84e23c85cae487f4f08fed25cc06cec95f969b3b05bbf460fe912baad74b25b24b90d3192d4c0d73872e1356e455931a4bb604cf0ec3fe03ddb305f90df8b01962622baa78d698ba207cc417700b8e77cb94fee537451b74697d039717036a0bea9fe07400be1d0ef76294958c125ceb861d3fc2d90e6524621dc05fd9a4a65f7b8a9c17c1df9fe2eb6647831aca06e564c255fee7fadd85757ba687b292077472fcdaca009c7cae82e06fcbe15fb6605e9a92f430d492b54cac68c6ccd8a63da09a73d82cfec0a54ac5884bd7ae4f9f81a9be836fb4a1dcc910b2f9013640f8d2ee550212f311aa05706684efd07add81cadfe1ab5ec807b9a1d536f12e4cab38e0f0d66d7d3cbdfcdfc4431a8bb115c5051afcd3f4dcb943e5620525a1b23983d3a01d996b4af08a5933e352b9bca247bf3bb528b6011960fc2060a3fcaf5a3d70d2c2d092aab5b8743ca903cc27bb48c56aa676d7536934fbe00fa4e11a9f985e3c98b69c60f50ab85eaba5f1b5b12ddc55d224eb2200de58b4a778e2827ce362be93fcaea706d96c0e49f05e1e5c8d266e7b198af666a37fc6a49b57b8d703475b0a2430ef31e4e25e3397662ee69da067a880926d285759c324a4b2c553b2ad54cf5ee1df2289b67901e418bbd5200cbb79916d79e4d1c7f40eec8fb68280f2ef2253d5cc40a5a807043a5a82513b14ff99bc87c24b390ad9ecb894d2d7b796f0e26f15f750de9edb844566de72e3a276f414730287c19128b59fd029e2b544408f9f6b198522e9a727a918d4b5b4c21f80e9ba4e866a9cf55e5b041095f11af8662b0d1b24af4ac0bab8b1e592ca515a0dc57cfaf53c309e4a7000dbab9d844b358bfecc43f92221ac1672ab793534994253aafd5e87356336f7cba3014200f6831f325ea92ef1ae98fd0bfcce32e731cd56fab285b9df651b42a07780beb9d0e652b24516e2689737b029ce836c012c924f3fa558afe8797636027119867d1468669da0658aecee4f36009d4b71f2702ddec306423f4a1652a58a783760bd247d593050644b194a0ed8f2741b45d5f0d61c305b41bc4c2fb99741cef44e15df00353936442ca9d6ba4b6ef430714a8a21b701cb43fd4664a85deca37e0d577ba2f3d5184d4c4adc0064ef70aa8c73c7b0444147e296d4e3a95de910a7a409c53274fb6554f6d020e52ed5e2915fd1fba3c5f415d5c58580b2e9055d1d72ba27c78b013af7d50074b8d52216a0b1b8811e2968b80f295b28474ec9ab2e4dd55233ad9d9b87b7bb19b6efb36eebc07eb51f39204bbfa64e525295ac653a3f04aa025f01b06af9f68969e7695cc046295f47bea51b7a12c2773b18cac867e2a999e32eaf35af110d941f68ecb49ff6db4f3953889d7ebd3e936631b97c81ad30856cdc85c9dfae4d9406b1c3e6065dce393d074f97f3e411bde66591ca7762a0df14070b613f241a7fc720c6286c95b5bd5f92a3618d9eefcd7a6d10c1a7ddc619e902972355fa764748c018c1c48bc8d00d106cb9ea144158c98f1a72f09c7c961a861182ed8a9dd91d04df3b4bbca4a281b936479f5ecfbdd87901ac99274fb36bb9bc44f373a109c618c87741c0e9af3c3a8d88fb88fdb61489ff05cbe4f248208942eddbf9d082d15f237f5ff16c563bedfc240523ac1a74baff485f06b9e5e12c5545fb0966090a037a3f308b99126f7e5af7ed9b9740fa6ac215f945915eea458ae9159d346f8eadc344fe9c7bebec8d2b0dbde475438beb0bedf79fed5f6e6cb232cb706cd790722e87af69dffddc668f0a83bf1469d6a62944a5bf2db58bef4d66795b7b486e10341436798f322f54ac6410289d91b6ca91e0aee9aa1e24fd3209ec798c3e047b0a5c32994ef4f7ac08d9639f10c9edd3394f2181af45293d60d104045e4f30bb0436b7c68d53b24ae1533e39ba57715fd2d489619ba4d8bbef7b7348348a09466e311ee3b1716b6c85004239d74967b2bb4784983b8ca21253dad54565fd1a03f9a9923faca38c62d12583b0dd7ae0bb70ca2368b69eca3753501ad64492484a9d91a831015caad5412a0a808a18f3106198b1eab3609d70b851ccee1050151c8163c6b1c6b08752fe9a1271c57cbd5758f291d3eeaf988a28b3c578fe2b333f59f7ae75550c988fb871d81ac2be6c3dd768c6b413e25ddd17f9047a487d504002e98acf1f7573310bc7793cd3b66038d89bf7df127261de895b751ebdbdf9a27e30d68a39e372ad9ab1c62b0cf370bdf78c0a631ebad17d76e887b133167ab1ba3fadf0bbed4d79d554b516c145b5c1867c9857a5a15bbeab217759b9827737873f693f1ffb367c1d7d196215aef71908150fe5fd9b730290dafab881200a7f747fd24d69489c0fcb3eef169d2f8d3576e9460fd5c6299de4beb02089fb7ebff7bb86c80b3858017ef2afea941d0b49f736b8f8e56c16671a359dac8a5131bb88a2599a9af09a2bf9b4dacaa424d914224c48b8f9e73aca40d994e3f497dbe0d7b7e3fe2a2a9c95ae2ed7729273e53388b9fd675a3639eed4b37b3e24cdc2e77c08f45fc68361b7d504959bba42e81356fc2e1c2d0abbfe1a2064aeab6263237dd73773cbff008dec4640ea6248a8059076d0c4e9a85024df662132029d659e45a7f5ea60fb216088faa79b1a0abda3f660ffdba547dd9ae04eb0315e3055e9d6bdf5288ad5f50722bc4a15ea704c08173628135d43f869850af6a6a0192a02763bae5dd9f5477cdbf47a0a826ef343cf960182939286fde0d0424d66ceea916c2db0d36288110bf022f86a77fa5a5193801c216ce4f3487df13ae3759d64797b161a6a6950d99b675c6e75f5f104ec030c3a94273d02ee06cff940c8bf28d3beb48cf45c86490cefc389715dd4534cabfb209a9df561f0e6c9051c04dbbe82c430eaffc4050b7b18df33065717dd23802ef2a8c064f31a09a1f2a5ebd05f69771caef4ccb55db9982c922a2a69babc160eaa2622638a2840b1bf3f16958801fd3eeb25d182380896b880e4f06fdb3d070c5b09ccbdd8385a8c74f0196a4bc08c802f1e501978e962598b84e8bf682e85cd9d089aebb37f6398da07d2e413cb39eec062f7cff1921a4b35039a10d7228f819ecd18aa72be6562a5ae21fc20ae837d86bd70e00c5b5296e604931b8f710e04855575bd46bd2d677bb2edee32e290fdbf3b1ca36011c6975350926db76c8e8afb1805dc526a766115ef95ff71786cd55aa4ddc44dce2cf5e5966f55f59ebc05c362bb85232eca9fe3136ddc934a0731c32cd2f5f7dfe295b499391025b5b97d29cf6cda6c25b0b68bbd5788d365c5d9c98d985b90edcee46c96c9c5e581b6bfd5a8dc07809d922c0f86c1064a9174fa0dd550bff93957182452b3fbc911bbfaa6455c0a700dbb11f7a4b1b3575745fc6c228c2e75ae3def282f33027ea1bdbb9d5c280b17930ac70737e64ce3e505bd4068089a799fc5a4823c507ae9a3410ab3aa0a47f4d1f83c7e38a100af1dc9856bfec8390bfbb80dfebfb9dfa0160e82582c044d7becaa03c84534e805662e032d0f2a6b49d511efffca227e8a1bc56879777d662339f74a19b9101c7f150ce61bbd3df46abc702da83de8d40d4d592d5ef16c975e8943400f6e58ed3663c22d9f6e434b655ae761cb6dd926eacc911450c30a5b0ec72d27ca24533010c63e74d01d7829379d89a0cbd4e792204676d3821f2b81ae5b75d772006ef0ca9b4996bcc7243456f298a43643b4312e26136f601c9e6d5a1452f58c9494aacbb1afdf035c34292d717e8e42a5fa6a4b678689ecee184fbc8fd6d78638a42c8780487f4f2f9514ff926bf5be6bb0691286c4b0c09cf231a0a008f9f4b0e363cc92c3b95185e498d2d97ce6e22c30842d424f8b8979206fa77c3eb629258e38bca17265872dfd172a049f2c973da0a9467d37de453687b0049d168b33cb0cc7fadeea2900537e4f4a36043138da1c08ec71a8273150c1d80541deffaf460a007f800bbe90049f8e937e37c6be952cc8ce43bf14c48672d667f4cbf56650c24fe43089be7ccc76f74941aabe24896070d371d8040b246e0b97ee0a182bc6eced6f72b0ed34970ec0801fd3e2accda44bb4176a768ca25e938a4b9055a9faa56fb75254de0f44300b4aed5f59264fc067a0c2909274b7f66d395326380b6b756745b78d363f1763bcc65fd9e51422b594138c71922357dccf22b337ea317cf301853422c5cb1ad276d797949bea37e188728c8e9d4f0a9d801dd222fed484b395481b67324faf55b05c3119a8a65de8349ac9b45e1141a54d6d6efce7821c4874331462737eb0ce8390cfca33d9453ceb84264fe142a164b08862d8b55fa8841b45d23a8a7cc4cc8fc3586d3395454816c231164a2f6a188ccba6bf6c5af9f99360edbaaa990235f9329930418bc47835a6e085e057f3c14919d8c8071cb255139bfa3ac8a00fdea12e6c49c460e35105badbaf764509e4cfedc4ee71ac5cc20000000038124f923b4fac0467e4c1d76647995a33a5cf85117f41726deca042cc2abdb7592cdd2d8d5e7d57ed437135bb4dca7dc554d7666348ae23669cb82ecd84cbf5a12ad3a67eb11920b9ec579211531cc23fa0cad47db25f0896e479edcc72e4f4323b"], 0x1030, 0x8004}, {0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000340)="297e797fd12ddf3661afede12d0bc3f3f20df3fd", 0x14}, {&(0x7f0000001d80)}, {0x0}, {0x0}, {0x0}, {&(0x7f0000000900)="fc5dac1862c19466a87ad96dd8e6733ca130f1d23281983e4958bee165f25bed41d533552cf926e2328b5f53903a9432ade146449dae6815", 0x38}, {&(0x7f0000000a00)="d3270074e3a952234c898618733f743caef59645a3051a659ec02c9c31dd6739c1679ba2ed51f484d222be9dc704f8e3e6d47ce52454587d02e7240f7e4278563ada3d7dff3ad1696306b1f7bd9ef7034f787d54e95262b12707ad6b0245e663effbfc6bdf67ed2663631b8187cee5691ecee7a8da6b8f31d9a7c2da42b6ef9deaee234940d413ea8dd235445b518c2d9cc93a9017c273c7d9c6a8446a9b0bb8273bc81e3bedbd30b304c8c28713a42f35699f38ac890cce6262543ef87e245af92829d70fbe63eff66e96", 0xcb}], 0x7, 0x0, 0x0, 0x4000004}, {0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000bc0)="781304bf74068d012acad51e44e32ec2634ced568e6c82ce03f1ded0405de6579dc80713b9d96db31b2b70e8c9e84240b246d6efdb5a2a8dcab2edeb8913e02a283ba21d6c54305fe53eba93538550227fa5743f715df1867447c4b7d56179c96372c8b5072fa62f8d8a3675c9abca395d2c1ac2269c0ee812978544a027568f89e17663f9c36b065afcb971da9e8429c4fe958c535b0eb5ee1185fa44a4b0bde78db2abc9ece103b5680161f3642e3754da3c044a554565c790222748508bbec30777dceaca77f4881bf5091d6109aff9fd7063c1eeebb39a1baf7581efde944b0d", 0xe2}, {&(0x7f0000002d80)="b91e84c967d5615c5516f453314ecc238b97b5df3b4e4def440d0a12a5ae4e84c3adff92bc3e7ee9d143bf5f5ceccea92187485301f64ed857f5cb7a305f7e1f236341b1b6a084c623d120490b16ead2ef06616874fb1e832784583819e659bac0083408874e69961cbd17d082efafb316e08d3a8f21b44bb1ab813f", 0x7c}], 0x2, &(0x7f0000001180)=ANY=[@ANYBLOB="18000000000000001701000004000000000000000000000018000000000000001701000004000000010000000000000018100000000000001701000002000000001000001e6ad33cdebb21fe96d13394a4ceb3de9111c18efac40f5df540d868edb1dda7fc20eb9fa8b8024bfe01d3d7785fb1c5f5dcfcc614c2aa58dc63797f16c66f5aaf91aa8eafc15ee8d9bd5adff64b5247d21db55b852f82e2c7cbf390ab573db581a56ee03a43f448726e58ba4569b71afc4356c7b0e9e71e7a839c9ce553f915d2dc459f9a88052da4d2659235fdd8cf96e73d690e7abaff201062377c16424f6df73a7c208de790a97eb246c297eb03c9f7f887d15c4f668feeb37f8b5bbe8d014404ae558c03795d40ac522985255e41893b44cc172f3877325e0d79951a4d6c99f07d0a084eeed17773180cff362ad54163b541180b5810ae66977a740ece2d3b06bf50647dad071616b6575ebcc0843224aca991d74d6f7f9b1bd7e580f9b580ed1bb8888fc14ae1c9eb4817d9194a1a8d3fcf079e4105915559289bde573a344d5ab79a36f11c9338daf8df29e1226499da34de4fe91f4f8705a92fa87e619443526a6d4219680b6c1be73ae01e2be59f314c409ef101e448f63f6e2db5b08896b2d665d8f9a474c7404da23b87c77da532819e3d6e2f06c6c9c16d51b20c9b3192af73414a214758b2c33ada49c64ae205f315150386b39c144f7291e9742db9e67284f76a160570a35e20a6cbed38c1bdccda566b4fbe9c02691ed957ac0dadc6db82f66a86c421a21b83a8c0fcba1eb42b0a9a0b2c4f60445bcb5f9317a4eb843d896c0d4e5f87bd8d45ee3f2dab5b29239115344e8bdc398877a7c7d66e0413b20af94b488d02c39f301d99df0e3bae24ed901710b477e5a95fe85b08f9cda3205d412d62b9dd0604a9dac3cf8e01e3d573c37cc775053ff9ef5c484bf6a0779656dde6ba52e32cd35c0e399023233e1779cb375a407459ccc4e2dc3f178447ea4e8b9cf3d5bbc155f0342291ad4eaa7580beb45c1df3dd06bcfdea18720b55f3df86172c89e5bc1413b423d0c1f7b7c23156081514d8030901ef5cef342b1c49e85d8871de6ee17d078c8d2ccbf469d05aa371edb2a156f7573578a732d75c46d207fa3eb451d2ff41ed703eea77bb409681167ae8fc9eb95dd216b736363e42139a4489df9523dc47cf288a0f2bbce18cf0fbfc02df13184cd3f0843259b1b5270b7375fade06beaed6e95111b3d12ae243717ea79b7b59ba7e8932d08b45b672dc618e84cc83e5df8abd9d6baf0ebb2bb552dcc851577b137807ffd54e52485221cb93de2c5c9db6b0e17a70a24a096da34d65566dba125455c3ba7e3fdbc6a63b1518242cbd71a5dd2df6cc56544e888f912e482ee35c33476e57df070545ac71da4795f8ecbc309d204fb24c403442c8a666b38e8febbd9216b813136125044bbe14822fbf3eea1f1b418e66775ce7d95f6cbad4ad50abbc3d15c27dcacfa85347e6b5f2eef832dffdf64d6459fa84413601047d124050f4f90b707c262f82e1a25ed39bbfd893a79960993c2953581620f726f4e5956d30445644f69e41d8f706006ca53d33be18c12845f0268b0b925a3212fc4724980582f7fed88f53214dc935a04ab6ff017a7a445085b650517e08b1efc9284f4472a16288f0ed98273803b16385df9d6a52a6b35afe71e35e876f566f17b4d4447d86507f83555403b9ebda67190deb2fed35d1f52c63c956bd4cca900ad51c5a00e627c47076b190b6f24b0b4f338d37f717fd59c3dc79092939504cd4f1dc1979e916ef2ae396122883f849e062ebf9f72339db522adbf03ca5ff88dbfb8420c65f32c5d651c5e784cd34277b2a9e84ce4eea646df34b8e5caf65da92f9aaf51cf87001a25838819b6dbfe7c19226f474c4bb02273f58858bf7b736d6a5c0c8ef96ce8bb58512b1e088ff650872ec22fb5d0f4aaec6f8e44ae5b9a2c39c956937bff400a136f89306d00e84e4fb881208436c6eba1925d538c8b2313e0313d21732b17b8fc7caea9507e84713a5701f6dfdb18d45d1798823350690769e2b715ad7d80d0cb499eed1fc6a3475d662aa2ecf980451ae389774389276e372c769b920065d3be3d6a6b84cd09613efb5a7179e51d6d22ca267e292bb9c63ca46053ff6ec4bab0b2f9bd4bc177ca972a78cfbf459b93933513a5f8ed96604f2b641bcb1a178b718d1160555ca2b454da1624ebd2b891a24d95578b215630bd85ee6f3252ef16ab29fbc68a4455dc64f2948166baabd42d79a012702214e76ad50b90a2dd8cf644c44a444a079e7f6148fe0e430253402116dec114c43d313581da95f111f8d157e6f4b2c309aab90bbce74662d0d58599cbb3ac907d58c97254c7d0c14b3e995e99c0777969b4ef11697bb6b78cbeda5e31fe10b8d2edc2ca813a063c341a72b86aa718f23a2abcda95d4332821cc83398c02b49030f667b9a6e672d25ce7094a5cf8561a9d8dc2ce27442e3fe718b138b3454ae693c99bf633328487a2642c36b54db6b94f5417c003499abf251eabd8e6ab70b2b2b2f317db625134c74dd0f8e360b253af5f373ef22a4778ea7cedb816f8f63d0e5d40162a7a24875819b00ccb58f47c3be6496980f55fdf07ff1cee4bcc8f6b9f11a4ea269a2312c5bd4a0d8e9c385204b01b162a747dd43092afa3f3c804a432954e37b35563f16f6fb86c8f9f1b94573befeb2dcecf749758d80600cccfb910b2ca43bb1eb6cd62fb0b1921d56a789ef961fbd19c041c716db29ee6e27fe2fcd72f3b2df865139048173b795ff690af3364e19cb0efe730def6e246bf45648c56548631294032682befe2c2bc6fc5888f46204ac77ab9a94888ab97a074d14db16e040b48c7494790153de76ca5c97b04f3f2f82a025f9076c133df4771071246bdfa7728f7083ff5d9f567d3bb3755fa1059328e4f4ab50c58b4726aa43b8b0d8653b59dcc47debe2b1b12727dc3366f9c3b60abf409a4c54c8a23397210260222fdd9e4e4ce93c2afdfd7f91840d359a8cf62e64968ae69508f11249515f8650f467a364f97ebcc142cb5642d5146f6ea184de84136ba011205f1e72a4cea97e965d98cf12253be040201d747041eed27cce83c757179371874b944559c9d865446f7724ee19967a286d92b3c77716c4878392c3b7776e0793e0a3a64bacde068e6cc32a201e00236dde6f9825f1f4562016d779c2117fdc5aba66f5ced1e51f19ae81b88b5e842a7126c1f29ee962cc2d77fb200440821ee473bf81578a74ddf853d0e56367a133f3bdaf849bb21df2153ceba5118d4c33f65f82c63fc3dcdb3c74fb550ac21ce46a5bcc88541c95ddbbd97e3cda3609ff6ee505d69118cc265cf6de523967dc10bf1c7e9f2b1744dc22647649419dd4f9b967b48abcb03c6718431c41b00b67f5233ffc38834752fa40160b1bf2a04c9843b15ab912bae870d1492626f99407a0ddd5ef663663333f17a6b296c0911709c4fce8132d615b3d74e571b5f4b3ec344a710f1965a4cb89c7ebb75468f74490ba64eddcf6f0ccf93fbdd9d2daae72f4cf8cd25cecbf6bdcb86b58ba7496ab818479aa6b2a311e9992d202444ff2c1306e78110e7fbd6804dc326fc380a23aad18e04dbf216b5b567f0dfe4d5a08c1f5d57972288b4ac0c2f6c362ce59715710575fb205cc6018655527d1eecc944b4a6021267e1fc7b73ee0e8eca6ef9e4ba69ee5631a9c3032751d7065f2d154375cdde4af626e41670c55df96044c40d3f04db4938f105082238495f3e7cd41fb745037a368001c5242fa402811ed01d0f33c4aea40f03320b7369af2d098dd83fe496ad936ec79b3ab27db0867c145e8cf43116d11699685621cb5f5fe7ffdbb1506448e6c2163fce734a349083fda48f5265dba6079ecf5bff06b4fb0d324b8875c10a7c3f1665f6e7d1d41ec3e7abf9354eeff772b953e0239513b6ae0b076eba2a1ee1aac18039a6716995a5ce364497c02bd6ad75723ac7454575ddc171c621aab931536372fe3d911d0b5c4c80f54d67920bed569514f2fbaee82ec5a94c5eec7f7d8f7c1b7387b2da094ff4b70a605c617f44f04e6d0ed61a17705809d2a7101f626821873c8bccc5fd70104fffc60ec18906a3353721ccf9c6507ece21e605f26c4fa6cee74c7aefd382e422d4398606f3a05741975f1d3d2fee22bdcf88eb7f69632d409e53b4e09d23e5c8510db91b4d6cd06a2ddf2e34f416a4fb9a010a1062e41ce9d56a8ebc2b09828ad73a8c692ff369c54f7757cbbcf4a1d5ecb142a51e5fa13a7cf6c3422963da8cbe736d6fc87425120bcfb38b7caba7dd9d731b7a4443a81451b9d68445435da5ed456a8ece7fbfbf8ba3be88ab51c7c0756787fd9cb8e0d4818afba8b1c230fa3e0eb972ca8bf5521a8d7c708888a0503316fa0b3e4aa6337bddfe1a9d60c7e41460aba8774631897db193f98332109155a4a0b7e72f086c17cdf1e16d596b2b708c3035c2421193f21e19d1a1ff96d60557b6dea66ea72f448489642c5f152ada51524c1f41d6bc3fecc266002048f5a9299bf325e069abf64d513f9501daae21bd877a39c86d11faf8420b1246e6e8ffb2e4bf7a7a7213efebad693b1afabb7c5f5ef380b7b82a28ea45c7f51c1e9abd0f83db979cd7798c847ad2023d0676fa1c5555262d3fbe39a0bb61e638671c8831dd0c9cd1f20d51e066611eeb7333184ff0dbf0b06806a155eaed555bdcc5fc1f00b9deb67f9b70dc08076f7d68078ef8b1bc9e10b68563d3e0c74ec950f0462d157e7dd7be30ea804e76ecb79f06571af8de1a0222523ca12cde12001a1bd43805bf5f255148f837eba2db2df3a0dafc261a5d9ced4eb0af9e1dc80adedd6647d175aba013936a13b8c312f55319d432f8d3ea02ab382491fc1b6019b5ba3fcd4d01243e1770088ec941d39fac547930ec660c65e520a65699c2aeea02191b2083a181ba1fa9adc7ce3f8b3286e6befe847db61dafb945ace573c9b9e92ca17251bb4327769f6693ca194ad94ef2c43316778beeee7ec899c1aab024fac60fd58bbeb8436dce11fe815895dbf0c82a415d1a796d4c2fdc70256a87b3d70d34226053c01d9a4d61201205f6e7e6a400887830bd488bcf02d8a7c50c114344b8d19dc01c4f4b237c37261a2b29460f73b39cede292e9ba00ae1bbb2284952c8972853d21c216840c033562217fb607613ec6c43f1ee4dceca6c08704a2fe791852f9b2c33e616ec9ac484fdff8f50cec2fba9c0191023e10e684314bb3559620de3e371e9046170622bc897c380dca1aeb65c44765b795319c784c73f430f20919e8d39514d20ceea847f71c1a1582a54b5655f3a35e11b7b799702f22189c3e75dd3adc6d4ce44dcf1111c2eed4b37e03be610d29e3b67c38f9da4993dee82c50363c67e59ad4bc29d966bc8ad31c73874fc587156558c65409a39f8cc4e07b0ef0c794fb812c1b89d95085827f436c9315f11b7837b327a6e807221582a3b384541fdd84c208538daaaa0202984d611e26c3ed4c0d84c437a90c429235de4140c029bfe4903baa770f2aa695c7ad7c7a4e85ed89d8b7d9f6f09acdfe45a21671f8a58aaeaa55b8f4be20046cba7d61ca1f87c379b3d542aa73971920f94b39f19e2863cfd1ecbe5f6d70e8eac9bca119ac583940e282c82300ce999643d20220aab4e9a8aeafcd1d4f537a77a50bfe2f243660725392ac7cb60001fae77bca76c101f61736c835708abc65823beccf2759c73d7795718639ea713b78991470cb04e29f14a9fc35357add69e5f8481918c642a25d06313b55ec8840bea3ee4cf738d18fa6cf0320849384e6266383ef0f7cb6e534a4c6d8f0fda31a6eaf20c5be5e59288207ae50000000018000000000000001701000004000000c906000000000000"], 0x1060, 0x20000810}, {0x0, 0x0, &(0x7f0000003f80)=[{&(0x7f0000000cc0)="cdcef075b1a1f7345903ee8436a601f9e6b39870c046cabcfd196ee7da30bcfecde0e9387c749e7fc0cf772a4a24", 0x2e}, {&(0x7f0000003e80)="2a5fe066dad3e50b9ba4157b1635f0f8a2bc70ead300c68c4aeb06f306cfec6df80cb5d89e28aca1a80057e07432f2656ce2a5fc4fe85fd95224e4fadb510d8f4d9d3de858b568da4440668f0bd5ee7d1f774d1e12d3ef4cc9608f6f7c39b8512d292f84547aeb9a1d66fcb186ccb0d5e7857839e9b9432c366b93942b3ffe69f5c5856a9eb98bd81fec19ad7f16201fc6b577459f4e9735d089256414939a34d3c74ddb876bac9f4b2b6feb291f9cc3a59142218e285ea12c081ef122d34842f5b830c3873d740bc09c6cf5944a72d0673c59990bfb47b7be4e5a2194c2f62b254046cb3d0737cf92fcba", 0xeb}], 0x2, &(0x7f0000003fc0)=[@assoc={0x18, 0x117, 0x4, 0x5}, @op={0x18}, @op={0x18}], 0x48, 0x800}, {0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000004040)="32f0d055865da8e9e803ab00eb13ad90abbbce995128175c37777d4836177a5750730f64d71bdcef09f755b99245999f4c115cd2b83cd6dbc4447f317aee58688532083f1b427097e7f887e243e8004bdb8b0b0e652776e7f957128b733c7b28be5b6f24231c539bd869274e4f3a70c3a9ab13977c986675597b94a0656ce95015cfcfd1b44d4aaab88f4f7066708d810fc6676a6c61096485cddab0706719f835ef389d20bcffaa54343ab95ede745766a44e2eb81c9538367d0a9a3af2c706b4e392af392f83966be602d087db9521e15efbf07725d7d6fa8d0cbdacc05a103cc93899056436834320ac37fd4650701df562f2112d4fbc74b34d9df0110e", 0xff}], 0x1, 0x0, 0x0, 0x4010}], 0x5, 0x4000180) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x20, &(0x7f0000000180)={&(0x7f0000000440)=""/127, 0x7f, 0x0, &(0x7f00000000c0)=""/5, 0x5}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000ed1900000000b703000000000000850000000c000000b400000000000000180100002020702500000000002020207b3a48d484c91af8ff00000000bfa100000000000007010000f8ffffffb7020000080000003f0000000000000085000000"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0xc, &(0x7f0000000080)=@raw=[@exit, @map_fd={0x18, 0x6, 0x1, 0x0, r3}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x9}, @generic={0xef, 0x5, 0x4, 0x4, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @ldst={0x3, 0x3, 0x6, 0x3, 0xb, 0x20, 0xfffffffffffffff0}, @call={0x85, 0x0, 0x0, 0x88}], &(0x7f0000000000)='GPL\x00', 0xd5, 0x0, 0x0, 0x40f00, 0x35, '\x00', r2, @sk_msg=0x7, r3, 0x8, &(0x7f0000000180)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0xd, 0xa506aa2, 0x8}, 0x10, r5, r0, 0x5, 0x0, &(0x7f0000000240)=[{0x5, 0x3, 0x10}, {0x4, 0x1, 0x7, 0xa}, {0x0, 0x1, 0x2}, {0x5, 0x3, 0x9, 0x1}, {0x3, 0x1, 0xe, 0x7}], 0x10, 0x7}, 0x94) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="340000001400b59500000000000000000a400000", @ANYBLOB="14000200ff02"], 0x34}}, 0x0) (async, rerun: 64) r6 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async, rerun: 64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xe, 0x0, &(0x7f0000000040)="ffff53f2081e87f89b60160b08ff", 0x0, 0x63, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3f}, 0x50) (rerun: 64) 333.913446ms ago: executing program 2 (id=4209): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x30, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa0}, 0x1, 0x0, 0x0, 0x850}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="58000000100037040400"/20, @ANYRES32=r3, @ANYBLOB="8304050000000000380012800b000100697036746e6c000028000280080008001300000014000300fe"], 0x58}, 0x1, 0x0, 0x0, 0x9005}, 0x4000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x80000002, 0x12) (async) sendmmsg$inet(r1, &(0x7f0000000400)=[{{&(0x7f0000000580)={0x2, 0x4e5c, @broadcast}, 0x10, 0x0, 0x0, &(0x7f00000003c0)}}], 0x1, 0x4880) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x8010) 305.340379ms ago: executing program 1 (id=4210): r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000240)=ANY=[]) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000500)={'gretap0\x00', 0x0, 0x0, 0x1, 0x408000, 0x101, {{0xf, 0x4, 0x3, 0x30, 0x3c, 0x64, 0x0, 0xb, 0x29, 0x0, @multicast2, @loopback, {[@rr={0x7, 0x27, 0xe5, [@broadcast, @loopback, @multicast2, @empty, @multicast1, @dev={0xac, 0x14, 0x14, 0x31}, @remote, @private=0xa010102, @remote]}, @noop]}}}}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000880)=ANY=[@ANYRES8=r2, @ANYRES64=0x0, @ANYBLOB="010000000000000000000700000008000b0000000000", @ANYRES32=r2, @ANYBLOB="2f173e96c9a87daf4f4cc86d2f2f3506f6b06bd2fb8dd83a49763864cfd6b9169ba93cf2ca77670a3b309311b99e29c9a0c563fb979b1b9013dfc1814bd2642d0b03d519806fd1e8288045fa166538f600a41b0a8750863b803bd680d136d4802148ab663f50419e38151bcdcb52cae7950d3314afabe9ad20432e417c6faba7b64973b77fe1c2d2f98fa023c29a48c2d05f093ef6e389b87c93aa28dab9061218811fd7dea8e1f197a69d931f1ab40c7f2847658b76b29eed54e5330b9e1d07b298121e132124514585db4f90136e90b0739e1b87fbd9dcf5509a9933e4bee2b4ce78977efe01e3a8eabd"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt(r3, 0x84, 0x81, &(0x7f0000000300)="1a00000002000000", 0x8) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000600)={'syztnl1\x00', &(0x7f0000000580)={'sit0\x00', 0x0, 0x8000, 0x10, 0x4, 0xfffffff8, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x401, 0x0, 0x3, 0x29, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x3d}, {[@noop]}}}}}) r5 = socket$inet(0x10, 0x3, 0xc) sendmsg(r5, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="2400000002031f001cfffd946fa2830020200a800900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) r6 = socket$inet(0x10, 0x3, 0xc) sendmsg(r6, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)="2400000001031f001cfffd946fa2830020200a800900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000640), &(0x7f0000000680)=0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="100100006d0008002abd7000fddbdf2500000000", @ANYRESDEC=r0, @ANYBLOB="0029e54a2a004a02ef3c8400437ccf22235ff353838e79e9ec2d8b956aabb4ed988f94efc49df02c3b851c47072b09424e8c6a3564f21f9da5000f3265f85378e32d7935132c134ac1eb298856af2e1b1a5e0b501d8e36dd2d58dbf4530ba7d340c17b430005e68ef7723378769b635dc423070acb03bfa4a59dadb24b2d343b6867f403cd7c40dc", @ANYRES32=0x0, @ANYBLOB="08001d0009000000b80012800b0001006970367674690000a800028014000500ff02000000000000000000000000000108000200850000001400040000000000000000000000000000000001140005000000000000000000000000000000000114000400fc00000000000000000000000000000108000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="080003000200000014000500fe8000000000000000000000000000aa080003000400000008000100", @ANYRES32=0x0, @ANYBLOB="080003000800000008000300090000001d0022005ca44ced0c24e0353f8b9e83301b54bc1c9f96e8f7453b412b000000080029005b390400"], 0x110}, 0x1, 0x0, 0x0, 0x8081}, 0x4000840) r7 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_TIOCOUTQ(r7, 0x5411, &(0x7f0000000100)) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r8, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="030700006200190000000b0000000800030048"], 0x1c}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000060a0b0400000000000000000200fffd140004ca0b000000000000007061796c6f6164000900010073797a30000000000900020033797a3200000000140000001100010000000000000000000000000a"], 0x68}}, 0xc000) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB='$@\x00\x00', @ANYRES16=r9, @ANYBLOB="00032cbd7000fedbdf250b00000005003500000000000500330001000000"], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) r11 = socket(0x40000000015, 0x5, 0x0) r12 = epoll_create(0x8) epoll_ctl$EPOLL_CTL_ADD(r12, 0x1, r11, &(0x7f0000000280)={0x20000015}) connect$inet(r11, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) 212.587793ms ago: executing program 4 (id=4211): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) (async) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x4000, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x80000}, 0x50) (async) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0000fdffff"], 0x48) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r3, 0x0, 0x1}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='ext4_es_insert_delayed_block\x00', r3, 0x0, 0x6}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090200000300ffe5000d0000000000b702000000000000739af0ff00000000c509000000010000c3aaf0fff1000000bf8720000000000037080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 204.043294ms ago: executing program 2 (id=4212): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x41}, @call={0x85, 0x0, 0x0, 0x2a}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000040)='GPL\x00'}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) accept4(r3, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', 0xffffffffffffffff, 0x0, 0x3}, 0x18) syz_init_net_socket$ax25(0x3, 0x2, 0xca) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000580)={'veth0_macvtap\x00', 0x0}) r6 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000a40)={r1, r5, 0x25, 0x2, @void}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r6, r2, 0x4, r2}, 0x10) 185.822141ms ago: executing program 4 (id=4213): r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="2400000002031f001cfffd946fa2830020200a800900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) r1 = socket$inet(0x10, 0x3, 0xc) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0xe0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xfff3, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x842}, @TCA_CAKE_INGRESS={0x8, 0xf, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000021}, 0x4044080) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r2, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f00000001c0)=0x40, 0x4) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)="2400000001031f001cfffd946fa2830020200a800900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) 100.853116ms ago: executing program 1 (id=4214): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000000000000000000001805000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000b90600008500000004000000850000002300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r0}, 0x10) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 100.430978ms ago: executing program 2 (id=4215): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)}, 0x4) bpf$ITER_CREATE(0x21, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000100001ff00000000000000000000000a2c000000050a01020000000000000000020000000900030073797a32000000000900010073797a300000000014000000020a031747d21400000000000000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4006000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0xe8}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000100001ff00000000000000000000000a2c000000050a01020000000000000000020000000900030073797a32000000000900010073797a30000000000b00000002"], 0x68}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000b000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f08000340000000045c0000000c0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xe8}}, 0x8040) 71.731319ms ago: executing program 1 (id=4216): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f00000004c0)="1ed8b7f9d457", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c0000000000000000000000010000"], 0x40}, 0x20000000) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, r1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x14, 0x2, 0x4) getpeername$packet(r2, 0x0, 0x0) (async) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f00000002c0)=ANY=[@ANYBLOB="08000000000000000a002400000007fe8000000000000000000000000000397410000000000000000094d966347a172e000000000000000000000000000000000000005f9a08429c0d185300"/143], 0x90) sendto$packet(r3, &(0x7f00000002c0)="05031600d3fc140000004788031c09103b28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 55.707664ms ago: executing program 4 (id=4217): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000540)={@local}, 0x14) (async) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000540)={@local}, 0x14) socket$netlink(0x10, 0x3, 0xc) (async) r1 = socket$netlink(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000780)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, 0x0}}], 0x1, 0x4040815) (async) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000780)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, 0x0}}], 0x1, 0x4040815) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000000)={r4, 0x9d7, 0x20}, &(0x7f0000000040)=0xc) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)=ANY=[@ANYBLOB="140000000d0603"], 0x14}}, 0x0) (async) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)=ANY=[@ANYBLOB="140000000d0603"], 0x14}}, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r6, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) bind$vsock_stream(r6, &(0x7f0000000940), 0x10) close(0x3) listen(r6, 0x0) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) (async) connect$vsock_stream(r7, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) writev(r7, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1) shutdown(r7, 0x1) (async) shutdown(r7, 0x1) connect$can_bcm(r5, 0x0, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000100)='vm_unmapped_area\x00', r8}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffcac}, 0x94) (async) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffcac}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000100)='vm_unmapped_area\x00', r9}, 0x18) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) sendmsg$NL80211_CMD_DISASSOCIATE(r1, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="000428bd7000fddbdf252500000018002a006512080211000001ffffffffffff080211000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x40) 0s ago: executing program 3 (id=4218): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x6, 0x9, &(0x7f0000000080)={{0x1, @broadcast, 0x0, 0x0, 'wrr\x00', 0x0, 0x0, 0x4}, {@empty}}, 0x44) getsockopt$inet_tcp_int(r1, 0x6, 0x9, 0x0, &(0x7f0000000040)) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'dh\x00', 0x2d, 0x40085, 0x13}, 0x2c) kernel console output (not intermixed with test programs): d promiscuous mode [ 245.481982][T16815] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1500) ! [ 245.490568][T16597] veth1_macvtap: entered promiscuous mode [ 245.510835][T16597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 245.542300][T16820] netlink: 'syz.1.2939': attribute type 1 has an invalid length. [ 245.554003][T16597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 245.570318][ T6162] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.601688][ T6162] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.619121][ T6162] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.649206][ T6162] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.670778][T16824] syzkaller1: entered promiscuous mode [ 245.677912][T16824] syzkaller1: entered allmulticast mode [ 245.769444][T16790] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 245.786300][T16790] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 245.847169][T16786] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 245.861645][T16786] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 245.884606][ T50] Bluetooth: hci4: command tx timeout [ 246.141923][T16850] veth3: entered promiscuous mode [ 246.197100][T16851] veth5: entered promiscuous mode [ 246.442925][ T5860] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 246.455592][ T5860] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 246.463108][ T5860] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 246.473105][ T5860] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 246.482021][T16873] __nla_validate_parse: 6 callbacks suppressed [ 246.482038][T16873] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2951'. [ 246.502734][ T5860] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 246.577455][T16876] netlink: 'syz.3.2953': attribute type 1 has an invalid length. [ 246.586049][T16876] netlink: 'syz.3.2953': attribute type 11 has an invalid length. [ 246.593876][T16876] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2953'. [ 246.610424][T16871] lo speed is unknown, defaulting to 1000 [ 246.847937][T16871] lo speed is unknown, defaulting to 1000 [ 246.854892][T16871] hsr0 speed is unknown, defaulting to 1000 [ 247.062707][T16917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2964'. [ 247.113041][T16871] chnl_net:caif_netlink_parms(): no params data found [ 247.319365][T16871] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.339604][T16871] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.359896][T16871] bridge_slave_0: entered allmulticast mode [ 247.383685][T16871] bridge_slave_0: entered promiscuous mode [ 247.392422][T16871] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.400452][T16871] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.414002][T16871] bridge_slave_1: entered allmulticast mode [ 247.426348][T16871] bridge_slave_1: entered promiscuous mode [ 247.497674][T16871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 247.513624][T16942] netlink: 'syz.2.2969': attribute type 1 has an invalid length. [ 247.523769][T16871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 247.562059][T16942] bond11: entered promiscuous mode [ 247.571215][T16942] 8021q: adding VLAN 0 to HW filter on device bond11 [ 247.579507][T16945] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2969'. [ 247.593034][T16871] team0: Port device team_slave_0 added [ 247.605924][T16871] team0: Port device team_slave_1 added [ 247.619493][T16945] batadv1: entered promiscuous mode [ 247.626141][T16945] batadv1: entered allmulticast mode [ 247.633229][T16945] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 247.653173][T16945] bond11: (slave batadv1): making interface the new active one [ 247.661743][T16945] bond11: (slave batadv1): Enslaving as an active interface with an up link [ 247.707617][T16942] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.2969'. [ 247.719417][T16871] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 247.730303][T16871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 247.765328][T16871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 247.789712][T16871] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 247.798730][T16871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 247.826075][T16871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 247.947081][T16871] hsr_slave_0: entered promiscuous mode [ 247.963315][T16871] hsr_slave_1: entered promiscuous mode [ 247.976458][ T5860] Bluetooth: hci4: command tx timeout [ 247.980458][T16871] debugfs: 'hsr0' already exists in 'hsr' [ 247.993860][T16871] Cannot create hsr debugfs directory [ 248.138868][T16962] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2976'. [ 248.155609][T16962] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2976'. [ 248.191630][T16959] netlink: 18 bytes leftover after parsing attributes in process `syz.4.2975'. [ 248.321669][T16972] netlink: 160 bytes leftover after parsing attributes in process `syz.0.2979'. [ 248.349511][T16967] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2980'. [ 248.419502][T16980] pimreg: entered allmulticast mode [ 248.445227][T16981] pimreg: left allmulticast mode [ 248.488684][T16983] dvmrp0: entered allmulticast mode [ 248.542558][T16986] netlink: 'syz.3.2986': attribute type 1 has an invalid length. [ 248.560053][T16986] netlink: 'syz.3.2986': attribute type 6 has an invalid length. [ 248.574795][T16986] netlink: 'syz.3.2986': attribute type 3 has an invalid length. [ 248.589283][T16992] vlan0: entered promiscuous mode [ 248.597597][T16992] vlan0: entered allmulticast mode [ 248.604702][T16992] hsr_slave_1: entered allmulticast mode [ 248.604923][ T5860] Bluetooth: hci2: command tx timeout [ 248.659278][T16998] netlink: 'syz.4.2990': attribute type 16 has an invalid length. [ 248.739685][ T30] audit: type=1800 audit(1756319901.078:12): pid=17000 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2991" name="@" dev="tmpfs" ino=2936 res=0 errno=0 [ 248.744786][T16871] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 248.816762][T16871] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 248.876098][T17000] lo speed is unknown, defaulting to 1000 [ 248.881967][T16871] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 248.923868][T16871] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 249.030393][T16871] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.060604][T16871] 8021q: adding VLAN 0 to HW filter on device team0 [ 249.098302][T16791] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.105655][T16791] bridge0: port 1(bridge_slave_0) entered forwarding state [ 249.145437][T16791] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.152581][T16791] bridge0: port 2(bridge_slave_1) entered forwarding state [ 249.441383][T17000] lo speed is unknown, defaulting to 1000 [ 249.471725][T17000] hsr0 speed is unknown, defaulting to 1000 [ 249.512030][T17046] syz_tun: entered allmulticast mode [ 249.538776][T17046] dvmrp8: entered allmulticast mode [ 249.609166][T16871] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 249.646193][T17046] lo speed is unknown, defaulting to 1000 [ 249.692321][T17048] netlink: 'syz.4.3002': attribute type 23 has an invalid length. [ 249.852420][T16871] veth0_vlan: entered promiscuous mode [ 249.876392][T17046] lo speed is unknown, defaulting to 1000 [ 249.885124][T17050] tipc: Enabled bearer , priority 0 [ 249.922723][T17050] syzkaller0: entered promiscuous mode [ 249.930335][T17050] syzkaller0: entered allmulticast mode [ 249.939091][T17046] hsr0 speed is unknown, defaulting to 1000 [ 249.939870][T16871] veth1_vlan: entered promiscuous mode [ 250.044322][ T5860] Bluetooth: hci4: command tx timeout [ 250.178949][T17050] tipc: Resetting bearer [ 250.189698][T17049] tipc: Resetting bearer [ 250.202824][T17049] tipc: Disabling bearer [ 250.258232][T17056] lo speed is unknown, defaulting to 1000 [ 250.392063][T17045] syz_tun: left allmulticast mode [ 250.399021][T17045] dvmrp8: left allmulticast mode [ 250.410990][T17056] lo speed is unknown, defaulting to 1000 [ 250.437226][T17056] hsr0 speed is unknown, defaulting to 1000 [ 250.501873][T16871] veth0_macvtap: entered promiscuous mode [ 250.511813][T16871] veth1_macvtap: entered promiscuous mode [ 250.535784][T16871] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 250.569556][T16871] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 250.580618][T16789] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 250.613712][T16789] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 250.623347][T16789] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 250.649764][T16789] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 250.685697][ T5860] Bluetooth: hci2: command tx timeout [ 250.709067][T16787] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 250.720312][T16789] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.730136][T16787] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 250.775008][T16789] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.775961][T17081] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 250.797593][T16789] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.815441][T16789] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.988231][T17090] lo speed is unknown, defaulting to 1000 [ 251.013501][T16789] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.048591][T16789] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.090985][T16786] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.105372][T16786] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.253226][T17090] lo speed is unknown, defaulting to 1000 [ 251.261417][T17090] hsr0 speed is unknown, defaulting to 1000 [ 251.311736][T17121] tun0: tun_chr_ioctl cmd 1074025675 [ 251.321449][T17121] tun0: persist enabled [ 251.337520][T17121] tun0: tun_chr_ioctl cmd 1074025675 [ 251.342921][T17121] tun0: persist disabled [ 251.402276][T17126] tun0: tun_chr_ioctl cmd 1074025673 [ 251.740772][T17141] netlink: 'syz.1.3028': attribute type 13 has an invalid length. [ 251.749186][T17141] netlink: 'syz.1.3028': attribute type 17 has an invalid length. [ 251.832408][T17141] net_ratelimit: 4 callbacks suppressed [ 251.832419][T17141] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 251.997433][T17153] netlink: 'syz.1.3031': attribute type 1 has an invalid length. [ 252.039568][T17153] __nla_validate_parse: 13 callbacks suppressed [ 252.039586][T17153] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3031'. [ 252.070575][T17153] batadv1: entered promiscuous mode [ 252.075775][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 252.083517][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 252.090908][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 252.100302][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 252.113139][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 252.130641][T17153] batadv1: entered allmulticast mode [ 252.232021][T17158] lo speed is unknown, defaulting to 1000 [ 252.285845][T17172] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3031'. [ 252.390080][T17174] netlink: 'syz.3.3038': attribute type 1 has an invalid length. [ 252.410514][T17174] bond14: entered promiscuous mode [ 252.424460][T17174] 8021q: adding VLAN 0 to HW filter on device bond14 [ 252.460447][T17158] lo speed is unknown, defaulting to 1000 [ 252.468632][T17183] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3038'. [ 252.479109][T17158] hsr0 speed is unknown, defaulting to 1000 [ 252.510195][T17183] batadv2: entered promiscuous mode [ 252.516495][T17183] batadv2: entered allmulticast mode [ 252.533969][T17183] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 252.551254][T17183] bond14: (slave batadv2): making interface the new active one [ 252.560829][T17183] bond14: (slave batadv2): Enslaving as an active interface with an up link [ 252.641398][T17174] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.3038'. [ 252.765602][ T5860] Bluetooth: hci2: command tx timeout [ 252.776677][T17192] tipc: Enabling of bearer rejected, already enabled [ 252.813799][T17190] tipc: Started in network mode [ 252.821850][T17190] tipc: Node identity de28de39d021, cluster identity 4711 [ 252.831562][T17190] tipc: Enabled bearer , priority 0 [ 252.841973][T17158] chnl_net:caif_netlink_parms(): no params data found [ 252.861635][T17189] tipc: Resetting bearer [ 252.921966][T17189] tipc: Disabling bearer [ 253.012836][T17158] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.024396][T17158] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.031759][T17158] bridge_slave_0: entered allmulticast mode [ 253.041882][T17158] bridge_slave_0: entered promiscuous mode [ 253.051095][T17158] bridge0: port 2(bridge_slave_1) entered blocking state [ 253.058611][T17158] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.068838][T17158] bridge_slave_1: entered allmulticast mode [ 253.076309][T17158] bridge_slave_1: entered promiscuous mode [ 253.114476][T17158] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 253.128850][T17158] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 253.167738][T17158] team0: Port device team_slave_0 added [ 253.178177][T17158] team0: Port device team_slave_1 added [ 253.216748][T17158] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 253.223887][T17158] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 253.254303][T17158] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 253.280991][T17158] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 253.291725][T17158] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 253.323504][T17158] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 253.397787][T17158] hsr_slave_0: entered promiscuous mode [ 253.417796][T17158] hsr_slave_1: entered promiscuous mode [ 253.423964][T17158] debugfs: 'hsr0' already exists in 'hsr' [ 253.447341][T17158] Cannot create hsr debugfs directory [ 253.598897][T17241] netlink: 264 bytes leftover after parsing attributes in process `syz.2.3057'. [ 253.611385][T17241] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3057'. [ 253.627944][T17243] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 253.691190][T17248] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3060'. [ 253.790570][T17256] Bluetooth: MGMT ver 1.23 [ 253.793067][T17259] pimreg: entered allmulticast mode [ 253.822921][T17259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3062'. [ 253.836105][T17259] pimreg: left allmulticast mode [ 253.891216][T17265] Â: renamed from pim6reg1 [ 253.973665][T17158] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 253.983773][T17158] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 254.002910][T17158] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 254.025026][T17158] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 254.111540][T17288] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3072'. [ 254.124912][T17288] nbd: must specify at least one socket [ 254.144792][T17288] block nbd2: NBD_DISCONNECT [ 254.149459][T17288] block nbd2: Send disconnect failed -32 [ 254.165611][T17288] block nbd2: shutting down sockets [ 254.172742][T17292] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3074'. [ 254.204578][ T5860] Bluetooth: hci0: command tx timeout [ 254.219681][T17158] 8021q: adding VLAN 0 to HW filter on device bond0 [ 254.240946][T17295] (unnamed net_device) (uninitialized): option lp_interval: invalid value (0) [ 254.251481][T17295] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 254.275337][T17158] 8021q: adding VLAN 0 to HW filter on device team0 [ 254.283967][T17298] netlink: 'syz.3.3076': attribute type 5 has an invalid length. [ 254.300696][T17301] netlink: 'syz.1.3077': attribute type 2 has an invalid length. [ 254.324759][T17300] netlink: 'syz.3.3076': attribute type 5 has an invalid length. [ 254.325538][T16789] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.339817][T16789] bridge0: port 1(bridge_slave_0) entered forwarding state [ 254.381611][T16790] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.389103][T16790] bridge0: port 2(bridge_slave_1) entered forwarding state [ 254.420974][T17308] netlink: 'syz.2.3080': attribute type 1 has an invalid length. [ 254.512035][T17158] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 254.523106][T17158] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 254.559202][T17314] bond12: (slave gretap3): making interface the new active one [ 254.575918][T17314] bond12: (slave gretap3): Enslaving as an active interface with an up link [ 254.844227][ T5860] Bluetooth: hci2: command tx timeout [ 254.879078][T17331] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.886551][T17331] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.964651][T17331] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 254.980894][T17331] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 255.098550][T17350] syzkaller0: entered promiscuous mode [ 255.115379][T17350] syzkaller0: entered allmulticast mode [ 255.125660][T16786] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.137703][T16786] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.165697][T17347] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20003 [ 255.169517][T16786] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.214648][T16786] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.227745][T17158] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 255.290284][T17158] veth0_vlan: entered promiscuous mode [ 255.318700][T17158] veth1_vlan: entered promiscuous mode [ 255.346152][T17158] veth0_macvtap: entered promiscuous mode [ 255.356125][T17158] veth1_macvtap: entered promiscuous mode [ 255.387745][T17379] IPVS: Unknown mcast interface: vcan0 [ 255.400333][T17158] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 255.419335][T17158] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 255.434010][T16786] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.447903][T16786] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.459556][T16786] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.469526][T16786] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.513804][T17383] "syz.2.3099" (17383) uses obsolete ecb(arc4) skcipher [ 255.543228][T17383] tipc: Enabled bearer , priority 0 [ 255.552567][T17383] syzkaller0: entered promiscuous mode [ 255.558888][T17383] syzkaller0: entered allmulticast mode [ 255.567747][T17383] tipc: Resetting bearer [ 255.577688][ T1328] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 255.603763][ T1328] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 255.632530][ T3565] tipc: Resetting bearer [ 255.642530][T17383] tipc: Resetting bearer [ 255.660801][T17383] tipc: Disabling bearer [ 255.679591][ T3565] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 255.688749][ T3565] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 255.887449][ T1299] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 255.897912][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.909682][T17409] ieee802154 phy0 wpan0: encryption failed: -90 [ 255.945748][T17409] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 255.952997][T17409] IPv6: NLM_F_CREATE should be set when creating new route [ 255.960448][T17409] IPv6: NLM_F_CREATE should be set when creating new route [ 256.056515][T17409] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 256.095112][ T50] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 256.102613][ T50] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 256.110180][ T50] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 256.121431][ T50] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 256.129287][ T50] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 256.173695][T17424] tipc: Enabling of bearer rejected, failed to enable media [ 256.208236][T17418] lo speed is unknown, defaulting to 1000 [ 256.285047][ T50] Bluetooth: hci0: command tx timeout [ 256.344962][ T1328] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.411152][ T1328] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.453966][T17418] lo speed is unknown, defaulting to 1000 [ 256.473786][T17418] hsr0 speed is unknown, defaulting to 1000 [ 256.501329][ T1328] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.511723][ T1328] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.538148][T17446] sch_tbf: burst 88 is lower than device batadv0 mtu (1514) ! [ 256.567862][ T1328] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.593542][ T1328] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.633068][T17446] sctp: [Deprecated]: syz.0.3114 (pid 17446) Use of struct sctp_assoc_value in delayed_ack socket option. [ 256.633068][T17446] Use struct sctp_sack_info instead [ 256.693796][ T1328] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.726525][ T1328] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.802054][T17462] sysfs: cannot create duplicate filename '/class/ieee80211/žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»–_à›xDä±pj8¼•TTí!' [ 256.817942][T17462] CPU: 0 UID: 0 PID: 17462 Comm: syz.2.3119 Not tainted syzkaller #0 PREEMPT(full) [ 256.817967][T17462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 256.817990][T17462] Call Trace: [ 256.817998][T17462] [ 256.818007][T17462] dump_stack_lvl+0x189/0x250 [ 256.818040][T17462] ? __pfx_dump_stack_lvl+0x10/0x10 [ 256.818062][T17462] ? __pfx__printk+0x10/0x10 [ 256.818084][T17462] ? kernfs_root+0x1c/0x230 [ 256.818106][T17462] ? kernfs_path_from_node+0x2f/0x290 [ 256.818128][T17462] ? kernfs_path_from_node+0x250/0x290 [ 256.818146][T17462] ? kernfs_path_from_node+0x2f/0x290 [ 256.818167][T17462] sysfs_warn_dup+0x8e/0xa0 [ 256.818185][T17462] sysfs_do_create_link_sd+0xc0/0x110 [ 256.818202][T17462] device_add_class_symlinks+0x1cf/0x240 [ 256.818223][T17462] device_add+0x475/0xb50 [ 256.818241][T17462] wiphy_register+0x1ba6/0x28d0 [ 256.818275][T17462] ? __pfx_wiphy_register+0x10/0x10 [ 256.818298][T17462] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 256.818320][T17462] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 256.818338][T17462] ieee80211_register_hw+0x3425/0x4080 [ 256.818365][T17462] ? ieee80211_register_hw+0x14c1/0x4080 [ 256.818387][T17462] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 256.818409][T17462] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 256.818435][T17462] ? __hrtimer_setup+0x187/0x210 [ 256.818451][T17462] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 256.818476][T17462] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 256.818514][T17462] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 256.818535][T17462] ? trace_kmalloc+0x1f/0xd0 [ 256.818554][T17462] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 256.818576][T17462] ? kstrndup+0xbf/0x160 [ 256.818596][T17462] hwsim_new_radio_nl+0xea4/0x1b10 [ 256.818617][T17462] ? __pfx___nla_validate_parse+0x10/0x10 [ 256.818657][T17462] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 256.818684][T17462] ? __nla_parse+0x40/0x60 [ 256.818708][T17462] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 256.818733][T17462] genl_family_rcv_msg_doit+0x212/0x300 [ 256.818756][T17462] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 256.818780][T17462] ? bpf_lsm_capable+0x9/0x20 [ 256.818801][T17462] ? security_capable+0x7e/0x2e0 [ 256.818826][T17462] genl_rcv_msg+0x60e/0x790 [ 256.818847][T17462] ? __pfx_genl_rcv_msg+0x10/0x10 [ 256.818864][T17462] ? __kasan_slab_alloc+0x6c/0x80 [ 256.818885][T17462] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 256.818907][T17462] ? __netlink_lookup+0xbd/0x810 [ 256.818923][T17462] ? rcu_is_watching+0x15/0xb0 [ 256.818949][T17462] netlink_rcv_skb+0x208/0x470 [ 256.818974][T17462] ? __pfx_genl_rcv_msg+0x10/0x10 [ 256.818994][T17462] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 256.819021][T17462] ? lock_release+0x4b/0x3e0 [ 256.819043][T17462] ? down_read+0x1ad/0x2e0 [ 256.819060][T17462] genl_rcv+0x28/0x40 [ 256.819079][T17462] netlink_unicast+0x82f/0x9e0 [ 256.819106][T17462] ? __pfx_netlink_unicast+0x10/0x10 [ 256.819131][T17462] ? netlink_sendmsg+0x642/0xb30 [ 256.819145][T17462] ? skb_put+0x11b/0x210 [ 256.819163][T17462] netlink_sendmsg+0x805/0xb30 [ 256.819182][T17462] ? __pfx_netlink_sendmsg+0x10/0x10 [ 256.819201][T17462] ? aa_sock_msg_perm+0xf1/0x1d0 [ 256.819220][T17462] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 256.819239][T17462] ? __pfx_netlink_sendmsg+0x10/0x10 [ 256.819255][T17462] __sock_sendmsg+0x219/0x270 [ 256.819277][T17462] ____sys_sendmsg+0x505/0x830 [ 256.819297][T17462] ? __pfx_____sys_sendmsg+0x10/0x10 [ 256.819319][T17462] ? import_iovec+0x74/0xa0 [ 256.819339][T17462] ___sys_sendmsg+0x21f/0x2a0 [ 256.819356][T17462] ? __pfx____sys_sendmsg+0x10/0x10 [ 256.819398][T17462] ? futex_wake+0x4b2/0x560 [ 256.819445][T17462] __x64_sys_sendmsg+0x19b/0x260 [ 256.819465][T17462] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 256.819490][T17462] ? rcu_is_watching+0x15/0xb0 [ 256.819511][T17462] ? rcu_is_watching+0x15/0xb0 [ 256.819529][T17462] do_syscall_64+0xfa/0x3b0 [ 256.819546][T17462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 256.819564][T17462] ? clear_bhb_loop+0x60/0xb0 [ 256.819585][T17462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 256.819603][T17462] RIP: 0033:0x7f09f738ebe9 [ 256.819621][T17462] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 256.819645][T17462] RSP: 002b:00007f09f81ea038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 256.819666][T17462] RAX: ffffffffffffffda RBX: 00007f09f75b5fa0 RCX: 00007f09f738ebe9 [ 256.819680][T17462] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000008 [ 256.819694][T17462] RBP: 00007f09f7411e19 R08: 0000000000000000 R09: 0000000000000000 [ 256.819706][T17462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 256.819717][T17462] R13: 00007f09f75b6038 R14: 00007f09f75b5fa0 R15: 00007ffdc731bb28 [ 256.819740][T17462] [ 257.330714][ T1328] tipc: Resetting bearer [ 257.432842][ T1328] ip6gretap0 (unregistering): left allmulticast mode [ 257.679107][ T1328] tipc: Disabling bearer [ 257.873605][ T1328] bond0 (unregistering): Released all slaves [ 257.897016][ T1328] bond1 (unregistering): Released all slaves [ 257.924842][ T1328] bond2 (unregistering): Released all slaves [ 257.937430][ T1328] bond3 (unregistering): Released all slaves [ 257.965252][ T1328] bond4 (unregistering): Released all slaves [ 257.992672][ T1328] bond5 (unregistering): Released all slaves [ 258.031433][ T1328] bond6 (unregistering): Released all slaves [ 258.048574][ T1328] bond7 (unregistering): Released all slaves [ 258.063996][ T1328] bond8 (unregistering): Released all slaves [ 258.079104][ T1328] bond9 (unregistering): Released all slaves [ 258.097856][ T1328] bond10 (unregistering): Released all slaves [ 258.108864][ T1328] bond11 (unregistering): Released all slaves [ 258.122855][ T1328] bond12 (unregistering): Released all slaves [ 258.137289][ T1328] bond13 (unregistering): Released all slaves [ 258.179066][ T1328] bond14 (unregistering): (slave batadv2): Releasing active interface [ 258.195585][ T1328] bond14 (unregistering): Released all slaves [ 258.204281][ T50] Bluetooth: hci5: command tx timeout [ 258.214544][T17418] chnl_net:caif_netlink_parms(): no params data found [ 258.253866][T17508] __nla_validate_parse: 13 callbacks suppressed [ 258.253886][T17508] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3131'. [ 258.336759][ T1328] tipc: Left network mode [ 258.367584][ T50] Bluetooth: hci0: command tx timeout [ 258.411912][T17525] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3133'. [ 258.465575][T17418] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.476139][T17418] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.483966][T17418] bridge_slave_0: entered allmulticast mode [ 258.492236][T17418] bridge_slave_0: entered promiscuous mode [ 258.543315][T17527] dvmrp8: entered allmulticast mode [ 258.573886][T17418] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.587839][T17418] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.620164][T17418] bridge_slave_1: entered allmulticast mode [ 258.631961][T17418] bridge_slave_1: entered promiscuous mode [ 258.715469][T17548] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3141'. [ 258.745767][T17527] netlink: 'syz.2.3135': attribute type 23 has an invalid length. [ 258.790578][T17418] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 258.807971][T17530] lo speed is unknown, defaulting to 1000 [ 258.811468][T17418] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 258.831235][T17548] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3141'. [ 258.890354][T17418] team0: Port device team_slave_0 added [ 258.918762][T17418] team0: Port device team_slave_1 added [ 259.000445][T17556] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3142'. [ 259.020106][T17556] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3142'. [ 259.047223][T17418] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 259.069457][T17418] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 259.113575][T17418] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 259.142335][T17556] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3142'. [ 259.159683][T17556] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3142'. [ 259.180303][T17418] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 259.198594][T17418] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 259.252457][T17418] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 259.300633][T17530] lo speed is unknown, defaulting to 1000 [ 259.380207][T17530] hsr0 speed is unknown, defaulting to 1000 [ 259.392979][T17581] netlink: 'syz.0.3148': attribute type 1 has an invalid length. [ 259.417682][T17526] dvmrp8: left allmulticast mode [ 259.487660][T17418] hsr_slave_0: entered promiscuous mode [ 259.495002][T17418] hsr_slave_1: entered promiscuous mode [ 259.501950][T17418] debugfs: 'hsr0' already exists in 'hsr' [ 259.507957][T17418] Cannot create hsr debugfs directory [ 259.522547][T17583] veth0_to_hsr: entered promiscuous mode [ 259.530771][T17583] veth0_to_hsr: entered allmulticast mode [ 259.538946][T17576] tipc: Started in network mode [ 259.544774][T17576] tipc: Node identity 268713cf7289, cluster identity 4711 [ 259.552589][T17576] tipc: Enabled bearer , priority 0 [ 259.568741][T17585] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3150'. [ 259.578627][ T1328] hsr_slave_0: left promiscuous mode [ 259.585859][ T1328] hsr_slave_1: left promiscuous mode [ 259.596448][ T1328] veth1_vlan: left promiscuous mode [ 259.738983][ T24] IPVS: starting estimator thread 0... [ 259.844186][T17594] IPVS: using max 39 ests per chain, 93600 per kthread [ 259.986850][T17587] syzkaller0: entered promiscuous mode [ 259.992501][T17587] syzkaller0: entered allmulticast mode [ 260.033110][T17581] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.040757][T17581] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.098224][T17581] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 260.110709][T17581] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 260.216149][T17575] tipc: Resetting bearer [ 260.227460][T17575] tipc: Disabling bearer [ 260.235841][ T3565] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.245708][T16790] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.256156][T16790] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.268159][T16790] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.297538][ T50] Bluetooth: hci5: command tx timeout [ 260.333501][T17596] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 260.343732][T17596] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3151'. [ 260.454402][ T50] Bluetooth: hci0: command tx timeout [ 260.487253][T17598] netlink: 'syz.0.3152': attribute type 1 has an invalid length. [ 260.512714][T17602] FAULT_INJECTION: forcing a failure. [ 260.512714][T17602] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.525996][T17602] CPU: 1 UID: 0 PID: 17602 Comm: syz.1.3154 Not tainted syzkaller #0 PREEMPT(full) [ 260.526021][T17602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 260.526032][T17602] Call Trace: [ 260.526038][T17602] [ 260.526045][T17602] dump_stack_lvl+0x189/0x250 [ 260.526070][T17602] ? __pfx____ratelimit+0x10/0x10 [ 260.526094][T17602] ? __pfx_dump_stack_lvl+0x10/0x10 [ 260.526113][T17602] ? __pfx__printk+0x10/0x10 [ 260.526137][T17602] ? rcu_is_watching+0x15/0xb0 [ 260.526155][T17602] should_fail_ex+0x414/0x560 [ 260.526177][T17602] _copy_to_user+0x31/0xb0 [ 260.526190][T17602] simple_read_from_buffer+0xe1/0x170 [ 260.526206][T17602] proc_fail_nth_read+0x1b3/0x220 [ 260.526218][T17602] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 260.526229][T17602] ? rw_verify_area+0x2a6/0x4d0 [ 260.526240][T17602] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 260.526251][T17602] vfs_read+0x1fd/0xa30 [ 260.526264][T17602] ? __pfx_vfs_read+0x10/0x10 [ 260.526275][T17602] ? aa_sk_perm+0x81e/0x950 [ 260.526288][T17602] ? do_sys_openat2+0x154/0x1c0 [ 260.526299][T17602] ? __pfx_aa_sk_perm+0x10/0x10 [ 260.526313][T17602] ksys_read+0x145/0x250 [ 260.526335][T17602] ? __pfx_ksys_read+0x10/0x10 [ 260.526347][T17602] ? rcu_is_watching+0x15/0xb0 [ 260.526357][T17602] do_syscall_64+0xfa/0x3b0 [ 260.526366][T17602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.526375][T17602] ? clear_bhb_loop+0x60/0xb0 [ 260.526385][T17602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.526443][T17602] RIP: 0033:0x7fa0cd98d5fc [ 260.526453][T17602] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 260.526462][T17602] RSP: 002b:00007fa0cbbf6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 260.526474][T17602] RAX: ffffffffffffffda RBX: 00007fa0cdbb5fa0 RCX: 00007fa0cd98d5fc [ 260.526481][T17602] RDX: 000000000000000f RSI: 00007fa0cbbf60a0 RDI: 0000000000000004 [ 260.526487][T17602] RBP: 00007fa0cbbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 260.526493][T17602] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 260.526499][T17602] R13: 00007fa0cdbb6038 R14: 00007fa0cdbb5fa0 R15: 00007ffd7ac40188 [ 260.526510][T17602] [ 260.779744][ T1328] IPVS: stop unused estimator thread 0... [ 261.181617][T17418] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 261.213750][T17418] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 261.229581][T17418] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 261.253641][T17418] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 261.943163][T17418] 8021q: adding VLAN 0 to HW filter on device bond0 [ 261.968813][T17418] 8021q: adding VLAN 0 to HW filter on device team0 [ 261.981166][T16789] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.988408][T16789] bridge0: port 1(bridge_slave_0) entered forwarding state [ 262.038364][T16789] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.045634][T16789] bridge0: port 2(bridge_slave_1) entered forwarding state [ 262.160721][T17653] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 262.170085][T17653] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 262.190024][T17653] team0: Failed to send options change via netlink (err -105) [ 262.208674][T17653] team0: Port device batadv1 added [ 262.233259][T17652] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 262.257905][T17652] team0: Failed to send port change of device batadv2 via netlink (err -105) [ 262.306308][T17652] team0: Failed to send options change via netlink (err -105) [ 262.314166][T17652] team0: Port device batadv2 added [ 262.369423][ T50] Bluetooth: hci5: command tx timeout [ 262.498647][T17418] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 262.545227][T17666] !: renamed from dummy0 [ 262.586252][T17666] tipc: Disabling bearer [ 262.661511][T17418] veth0_vlan: entered promiscuous mode [ 262.676621][T17418] veth1_vlan: entered promiscuous mode [ 262.803246][T17418] veth0_macvtap: entered promiscuous mode [ 262.827489][T17418] veth1_macvtap: entered promiscuous mode [ 262.871704][T17418] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 262.888713][T17418] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 262.904841][T16789] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.921512][T16789] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.938803][T16789] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.958733][T16789] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.016502][T16786] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 263.054326][T16786] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 263.143526][ T1328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 263.159480][ T1328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 263.306621][T17685] lo speed is unknown, defaulting to 1000 [ 263.357698][T17687] netlink: 'syz.3.3105': attribute type 10 has an invalid length. [ 263.391343][T17689] __nla_validate_parse: 6 callbacks suppressed [ 263.391361][T17689] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3175'. [ 263.394408][T17687] team0: Port device dummy0 added [ 263.722575][T17685] hsr0 speed is unknown, defaulting to 1000 [ 264.454273][ T50] Bluetooth: hci5: command tx timeout [ 264.859672][T17616] Set syz1 is full, maxelem 65536 reached [ 264.875161][T17728] syzkaller0: tun_net_xmit 76 [ 264.880159][T17728] tipc: Enabled bearer , priority 0 [ 264.930080][T17728] tipc: Resetting bearer [ 265.229935][T17728] tipc: Disabling bearer [ 265.283503][T17732] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.362064][T17732] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.400650][T17742] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3187'. [ 265.481579][T17742] team0: Port device team_slave_0 removed [ 265.521261][T17732] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.600880][T17732] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.738684][T16789] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.819341][T16789] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.833916][T17752] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3189'. [ 265.874584][T16791] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.917868][T16791] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.942398][ T5860] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 265.949909][ T5860] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 265.960871][ T5860] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 265.968748][ T5860] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 265.976597][ T5860] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 266.035231][T17759] lo speed is unknown, defaulting to 1000 [ 266.182387][T17759] hsr0 speed is unknown, defaulting to 1000 [ 266.447052][T17759] chnl_net:caif_netlink_parms(): no params data found [ 266.592960][T17759] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.600939][T17759] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.609841][T17759] bridge_slave_0: entered allmulticast mode [ 266.618070][T17759] bridge_slave_0: entered promiscuous mode [ 266.630603][T17759] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.641704][T17759] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.651154][T17759] bridge_slave_1: entered allmulticast mode [ 266.662663][T17759] bridge_slave_1: entered promiscuous mode [ 266.670291][T17791] lo speed is unknown, defaulting to 1000 [ 266.700883][T17799] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3199'. [ 266.728027][T17799] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3199'. [ 266.730517][T17759] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 266.756754][T17759] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 266.786763][T17791] hsr0 speed is unknown, defaulting to 1000 [ 266.802050][T17759] team0: Port device team_slave_0 added [ 266.812773][T17759] team0: Port device team_slave_1 added [ 266.843821][T17759] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 266.851531][T17759] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 266.879492][T17759] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 266.894327][T17759] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 266.901360][T17759] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 266.928430][T17759] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 267.001003][T17759] hsr_slave_0: entered promiscuous mode [ 267.012761][T17759] hsr_slave_1: entered promiscuous mode [ 267.019105][T17759] debugfs: 'hsr0' already exists in 'hsr' [ 267.025433][T17759] Cannot create hsr debugfs directory [ 267.219234][T17759] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 267.236198][T17759] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 267.247876][T17759] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 267.257624][T17759] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 267.339534][T17759] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.360187][T17759] 8021q: adding VLAN 0 to HW filter on device team0 [ 267.382013][ T1328] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.389365][ T1328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.411096][T16790] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.418445][T16790] bridge0: port 2(bridge_slave_1) entered forwarding state [ 267.431874][T17821] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3206'. [ 267.446185][T17821] netlink: 328 bytes leftover after parsing attributes in process `syz.0.3206'. [ 267.496992][T17819] netlink: 666 bytes leftover after parsing attributes in process `syz.3.3205'. [ 267.646667][T17831] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3205'. [ 267.674958][T17759] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 267.736421][T17759] veth0_vlan: entered promiscuous mode [ 267.774471][T17759] veth1_vlan: entered promiscuous mode [ 267.817537][T17759] veth0_macvtap: entered promiscuous mode [ 267.827130][T17759] veth1_macvtap: entered promiscuous mode [ 267.853932][T17759] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 267.872004][T17759] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 267.898920][ T6162] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.913694][ T6162] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.932419][ T6162] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.003998][ T6162] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.059082][T17841] lo speed is unknown, defaulting to 1000 [ 268.082928][ T50] Bluetooth: hci3: command tx timeout [ 268.113922][T17844] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3211'. [ 268.154205][ T3565] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 268.162678][ T3565] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 268.241147][T17841] hsr0 speed is unknown, defaulting to 1000 [ 268.250578][ T6162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 268.263666][T17845] lo speed is unknown, defaulting to 1000 [ 268.272431][ T6162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 268.461680][T17845] hsr0 speed is unknown, defaulting to 1000 [ 268.470688][T17855] tun0: tun_chr_ioctl cmd 1074025673 [ 268.530758][T17854] tun0: tun_chr_ioctl cmd 2148045848 [ 268.539845][T17854] __nla_validate_parse: 2 callbacks suppressed [ 268.539861][T17854] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3214'. [ 268.703868][T17854] tun0: tun_chr_ioctl cmd 21731 [ 268.891200][T17891] tipc: Failed to obtain node identity [ 268.897644][T17891] tipc: Enabling of bearer rejected, failed to enable media [ 268.957697][T17895] syzkaller0: entered promiscuous mode [ 268.963464][T17895] syzkaller0: entered allmulticast mode [ 268.977061][T17895] netlink: 'syz.3.3224': attribute type 1 has an invalid length. [ 268.988075][T17895] netlink: 7 bytes leftover after parsing attributes in process `syz.3.3224'. [ 269.033633][T17894] lo speed is unknown, defaulting to 1000 [ 269.035861][T17889] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3223'. [ 269.055821][T17902] erspan0: entered allmulticast mode [ 269.095935][T17889] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3223'. [ 269.208364][T17907] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3228'. [ 269.220461][T17905] netlink: 'syz.0.3227': attribute type 9 has an invalid length. [ 269.260041][T17905] netlink: 184 bytes leftover after parsing attributes in process `syz.0.3227'. [ 269.277650][T17894] hsr0 speed is unknown, defaulting to 1000 [ 269.363258][T17913] netlink: 'syz.1.3229': attribute type 13 has an invalid length. [ 269.408061][T17913] netlink: 'syz.1.3229': attribute type 17 has an invalid length. [ 269.755457][T17940] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input5 [ 269.793789][T17952] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3240'. [ 269.857992][T17952] netlink: 'syz.1.3240': attribute type 1 has an invalid length. [ 269.876927][T17952] netlink: 'syz.1.3240': attribute type 1 has an invalid length. [ 269.985085][T17961] delete_channel: no stack [ 270.021892][T17964] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3246'. [ 270.053230][T17970] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3247'. [ 270.065283][T17974] netlink: 'syz.4.3248': attribute type 13 has an invalid length. [ 270.083721][T17974] netlink: 'syz.4.3248': attribute type 17 has an invalid length. [ 270.105800][T17965] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3247'. [ 270.188567][T17974] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 270.214749][ T50] Bluetooth: hci3: command tx timeout [ 270.220122][T17977] lo speed is unknown, defaulting to 1000 [ 270.303281][T17977] hsr0 speed is unknown, defaulting to 1000 [ 270.920601][T18018] netlink: 'syz.2.3263': attribute type 1 has an invalid length. [ 271.148965][T18040] macvtap1: entered allmulticast mode [ 271.168085][T18040] mac80211_hwsim hwsim44 wlan0: entered allmulticast mode [ 271.179000][T18040] batman_adv: batadv0: Adding interface: macvtap1 [ 271.186368][T18040] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 271.213625][T18040] batman_adv: batadv0: Interface activated: macvtap1 [ 271.309796][T18060] bridge_slave_0: left allmulticast mode [ 271.325779][T18060] bridge_slave_0: left promiscuous mode [ 271.341973][T18060] bridge0: port 1(bridge_slave_0) entered disabled state [ 271.365554][T18063] netlink: 'syz.2.3277': attribute type 3 has an invalid length. [ 271.380487][T18060] bridge_slave_1: left allmulticast mode [ 271.389244][T18060] bridge_slave_1: left promiscuous mode [ 271.395741][T18060] bridge0: port 2(bridge_slave_1) entered disabled state [ 271.408164][T18060] bond0: (slave bond_slave_0): Releasing backup interface [ 271.419800][T18060] bond0: (slave bond_slave_1): Releasing backup interface [ 271.431007][T18060] team0: Port device team_slave_0 removed [ 271.439234][T18060] team0: Port device team_slave_1 removed [ 271.445801][T18060] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 271.453955][T18060] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 271.466237][T18060] team0: Port device batadv1 removed [ 271.477389][T18060] team0: Port device batadv2 removed [ 271.489456][T18063] vlan0: entered promiscuous mode [ 271.500620][T18063] team0: Port device vlan0 added [ 271.660581][T18087] netlink: 'syz.2.3284': attribute type 11 has an invalid length. [ 271.702563][T18087] netlink: 'syz.2.3284': attribute type 11 has an invalid length. [ 271.712491][T18091] hsr_slave_1 (unregistering): left promiscuous mode [ 272.063427][T18118] lo speed is unknown, defaulting to 1000 [ 272.180963][T18118] hsr0 speed is unknown, defaulting to 1000 [ 272.284844][ T50] Bluetooth: hci3: command tx timeout [ 272.407787][T18133] gre1: entered allmulticast mode [ 272.417897][T18138] geneve2: entered promiscuous mode [ 272.431084][T18131] lo speed is unknown, defaulting to 1000 [ 272.492444][T18140] team0: Port device dummy0 removed [ 272.631447][T18151] tipc: Started in network mode [ 272.638811][T18151] tipc: Node identity 02eceff28dbb, cluster identity 4711 [ 272.656202][T18151] tipc: Enabled bearer , priority 0 [ 272.699086][T18151] syzkaller0: entered promiscuous mode [ 272.713699][T18151] syzkaller0: entered allmulticast mode [ 272.720387][T18131] hsr0 speed is unknown, defaulting to 1000 [ 272.779022][T18150] tipc: Resetting bearer [ 272.797928][T18150] tipc: Disabling bearer [ 273.061134][T18175] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 273.279135][T18189] 8021q: adding VLAN 0 to HW filter on device bond1 [ 273.320148][T18189] bond1: (slave wlan0): Enslaving as an active interface with a down link [ 273.359828][T18189] vlan2: entered allmulticast mode [ 273.366602][T18189] veth1: entered allmulticast mode [ 273.375034][T18189] veth1: entered promiscuous mode [ 273.381478][T18189] veth1: left promiscuous mode [ 273.390578][T18189] bond1: (slave vlan2): making interface the new active one [ 273.405699][T18189] veth1: entered promiscuous mode [ 273.413768][T18189] vlan2: entered promiscuous mode [ 273.420835][T18189] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 273.549692][T18211] __nla_validate_parse: 15 callbacks suppressed [ 273.549712][T18211] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3318'. [ 273.585035][T18213] IPv6: NLM_F_REPLACE set, but no existing node found! [ 273.619326][T18204] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.627334][T18204] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.711194][T18204] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 273.726366][T18204] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 274.160551][T18209] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3317'. [ 274.186205][T18214] 8021q: VLANs not supported on ip6tnl0 [ 274.198666][T18231] validate_nla: 10 callbacks suppressed [ 274.198688][T18231] netlink: 'syz.0.3321': attribute type 12 has an invalid length. [ 274.235329][T16786] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 274.247281][T16786] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 274.276522][T18234] netlink: 'syz.4.3323': attribute type 16 has an invalid length. [ 274.288034][T18234] netlink: 55946 bytes leftover after parsing attributes in process `syz.4.3323'. [ 274.304894][T16786] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 274.318774][T16786] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 274.367471][ T50] Bluetooth: hci3: command tx timeout [ 274.382752][T18237] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3324'. [ 274.416917][T18244] tipc: Started in network mode [ 274.426573][T18244] tipc: Node identity faa1d468e794, cluster identity 4711 [ 274.438714][T18244] tipc: Enabled bearer , priority 0 [ 274.454346][ C1] bridge0: port 1(dummy0) entered forwarding state [ 274.461701][ C1] bridge0: topology change detected, propagating [ 274.482722][T18244] syzkaller0: entered promiscuous mode [ 274.490545][T18244] syzkaller0: entered allmulticast mode [ 274.563917][T18256] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3327'. [ 274.565109][T18248] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3328'. [ 274.589798][T18247] lo speed is unknown, defaulting to 1000 [ 274.679744][T18256] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3327'. [ 274.720532][T18248] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3328'. [ 274.787211][T18266] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3331'. [ 274.816815][T18266] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3331'. [ 274.910427][T18240] tipc: Resetting bearer [ 274.932273][T18240] tipc: Disabling bearer [ 274.952824][T18247] hsr0 speed is unknown, defaulting to 1000 [ 274.952831][T18251] lo speed is unknown, defaulting to 1000 [ 275.048467][T18251] hsr0 speed is unknown, defaulting to 1000 [ 275.648941][T18317] netlink: 'syz.2.3346': attribute type 2 has an invalid length. [ 275.723531][T18319] lo speed is unknown, defaulting to 1000 [ 275.880010][T18319] hsr0 speed is unknown, defaulting to 1000 [ 276.216949][T18353] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 276.312469][T18360] tipc: Enabled bearer , priority 0 [ 276.328566][T18360] syzkaller0: entered promiscuous mode [ 276.335086][T18360] syzkaller0: entered allmulticast mode [ 276.349718][T18360] tipc: Resetting bearer [ 276.379760][T18358] tipc: Resetting bearer [ 276.419787][T18358] tipc: Disabling bearer [ 276.537412][T18364] lo speed is unknown, defaulting to 1000 [ 276.646086][T18329] delete_channel: no stack [ 276.863014][T18364] hsr0 speed is unknown, defaulting to 1000 [ 277.000582][T18387] lo speed is unknown, defaulting to 1000 [ 277.220672][T18387] hsr0 speed is unknown, defaulting to 1000 [ 277.537475][T18419] netlink: 'syz.1.3368': attribute type 8 has an invalid length. [ 277.622395][T18425] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 277.663545][T18428] tipc: Started in network mode [ 277.670739][T18425] netlink: 'syz.0.3372': attribute type 2 has an invalid length. [ 277.677479][T18428] tipc: Node identity 42accba34c3d, cluster identity 4711 [ 277.711985][T18428] tipc: Enabled bearer , priority 0 [ 277.729820][T18431] netlink: 'syz.4.3373': attribute type 2 has an invalid length. [ 277.741909][T18431] þ: entered promiscuous mode [ 277.753525][T18428] syzkaller0: entered promiscuous mode [ 277.760013][T18428] syzkaller0: entered allmulticast mode [ 277.778525][T18430] mac80211_hwsim hwsim51 wlan1: entered promiscuous mode [ 277.781265][T18433] netlink: 'syz.0.3372': attribute type 10 has an invalid length. [ 277.793194][T18430] macsec2: entered promiscuous mode [ 277.815797][T18430] mac80211_hwsim hwsim51 wlan1: left promiscuous mode [ 277.843394][T18427] tipc: Resetting bearer [ 277.852735][T18427] tipc: Disabling bearer [ 277.865242][T18433] batman_adv: batadv0: Adding interface: netdevsim0 [ 277.872038][T18433] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 277.901484][T18433] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 278.067407][T18449] lo speed is unknown, defaulting to 1000 [ 278.082229][T18450] sit0: entered promiscuous mode [ 278.088391][T18450] netlink: 'syz.0.3382': attribute type 1 has an invalid length. [ 278.173936][T18460] bond0: (slave ipvlan1): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 278.226740][T18460] bond0: (slave ipvlan1): The slave device specified does not support setting the MAC address [ 278.264620][T18460] bond0: (slave ipvlan1): Error -95 calling set_mac_address [ 278.337189][T18449] hsr0 speed is unknown, defaulting to 1000 [ 278.339148][T18473] netlink: 'syz.0.3388': attribute type 21 has an invalid length. [ 278.517076][T18484] netlink: 'syz.0.3391': attribute type 4 has an invalid length. [ 278.540718][T18484] Ã: renamed from bond0 [ 278.598377][T18487] ieee802154 phy0 wpan0: encryption failed: -22 [ 278.606716][T18487] __nla_validate_parse: 18 callbacks suppressed [ 278.606737][T18487] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3392'. [ 278.647280][T18487] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3392'. [ 278.669518][T18491] lo speed is unknown, defaulting to 1000 [ 278.694830][T18493] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3395'. [ 278.760269][T18496] tipc: Enabled bearer , priority 0 [ 278.777936][T18496] syzkaller0: entered promiscuous mode [ 278.793185][T18496] syzkaller0: entered allmulticast mode [ 278.819548][T18496] tipc: Resetting bearer [ 278.837707][T18496] tipc: Disabling bearer [ 279.001828][T18491] hsr0 speed is unknown, defaulting to 1000 [ 279.117171][T18505] lo speed is unknown, defaulting to 1000 [ 279.322019][T18520] netlink: 558 bytes leftover after parsing attributes in process `syz.4.3401'. [ 279.455637][T18525] veth1_to_bridge: mtu less than device minimum [ 279.534680][T18530] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3402'. [ 279.579352][T18529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3403'. [ 279.579568][T18505] hsr0 speed is unknown, defaulting to 1000 [ 279.595486][T18526] lo speed is unknown, defaulting to 1000 [ 279.648976][T18508] syzkaller1: entered promiscuous mode [ 279.657884][T18508] syzkaller1: entered allmulticast mode [ 279.672997][T18508] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3398'. [ 279.700852][T18529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3403'. [ 279.892469][T18526] hsr0 speed is unknown, defaulting to 1000 [ 279.976790][T18542] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3406'. [ 280.051930][T18547] netlink: 248 bytes leftover after parsing attributes in process `syz.0.3408'. [ 280.085868][T18546] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 280.198727][T18548] lo speed is unknown, defaulting to 1000 [ 280.379704][T18561] validate_nla: 2 callbacks suppressed [ 280.379723][T18561] netlink: 'syz.4.3411': attribute type 13 has an invalid length. [ 280.406447][T18561] (unnamed net_device) (uninitialized): option fail_over_mac: invalid value (6) [ 280.455999][T18548] hsr0 speed is unknown, defaulting to 1000 [ 281.417261][T18593] bridge3: port 1(bond1) entered blocking state [ 281.451216][T18593] bridge3: port 1(bond1) entered disabled state [ 281.493679][T18593] bond1: entered allmulticast mode [ 281.515431][T18593] bond1: entered promiscuous mode [ 281.892498][T18624] netlink: 'syz.0.3429': attribute type 12 has an invalid length. [ 282.199109][T18638] vlan2: entered allmulticast mode [ 282.345757][T18638] bond1: entered allmulticast mode [ 282.972519][T18656] lo speed is unknown, defaulting to 1000 [ 283.357055][T18656] hsr0 speed is unknown, defaulting to 1000 [ 283.357107][T18665] lo speed is unknown, defaulting to 1000 [ 283.675393][T18665] hsr0 speed is unknown, defaulting to 1000 [ 283.706837][T18674] lo speed is unknown, defaulting to 1000 [ 283.745456][T18677] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 283.909556][T18674] hsr0 speed is unknown, defaulting to 1000 [ 284.081982][T18692] netem: change failed [ 284.241543][T18704] IPVS: Scheduler module ip_vs_sip not found [ 284.252650][T18704] __nla_validate_parse: 10 callbacks suppressed [ 284.252671][T18704] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3452'. [ 284.647589][T16774] vlan2: left promiscuous mode [ 284.745266][T18730] netlink: 'syz.1.3461': attribute type 39 has an invalid length. [ 284.966056][T18734] veth3: left promiscuous mode [ 284.971434][T18734] veth5: left promiscuous mode [ 285.058531][T18739] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3464'. [ 285.164579][T18741] siw: device registration error -23 [ 285.175005][T18741] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3463'. [ 285.285426][T18748] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3466'. [ 285.328432][T18748] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3466'. [ 285.337994][T18748] netlink: 'syz.1.3466': attribute type 18 has an invalid length. [ 285.352043][T18748] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3466'. [ 285.352123][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 285.361833][T18748] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3466'. [ 285.361862][T18748] netlink: 'syz.1.3466': attribute type 18 has an invalid length. [ 285.426851][ T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 285.512912][T18734] lo speed is unknown, defaulting to 1000 [ 285.552707][ T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 285.582813][ T13] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 285.610100][T18734] hsr0 speed is unknown, defaulting to 1000 [ 285.862330][T18773] openvswitch: netlink: IP tunnel dst address not specified [ 286.458861][T18809] netlink: 'syz.0.3489': attribute type 4 has an invalid length. [ 286.476146][T18802] Bluetooth: MGMT ver 1.23 [ 286.478363][T18812] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 286.495587][T18809] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3489'. [ 286.567094][T18816] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3489'. [ 286.869539][T18834] lo speed is unknown, defaulting to 1000 [ 286.965397][T18845] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 287.392277][T18844] lo speed is unknown, defaulting to 1000 [ 287.399591][T18834] hsr0 speed is unknown, defaulting to 1000 [ 287.938978][T18844] hsr0 speed is unknown, defaulting to 1000 [ 288.102338][T18858] lo speed is unknown, defaulting to 1000 [ 288.260602][T18866] netlink: 576 bytes leftover after parsing attributes in process `syz.3.3504'. [ 288.297846][T18858] hsr0 speed is unknown, defaulting to 1000 [ 288.625149][T18891] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 288.649291][T18891] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 288.675849][T18891] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 288.873814][T18904] netlink: 'syz.3.3513': attribute type 4 has an invalid length. [ 289.823711][T18959] __nla_validate_parse: 6 callbacks suppressed [ 289.823730][T18959] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3529'. [ 289.893623][T18957] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3530'. [ 289.914691][T18957] bridge_slave_1: left allmulticast mode [ 289.920787][T18957] bridge_slave_1: left promiscuous mode [ 289.930500][T18957] bridge0: port 2(bridge_slave_1) entered disabled state [ 289.940973][T18957] bridge_slave_0: left allmulticast mode [ 289.952470][T18957] bridge_slave_0: left promiscuous mode [ 289.979097][T18957] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.056447][T18967] veth1_to_team: entered allmulticast mode [ 290.068599][T18967] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3533'. [ 290.081802][T18968] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3532'. [ 290.098885][T18968] team0: entered promiscuous mode [ 290.120306][T18968] team_slave_0: entered promiscuous mode [ 290.130772][T18968] team_slave_1: entered promiscuous mode [ 290.142524][T18968] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 290.151752][T18968] team0: left promiscuous mode [ 290.159172][T18968] team_slave_0: left promiscuous mode [ 290.168543][T18968] team_slave_1: left promiscuous mode [ 290.193447][T18974] netlink: 576 bytes leftover after parsing attributes in process `syz.4.3534'. [ 290.280620][T18985] netlink: 'syz.1.3538': attribute type 4 has an invalid length. [ 290.302119][T18985] netlink: 'syz.1.3538': attribute type 4 has an invalid length. [ 290.366496][T18992] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3541'. [ 290.625115][T18983] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.632959][T18983] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.970919][T18983] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 290.991446][T18983] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 291.223510][T18992] lo speed is unknown, defaulting to 1000 [ 291.311895][T16774] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.348264][T16774] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.367103][T19015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3544'. [ 291.430142][T16774] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.452299][T16774] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.484813][T19014] netlink: 'syz.2.3546': attribute type 10 has an invalid length. [ 291.503204][T18992] hsr0 speed is unknown, defaulting to 1000 [ 291.513607][T19014] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3546'. [ 291.535230][T19014] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3546'. [ 291.554291][T19014] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3546'. [ 291.573515][T19015] syzkaller0: entered promiscuous mode [ 291.580237][T19015] syzkaller0: entered allmulticast mode [ 291.620870][T19028] lo speed is unknown, defaulting to 1000 [ 291.760443][T19039] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 291.785326][T19039] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 291.863024][T19034] lo speed is unknown, defaulting to 1000 [ 292.020597][T19034] hsr0 speed is unknown, defaulting to 1000 [ 292.080647][T19028] hsr0 speed is unknown, defaulting to 1000 [ 292.232189][T19056] lo speed is unknown, defaulting to 1000 [ 292.644525][T19056] hsr0 speed is unknown, defaulting to 1000 [ 293.050945][T19074] lo speed is unknown, defaulting to 1000 [ 293.248200][ T9879] IPVS: starting estimator thread 0... [ 293.285322][T19074] hsr0 speed is unknown, defaulting to 1000 [ 293.414398][T19083] IPVS: using max 48 ests per chain, 115200 per kthread [ 293.597149][T19088] netlink: 'syz.4.3566': attribute type 3 has an invalid length. [ 293.608526][T19088] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 293.685840][T19090] netlink: 'syz.4.3567': attribute type 2 has an invalid length. [ 293.714627][T19090] netlink: 'syz.4.3567': attribute type 2 has an invalid length. [ 293.769659][T19097] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 293.809943][T19096] sctp: [Deprecated]: syz.3.3569 (pid 19096) Use of int in maxseg socket option. [ 293.809943][T19096] Use struct sctp_assoc_value instead [ 293.999041][T19108] lo speed is unknown, defaulting to 1000 [ 294.129906][T19108] hsr0 speed is unknown, defaulting to 1000 [ 294.218610][T19122] netlink: 'syz.4.3577': attribute type 6 has an invalid length. [ 294.271316][T19122] netlink: 'syz.4.3577': attribute type 4 has an invalid length. [ 294.552441][T19133] netlink: 'syz.3.3580': attribute type 1 has an invalid length. [ 294.991361][T19157] tipc: Enabled bearer , priority 0 [ 295.046812][T19156] tipc: Resetting bearer [ 295.102105][T19156] tipc: Disabling bearer [ 295.112497][T19168] lo speed is unknown, defaulting to 1000 [ 295.239522][T19168] hsr0 speed is unknown, defaulting to 1000 [ 295.281731][T19184] netlink: 'syz.2.3594': attribute type 12 has an invalid length. [ 295.908845][T19216] lo speed is unknown, defaulting to 1000 [ 295.970570][T19219] netlink: 'syz.2.3604': attribute type 1 has an invalid length. [ 296.157220][T19216] hsr0 speed is unknown, defaulting to 1000 [ 296.323172][T19234] __nla_validate_parse: 10 callbacks suppressed [ 296.323192][T19234] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3609'. [ 296.485883][T19235] geneve2: entered promiscuous mode [ 296.803754][T19252] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3616'. [ 296.821143][T19251] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3616'. [ 296.831098][T19252] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3616'. [ 296.845269][T19251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3616'. [ 296.941781][T19256] batadv1: entered promiscuous mode [ 296.965549][T19260] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3617'. [ 297.064894][T19263] netlink: 'syz.3.3621': attribute type 4 has an invalid length. [ 297.599377][T19302] netlink: 'syz.0.3634': attribute type 1 has an invalid length. [ 297.611315][T19302] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3634'. [ 297.669338][T19302] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3634'. [ 297.748939][T19310] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3637'. [ 297.760722][T19310] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3637'. [ 297.893068][T19324] tipc: Enabled bearer , priority 0 [ 297.906189][T19324] ip6gre0: entered promiscuous mode [ 297.993050][T19324] lo speed is unknown, defaulting to 1000 [ 298.076037][T19333] FAULT_INJECTION: forcing a failure. [ 298.076037][T19333] name failslab, interval 1, probability 0, space 0, times 0 [ 298.107272][T19333] CPU: 0 UID: 0 PID: 19333 Comm: syz.3.3644 Not tainted syzkaller #0 PREEMPT(full) [ 298.107295][T19333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 298.107305][T19333] Call Trace: [ 298.107312][T19333] [ 298.107319][T19333] dump_stack_lvl+0x189/0x250 [ 298.107344][T19333] ? __pfx____ratelimit+0x10/0x10 [ 298.107366][T19333] ? __pfx_dump_stack_lvl+0x10/0x10 [ 298.107385][T19333] ? __pfx__printk+0x10/0x10 [ 298.107407][T19333] ? fs_reclaim_acquire+0x7d/0x100 [ 298.107432][T19333] ? __pfx___might_resched+0x10/0x10 [ 298.107448][T19333] ? lock_acquire+0x5f/0x360 [ 298.107470][T19333] should_fail_ex+0x414/0x560 [ 298.107492][T19333] ? rhashtable_init_noprof+0x4ee/0xbb0 [ 298.107508][T19333] should_failslab+0xa8/0x100 [ 298.107530][T19333] __kvmalloc_node_noprof+0x161/0x5f0 [ 298.107551][T19333] ? rhashtable_init_noprof+0x4ee/0xbb0 [ 298.107570][T19333] rhashtable_init_noprof+0x4ee/0xbb0 [ 298.107590][T19333] rhltable_init_noprof+0x1e/0x60 [ 298.107608][T19333] nf_tables_newtable+0x68f/0x1890 [ 298.107636][T19333] nfnetlink_rcv+0x112f/0x2520 [ 298.107672][T19333] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 298.107697][T19333] ? kasan_save_track+0x4f/0x80 [ 298.107715][T19333] ? kasan_save_track+0x3e/0x80 [ 298.107732][T19333] ? __kasan_slab_alloc+0x6c/0x80 [ 298.107762][T19333] ? netlink_deliver_tap+0x2e/0x1b0 [ 298.107784][T19333] ? rcu_is_watching+0x15/0xb0 [ 298.107801][T19333] ? netlink_deliver_tap+0x2e/0x1b0 [ 298.107826][T19333] ? lock_release+0x4b/0x3e0 [ 298.107846][T19333] ? net_generic+0x1e/0x240 [ 298.107864][T19333] ? net_generic+0x1e/0x240 [ 298.107887][T19333] netlink_unicast+0x82f/0x9e0 [ 298.107912][T19333] ? __pfx_netlink_unicast+0x10/0x10 [ 298.107934][T19333] ? netlink_sendmsg+0x642/0xb30 [ 298.107953][T19333] ? skb_put+0x11b/0x210 [ 298.107970][T19333] netlink_sendmsg+0x805/0xb30 [ 298.107989][T19333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 298.108007][T19333] ? aa_sock_msg_perm+0xf1/0x1d0 [ 298.108024][T19333] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 298.108042][T19333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 298.108057][T19333] __sock_sendmsg+0x219/0x270 [ 298.108080][T19333] ____sys_sendmsg+0x505/0x830 [ 298.108101][T19333] ? __pfx_____sys_sendmsg+0x10/0x10 [ 298.108122][T19333] ? import_iovec+0x74/0xa0 [ 298.108143][T19333] ___sys_sendmsg+0x21f/0x2a0 [ 298.108161][T19333] ? __pfx____sys_sendmsg+0x10/0x10 [ 298.108195][T19333] ? __fget_files+0x2a/0x420 [ 298.108217][T19333] ? __fget_files+0x3a0/0x420 [ 298.108236][T19333] __x64_sys_sendmsg+0x19b/0x260 [ 298.108256][T19333] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 298.108278][T19333] ? __pfx_ksys_write+0x10/0x10 [ 298.108298][T19333] ? rcu_is_watching+0x15/0xb0 [ 298.108316][T19333] ? rcu_is_watching+0x15/0xb0 [ 298.108334][T19333] do_syscall_64+0xfa/0x3b0 [ 298.108350][T19333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.108367][T19333] ? clear_bhb_loop+0x60/0xb0 [ 298.108386][T19333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.108403][T19333] RIP: 0033:0x7fd3c8b8ebe9 [ 298.108419][T19333] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 298.108435][T19333] RSP: 002b:00007fd3c99e3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 298.108454][T19333] RAX: ffffffffffffffda RBX: 00007fd3c8db5fa0 RCX: 00007fd3c8b8ebe9 [ 298.108467][T19333] RDX: 0000000000008040 RSI: 0000200000000180 RDI: 0000000000000003 [ 298.108478][T19333] RBP: 00007fd3c99e3090 R08: 0000000000000000 R09: 0000000000000000 [ 298.108488][T19333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 298.108498][T19333] R13: 00007fd3c8db6038 R14: 00007fd3c8db5fa0 R15: 00007fff0d2a4ea8 [ 298.108520][T19333] [ 298.732077][T19352] netlink: 'syz.3.3648': attribute type 5 has an invalid length. [ 298.768571][T19324] hsr0 speed is unknown, defaulting to 1000 [ 298.772335][T19336] lo speed is unknown, defaulting to 1000 [ 298.810339][T19362] netlink: 'syz.1.3650': attribute type 3 has an invalid length. [ 298.833214][T19323] tipc: Disabling bearer [ 298.968012][T19336] hsr0 speed is unknown, defaulting to 1000 [ 299.048636][T19383] FAULT_INJECTION: forcing a failure. [ 299.048636][T19383] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 299.067092][T19383] CPU: 1 UID: 0 PID: 19383 Comm: syz.4.3656 Not tainted syzkaller #0 PREEMPT(full) [ 299.067117][T19383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 299.067127][T19383] Call Trace: [ 299.067134][T19383] [ 299.067142][T19383] dump_stack_lvl+0x189/0x250 [ 299.067167][T19383] ? __pfx____ratelimit+0x10/0x10 [ 299.067228][T19383] ? __pfx_dump_stack_lvl+0x10/0x10 [ 299.067248][T19383] ? __pfx__printk+0x10/0x10 [ 299.067272][T19383] ? rcu_is_watching+0x15/0xb0 [ 299.067291][T19383] should_fail_ex+0x414/0x560 [ 299.067321][T19383] _copy_to_user+0x31/0xb0 [ 299.067342][T19383] simple_read_from_buffer+0xe1/0x170 [ 299.067367][T19383] proc_fail_nth_read+0x1b3/0x220 [ 299.067387][T19383] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 299.067405][T19383] ? rw_verify_area+0x2a6/0x4d0 [ 299.067425][T19383] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 299.067444][T19383] vfs_read+0x1fd/0xa30 [ 299.067464][T19383] ? fdget_pos+0x247/0x320 [ 299.067481][T19383] ? __pfx___mutex_lock+0x10/0x10 [ 299.067505][T19383] ? __pfx_vfs_read+0x10/0x10 [ 299.067528][T19383] ? __fget_files+0x3a0/0x420 [ 299.067542][T19383] ? __fget_files+0x2a/0x420 [ 299.067561][T19383] ksys_read+0x145/0x250 [ 299.067582][T19383] ? __pfx_ksys_read+0x10/0x10 [ 299.067601][T19383] ? rcu_is_watching+0x15/0xb0 [ 299.067619][T19383] ? rcu_is_watching+0x15/0xb0 [ 299.067638][T19383] do_syscall_64+0xfa/0x3b0 [ 299.067653][T19383] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.067670][T19383] ? clear_bhb_loop+0x60/0xb0 [ 299.067688][T19383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.067705][T19383] RIP: 0033:0x7ff2f538d5fc [ 299.067720][T19383] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 299.067735][T19383] RSP: 002b:00007ff2f616f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 299.067753][T19383] RAX: ffffffffffffffda RBX: 00007ff2f55b5fa0 RCX: 00007ff2f538d5fc [ 299.067767][T19383] RDX: 000000000000000f RSI: 00007ff2f616f0a0 RDI: 0000000000000004 [ 299.067779][T19383] RBP: 00007ff2f616f090 R08: 0000000000000000 R09: 0000000000000000 [ 299.067790][T19383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 299.067800][T19383] R13: 00007ff2f55b6038 R14: 00007ff2f55b5fa0 R15: 00007fffb2748578 [ 299.067820][T19383] [ 299.333873][T19388] bond0: (slave bond_slave_1): Releasing backup interface [ 299.469153][T19364] lo speed is unknown, defaulting to 1000 [ 299.741236][T19364] hsr0 speed is unknown, defaulting to 1000 [ 299.772678][T19420] netlink: 'syz.1.3663': attribute type 1 has an invalid length. [ 299.892815][T19423] IPVS: set_ctl: invalid protocol: 51 224.0.0.2:20003 [ 299.908326][T19423] sctp: [Deprecated]: syz.4.3666 (pid 19423) Use of int in max_burst socket option deprecated. [ 299.908326][T19423] Use struct sctp_assoc_value instead [ 299.935580][T19421] lo speed is unknown, defaulting to 1000 [ 300.041936][T19421] hsr0 speed is unknown, defaulting to 1000 [ 300.208490][T19442] !: renamed from dummy0 [ 300.218642][T19438] netlink: 'syz.0.3672': attribute type 1 has an invalid length. [ 300.416636][T19449] lo speed is unknown, defaulting to 1000 [ 300.421588][ T30] audit: type=1800 audit(1756319952.758:13): pid=19454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3674" name=5D80CEFF4AA6DC5F710E8DF1F7582C892AF8D26C5BD9C07CAA9E7DED20F3F5CE5E3A882A02450DCF19 dev="tmpfs" ino=630 res=0 errno=0 [ 300.581321][T19467] netlink: 'syz.0.3676': attribute type 8 has an invalid length. [ 300.692246][T19449] hsr0 speed is unknown, defaulting to 1000 [ 300.892973][T19479] pim6reg: entered allmulticast mode [ 300.932098][T19483] pim6reg: left allmulticast mode [ 301.227318][T19496] netlink: 'syz.1.3683': attribute type 1 has an invalid length. [ 301.299739][T19496] netlink: 'syz.1.3683': attribute type 1 has an invalid length. [ 301.324010][T19513] vxcan1: entered allmulticast mode [ 301.339654][T19513] vxcan1: left allmulticast mode [ 301.357397][T19508] netlink: 'syz.4.3684': attribute type 1 has an invalid length. [ 301.394752][T19508] __nla_validate_parse: 18 callbacks suppressed [ 301.394796][T19508] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3684'. [ 301.416046][T19517] netlink: 'syz.0.3689': attribute type 11 has an invalid length. [ 301.431234][T19496] 8021q: adding VLAN 0 to HW filter on device bond2 [ 301.449474][T19517] netlink: 'syz.0.3689': attribute type 11 has an invalid length. [ 301.458889][T19517] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3689'. [ 301.529208][T19496] vlan3: entered allmulticast mode [ 301.537238][T19496] veth1: entered allmulticast mode [ 301.543675][T19496] bond2: (slave vlan3): Opening slave failed [ 301.688148][T19536] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3702'. [ 301.823119][T19549] lo speed is unknown, defaulting to 1000 [ 301.899277][T19546] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3696'. [ 301.983638][T19552] lo speed is unknown, defaulting to 1000 [ 301.990716][T19549] hsr0 speed is unknown, defaulting to 1000 [ 301.993745][T19557] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3697'. [ 301.997638][T19546] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3696'. [ 302.009664][T19557] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3697'. [ 302.218627][T19568] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3699'. [ 302.347830][T19552] hsr0 speed is unknown, defaulting to 1000 [ 302.475858][T19586] validate_nla: 4 callbacks suppressed [ 302.475878][T19586] netlink: 'syz.4.3708': attribute type 1 has an invalid length. [ 302.526233][T19586] netlink: 'syz.4.3708': attribute type 1 has an invalid length. [ 302.689474][T19586] netlink: 'syz.4.3708': attribute type 1 has an invalid length. [ 302.713192][T19586] 8021q: adding VLAN 0 to HW filter on device bond2 [ 302.768943][T19586] bond2: (slave wlan0): Enslaving as an active interface with a down link [ 302.815518][T19586] vlan2: entered allmulticast mode [ 302.821183][T19586] veth1: entered allmulticast mode [ 302.831705][T19586] bond2: (slave vlan2): Opening slave failed [ 302.862129][T19604] netlink: 'syz.2.3713': attribute type 13 has an invalid length. [ 302.871091][T19604] netlink: 'syz.2.3713': attribute type 17 has an invalid length. [ 302.891920][T19604] ip6gre0: left promiscuous mode [ 302.924878][T19604] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 302.960019][T19607] netlink: 'syz.4.3714': attribute type 16 has an invalid length. [ 302.979220][T19601] lo speed is unknown, defaulting to 1000 [ 303.064497][T19607] netlink: 'syz.4.3714': attribute type 17 has an invalid length. [ 303.143075][T16778] bond0: (slave bond_slave_0): interface is now down [ 303.154553][T19607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 303.163576][T19607] 8021q: adding VLAN 0 to HW filter on device team0 [ 303.172476][ T6019] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 303.181877][T16778] bond0: (slave bond_slave_0): interface is now down [ 303.194661][T19607] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 303.210618][T16790] bond0: (slave bond_slave_0): interface is now down [ 303.218680][T19601] hsr0 speed is unknown, defaulting to 1000 [ 303.264584][T16790] bond0: (slave bond_slave_0): interface is now down [ 303.298808][T16778] bond0: (slave bond_slave_0): interface is now down [ 303.321590][T19616] bridge0: port 1(veth0_to_team) entered blocking state [ 303.329328][T19616] bridge0: port 1(veth0_to_team) entered disabled state [ 303.332595][T16790] bond0: (slave bond_slave_0): interface is now down [ 303.345471][T19616] veth0_to_team: entered allmulticast mode [ 303.369653][T16790] bond0: (slave bond_slave_0): interface is now down [ 303.383022][T19616] veth0_to_team: entered promiscuous mode [ 303.390577][T19622] veth0_to_team: left allmulticast mode [ 303.397016][T19622] veth0_to_team: left promiscuous mode [ 303.403260][T19622] bridge0: port 1(veth0_to_team) entered disabled state [ 303.411440][T16790] bond0: (slave bond_slave_0): interface is now down [ 303.444602][T16775] bond0: (slave bond_slave_0): interface is now down [ 303.487980][T16775] bond0: now running without any active interface! [ 303.550473][T19628] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3719'. [ 303.580367][T19620] lo speed is unknown, defaulting to 1000 [ 303.691994][T19632] netlink: 'syz.3.3722': attribute type 1 has an invalid length. [ 303.700630][ T6019] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 303.719550][T19643] netlink: 'syz.3.3722': attribute type 1 has an invalid length. [ 303.763366][T19631] netlink: 'syz.3.3722': attribute type 10 has an invalid length. [ 303.819830][T19648] tipc: Enabled bearer , priority 10 [ 303.893717][T19620] hsr0 speed is unknown, defaulting to 1000 [ 304.158335][T16775] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 304.236952][T19658] siw: device registration error -23 [ 304.258494][T19662] erspan0: left allmulticast mode [ 304.319610][T19662] gre1: left allmulticast mode [ 304.351266][T19662] vlan2: left allmulticast mode [ 304.357066][T19662] veth1: left allmulticast mode [ 304.408643][T19670] tipc: Enabled bearer , priority 0 [ 304.449453][T19670] syzkaller0: entered promiscuous mode [ 304.457884][T19670] syzkaller0: entered allmulticast mode [ 304.521716][T19670] tipc: Resetting bearer [ 304.551563][T19669] tipc: Resetting bearer [ 304.580918][T19669] tipc: Disabling bearer [ 304.716720][T19691] tipc: Enabled bearer , priority 0 [ 304.725740][T19691] syzkaller0: entered promiscuous mode [ 304.732156][T19691] syzkaller0: entered allmulticast mode [ 304.787622][T19691] tipc: Resetting bearer [ 304.813063][T19690] tipc: Resetting bearer [ 304.826671][T19690] tipc: Disabling bearer [ 304.934174][ T6019] tipc: Node number set to 490067048 [ 304.983195][T19721] tipc: Enabled bearer , priority 0 [ 305.003828][T19721] syzkaller0: entered promiscuous mode [ 305.020075][T19721] syzkaller0: entered allmulticast mode [ 305.047198][T19720] tipc: Resetting bearer [ 305.106805][T19720] tipc: Disabling bearer [ 305.143525][T19731] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 305.197344][T16775] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 305.213082][T19738] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3751'. [ 305.232256][T16775] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 305.254883][T19728] syzkaller1: entered promiscuous mode [ 305.275592][T19728] syzkaller1: entered allmulticast mode [ 305.591057][T19761] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 305.648835][T19761] mac80211_hwsim hwsim51 wlan1: entered allmulticast mode [ 305.962903][T19791] lo speed is unknown, defaulting to 1000 [ 306.048367][ T9879] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 306.229177][T19809] lo speed is unknown, defaulting to 1000 [ 306.229177][T19791] hsr0 speed is unknown, defaulting to 1000 [ 306.315140][T19820] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 306.441129][T19809] hsr0 speed is unknown, defaulting to 1000 [ 306.899880][T19855] __nla_validate_parse: 9 callbacks suppressed [ 306.899900][T19855] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3794'. [ 307.099623][T19875] vlan2: entered promiscuous mode [ 307.153127][T19875] team0: entered promiscuous mode [ 307.171512][T19875] team_slave_0: entered promiscuous mode [ 307.182758][T19875] team_slave_1: entered promiscuous mode [ 307.196532][T19875] team0: Device vlan2 is already an upper device of the team interface [ 307.223085][T19884] mac80211_hwsim hwsim51 wlan1: left allmulticast mode [ 307.237829][T19881] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3800'. [ 307.520489][T19914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3808'. [ 307.560980][T19921] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 307.756752][T19935] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3816'. [ 307.773525][T19928] pim6reg1: entered promiscuous mode [ 307.794338][T19928] pim6reg1: entered allmulticast mode [ 307.869830][T19938] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3819'. [ 307.898240][T19935] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3816'. [ 307.917301][T19938] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3819'. [ 307.975645][T19943] netlink: del zone limit has 4 unknown bytes [ 308.075896][T19946] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3822'. [ 308.092956][T19954] vlan2: entered promiscuous mode [ 308.099546][T19954] bridge0: entered promiscuous mode [ 308.107082][T19954] bridge0: port 3(vlan2) entered blocking state [ 308.141601][T19954] bridge0: port 3(vlan2) entered disabled state [ 308.148586][T19954] vlan2: entered allmulticast mode [ 308.154589][T19954] bridge0: entered allmulticast mode [ 308.161317][T19954] vlan2: left allmulticast mode [ 308.167467][T19954] bridge0: left allmulticast mode [ 308.186135][T19960] syzkaller0: entered promiscuous mode [ 308.192072][T19960] syzkaller0: entered allmulticast mode [ 308.206120][T19952] lo speed is unknown, defaulting to 1000 [ 308.327505][T19965] mac80211_hwsim hwsim52 wlan0: entered promiscuous mode [ 308.352456][T19965] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3827'. [ 308.376033][T19965] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 308.407297][T19952] hsr0 speed is unknown, defaulting to 1000 [ 308.593115][T19987] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3831'. [ 308.623554][T19987] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 308.648196][T19991] validate_nla: 4 callbacks suppressed [ 308.648216][T19991] netlink: 'syz.2.3833': attribute type 2 has an invalid length. [ 308.717924][T19993] tipc: Enabled bearer , priority 0 [ 308.749239][T19998] syzkaller0: entered promiscuous mode [ 308.755975][T19998] syzkaller0: entered allmulticast mode [ 308.783944][T19993] tipc: Resetting bearer [ 308.824463][T19993] tipc: Disabling bearer [ 308.924482][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 309.002951][T20016] netlink: 'syz.0.3841': attribute type 21 has an invalid length. [ 309.105007][T20024] atomic_op ffff888026cd4198 conn xmit_atomic 0000000000000000 [ 309.480320][T20042] lo speed is unknown, defaulting to 1000 [ 309.815379][T20055] bridge1: entered promiscuous mode [ 309.842250][T20042] hsr0 speed is unknown, defaulting to 1000 [ 309.843650][T20041] lo speed is unknown, defaulting to 1000 [ 310.072089][T20041] hsr0 speed is unknown, defaulting to 1000 [ 310.960012][T20114] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 311.092012][T20124] syzkaller0: entered promiscuous mode [ 311.104495][T20124] syzkaller0: entered allmulticast mode [ 311.149236][T20130] bridge0: port 3(veth0_to_team) entered blocking state [ 311.172164][T20130] bridge0: port 3(veth0_to_team) entered disabled state [ 311.179872][T20130] veth0_to_team: entered allmulticast mode [ 311.188800][T20130] veth0_to_team: entered promiscuous mode [ 311.230171][T20137] veth0_to_team: left allmulticast mode [ 311.242234][T20137] veth0_to_team: left promiscuous mode [ 311.248751][T20137] bridge0: port 3(veth0_to_team) entered disabled state [ 311.620906][T20173] lo speed is unknown, defaulting to 1000 [ 312.019287][T20173] hsr0 speed is unknown, defaulting to 1000 [ 312.118588][T20202] macsec0: entered allmulticast mode [ 312.331780][T20215] "syz.3.3893" (20215) uses obsolete ecb(arc4) skcipher [ 312.352284][T20215] "syz.3.3893" (20215) uses obsolete ecb(arc4) skcipher [ 312.661176][T20236] __nla_validate_parse: 11 callbacks suppressed [ 312.661194][T20236] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3898'. [ 312.750988][T20241] netlink: 'syz.4.3900': attribute type 1 has an invalid length. [ 312.792599][T20241] gretap2: entered allmulticast mode [ 312.828999][T20241] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3900'. [ 312.839322][T20241] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3900'. [ 312.851824][T20241] erspan0: entered promiscuous mode [ 312.858879][T20241] gretap0: entered promiscuous mode [ 312.865645][T20241] debugfs: 'hsr1' already exists in 'hsr' [ 312.871584][T20241] Cannot create hsr debugfs directory [ 313.138786][T20262] lo speed is unknown, defaulting to 1000 [ 313.204218][ T50] Bluetooth: hci3: link tx timeout [ 313.210486][ T50] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 313.245765][T20266] ip6gre1: entered allmulticast mode [ 313.258987][T20266] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3906'. [ 313.318501][T20262] hsr0 speed is unknown, defaulting to 1000 [ 313.528686][T20279] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 313.540617][T20279] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3910'. [ 313.562532][T20279] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3910'. [ 313.572882][T20279] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3910'. [ 313.849768][T20306] bridge_slave_0: left allmulticast mode [ 313.856617][T20306] bridge_slave_0: left promiscuous mode [ 313.863471][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.875435][ T9879] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 313.891415][T20306] bridge_slave_1: left allmulticast mode [ 313.899493][T20306] bridge_slave_1: left promiscuous mode [ 313.906014][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 313.906958][T20313] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3916'. [ 313.951257][T20306] bond0: (slave bond_slave_0): Releasing backup interface [ 314.022674][T20306] team_slave_0: left promiscuous mode [ 314.040505][T20306] team0: Port device team_slave_0 removed [ 314.055518][T20306] team_slave_1: left promiscuous mode [ 314.062569][T20306] team0: Port device team_slave_1 removed [ 314.069970][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 314.078929][T20306] bond2: (slave wlan0): Releasing active interface [ 314.209016][T20327] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3920'. [ 314.348101][T20340] syz_tun: entered allmulticast mode [ 314.360342][T20340] dvmrp8: entered allmulticast mode [ 314.391043][T20340] syz_tun: left allmulticast mode [ 314.404436][T20340] dvmrp8: left allmulticast mode [ 314.447706][T20345] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3922'. [ 314.467026][T20346] openvswitch: netlink: nsh attribute has 13 unknown bytes. [ 314.475749][T20346] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 314.479737][T20348] netlink: 'syz.3.3926': attribute type 9 has an invalid length. [ 314.507104][T20338] lo speed is unknown, defaulting to 1000 [ 314.630212][T20353] sctp: [Deprecated]: syz.1.3928 (pid 20353) Use of struct sctp_assoc_value in delayed_ack socket option. [ 314.630212][T20353] Use struct sctp_sack_info instead [ 314.662014][T20338] hsr0 speed is unknown, defaulting to 1000 [ 314.756214][T20364] bridge_slave_0: left allmulticast mode [ 314.789461][T20364] bridge_slave_0: left promiscuous mode [ 314.798080][T20364] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.818176][T20364] bridge_slave_1: left allmulticast mode [ 314.824510][T20364] bridge_slave_1: left promiscuous mode [ 314.830392][T20364] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.842537][T20364] bond0: (slave bond_slave_0): Releasing backup interface [ 314.847931][ T9879] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 314.865237][T20364] bond0: (slave bond_slave_1): Releasing backup interface [ 314.876242][T20364] team0: Port device team_slave_0 removed [ 314.883918][T20364] team0: Port device team_slave_1 removed [ 314.893717][T20364] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 314.904688][T20364] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 314.918712][T20364] bond1: (slave wlan0): Releasing active interface [ 314.921989][T20377] netlink: 'syz.2.3932': attribute type 3 has an invalid length. [ 314.925835][T20364] bond1: (slave wlan0): the permanent HWaddr of slave - 08:02:11:00:00:00 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 314.925877][T20364] vlan2: entered promiscuous mode [ 314.960319][T20364] bond0: (slave wlan1): Releasing backup interface [ 314.971090][T20364] bond1: (slave vlan2): Releasing active interface [ 314.978658][T20364] vlan2: left promiscuous mode [ 315.031737][T20374] bond1: (slave geneve3): Enslaving as an active interface with an up link [ 315.051989][T16774] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 315.063527][T16774] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 315.079188][T16774] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 315.132925][T16774] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 315.159294][T20384] tipc: Enabled bearer , priority 0 [ 315.245162][ T5860] Bluetooth: hci3: command 0x0406 tx timeout [ 315.273155][T20384] syzkaller0: entered promiscuous mode [ 315.301952][T20384] syzkaller0: entered allmulticast mode [ 315.353373][T20384] tipc: Resetting bearer [ 315.386488][T20383] tipc: Resetting bearer [ 315.403181][T20383] tipc: Disabling bearer [ 315.464170][T20410] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 315.482466][T20410] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 315.549148][T20411] lo speed is unknown, defaulting to 1000 [ 315.757130][T20411] hsr0 speed is unknown, defaulting to 1000 [ 315.790472][T20432] netlink: 'syz.3.3947': attribute type 21 has an invalid length. [ 315.819318][T20432] netlink: 'syz.3.3947': attribute type 4 has an invalid length. [ 315.830859][T20432] netlink: 'syz.3.3947': attribute type 5 has an invalid length. [ 315.845179][T20435] mac80211_hwsim hwsim45 syzkaller0: entered promiscuous mode [ 315.853734][T20435] mac80211_hwsim hwsim45 syzkaller0: entered allmulticast mode [ 315.877681][T20437] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 315.891858][T20441] netlink: 'syz.4.3955': attribute type 10 has an invalid length. [ 315.901332][T20441] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 316.027482][T20448] syzkaller1: entered promiscuous mode [ 316.033092][T20448] syzkaller1: entered allmulticast mode [ 316.092396][T20460] !: renamed from dummy0 [ 316.350057][T20470] lo speed is unknown, defaulting to 1000 [ 316.566362][T20486] tipc: Enabled bearer , priority 0 [ 316.589374][T20470] hsr0 speed is unknown, defaulting to 1000 [ 316.684155][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 316.712055][T20486] tipc: Disabling bearer [ 316.901234][T20504] lo speed is unknown, defaulting to 1000 [ 317.327324][ T1299] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 317.337197][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.348999][T20504] hsr0 speed is unknown, defaulting to 1000 [ 317.665531][T20510] __nla_validate_parse: 23 callbacks suppressed [ 317.665551][T20510] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3972'. [ 317.798933][T20555] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 317.848162][T20555] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3987'. [ 317.927185][T20557] openvswitch: netlink: Key type 251 is out of range max 32 [ 318.028893][T20563] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3990'. [ 318.229392][T20571] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 318.256344][T20578] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3992'. [ 318.440029][T20590] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3996'. [ 318.442549][T20588] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3995'. [ 318.483004][T20592] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3996'. [ 318.495784][T20592] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3996'. [ 318.561909][T20594] lo speed is unknown, defaulting to 1000 [ 318.677265][T20611] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4000'. [ 318.709971][T20612] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3997'. [ 318.740307][T20612] netlink: 'syz.2.3997': attribute type 1 has an invalid length. [ 318.769948][T20611] (unnamed net_device) (uninitialized): option packets_per_slave: mode dependency failed, not supported in mode 802.3ad(4) [ 318.779411][T20612] block nbd2: Unsupported socket: shutdown callout must be supported. [ 318.831546][T20613] lo speed is unknown, defaulting to 1000 [ 318.917099][T20594] hsr0 speed is unknown, defaulting to 1000 [ 318.992366][T20613] hsr0 speed is unknown, defaulting to 1000 [ 319.186966][T20636] netlink: 'syz.1.4008': attribute type 2 has an invalid length. [ 319.210959][T20636] netlink: 'syz.1.4008': attribute type 1 has an invalid length. [ 319.649207][T20678] lo speed is unknown, defaulting to 1000 [ 319.954916][T20678] hsr0 speed is unknown, defaulting to 1000 [ 320.098454][T20707] tipc: Enabled bearer , priority 0 [ 320.109054][T20707] syzkaller0: entered promiscuous mode [ 320.114941][T20707] syzkaller0: entered allmulticast mode [ 320.123039][T20707] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 320.158063][T20707] tipc: Resetting bearer [ 320.305510][T20723] netlink: 'syz.1.4035': attribute type 4 has an invalid length. [ 320.503195][T20727] lo speed is unknown, defaulting to 1000 [ 320.534321][T20733] netlink: 'syz.1.4036': attribute type 1 has an invalid length. [ 320.671454][T20727] hsr0 speed is unknown, defaulting to 1000 [ 320.778772][T20746] netlink: 'syz.3.4041': attribute type 5 has an invalid length. [ 320.833483][T20746] geneve2: entered promiscuous mode [ 320.840870][T20746] geneve2: entered allmulticast mode [ 320.851786][T20749] netlink: 'syz.1.4043': attribute type 1 has an invalid length. [ 320.868186][T16773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 320.883627][T20705] tipc: Resetting bearer [ 320.907166][T20705] tipc: Disabling bearer [ 320.930359][T20749] 8021q: adding VLAN 0 to HW filter on device bond3 [ 321.129429][T20757] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.143518][T20757] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 321.183535][T20758] lo speed is unknown, defaulting to 1000 [ 321.591136][T20757] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.608559][T20757] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 321.631755][T20758] hsr0 speed is unknown, defaulting to 1000 [ 321.752077][T20757] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.769793][T20757] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 321.840612][T20757] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.860392][T20757] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 322.033178][T20791] netlink: 'syz.1.4048': attribute type 1 has an invalid length. [ 322.050878][T16775] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 322.069313][T16775] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 322.099612][T20791] 8021q: adding VLAN 0 to HW filter on device bond4 [ 322.128502][T20791] bond4: (slave geneve3): making interface the new active one [ 322.138129][T20791] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 322.147605][T16775] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 322.156147][T16775] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 322.165290][T16775] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.202908][T16775] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.225966][T16775] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.252525][T16775] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.269067][T16775] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 322.277702][T16775] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 322.305055][T16775] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 322.318316][T16775] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 322.331524][T20804] pim6reg1: entered promiscuous mode [ 322.340689][T20804] pim6reg1: entered allmulticast mode [ 322.373521][T20806] netlink: 'syz.2.4053': attribute type 39 has an invalid length. [ 322.383741][T20806] veth0_macvtap: left promiscuous mode [ 322.547096][T20809] IPVS: Scheduler module ip_vs_sip not found [ 322.647595][T20742] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 322.728106][ T3587] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 322.749832][ T3587] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 322.770961][ T3587] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 322.780502][ T3587] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 323.003552][T20837] lo speed is unknown, defaulting to 1000 [ 323.078466][T20843] __nla_validate_parse: 20 callbacks suppressed [ 323.078488][T20843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4065'. [ 323.088122][T20840] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4064'. [ 323.113556][T20843] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4065'. [ 323.206077][T20837] hsr0 speed is unknown, defaulting to 1000 [ 323.360764][T20862] _ÐZ`Ô€@ÿÿ: entered promiscuous mode [ 323.397420][T20856] syz_tun: entered allmulticast mode [ 323.405954][T20856] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4070'. [ 323.427063][T20855] syz_tun: left allmulticast mode [ 323.475510][T20869] lo speed is unknown, defaulting to 1000 [ 323.477302][T20874] netlink: 72 bytes leftover after parsing attributes in process `syz.4.4075'. [ 323.630376][T20881] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4077'. [ 323.656198][T20881] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4077'. [ 323.838482][T20869] hsr0 speed is unknown, defaulting to 1000 [ 324.133373][T20907] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4087'. [ 324.289849][T20915] netlink: 'syz.1.4089': attribute type 25 has an invalid length. [ 324.306881][T20919] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4088'. [ 324.395819][T20922] siw: device registration error -23 [ 324.436478][T20925] siw: device registration error -23 [ 324.460799][T20922] netlink: 'syz.0.4091': attribute type 4 has an invalid length. [ 324.510641][T20928] siw: device registration error -23 [ 324.659420][T20938] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.4095'. [ 324.759570][T20940] tipc: Enabled bearer , priority 0 [ 324.813612][T20940] tipc: Resetting bearer [ 325.104916][T20963] tc_dump_action: action bad kind [ 325.322009][ T9878] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 325.332895][ T9878] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 325.341612][ T9878] hid-generic 0005:16BF:5505.0001: reserved main item tag 0xe [ 325.355162][ T9878] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 325.358658][T20981] netlink: 'syz.3.4111': attribute type 5 has an invalid length. [ 325.380475][T20983] netlink: 'syz.3.4111': attribute type 10 has an invalid length. [ 325.390156][T20981] netlink: 'syz.3.4111': attribute type 10 has an invalid length. [ 325.410892][T20987] A link change request failed with some changes committed already. Interface bond2 may have been left with an inconsistent configuration, please check. [ 325.415033][ T9878] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 325.491441][T20992] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 325.533087][ T9878] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 325.605628][T21001] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 325.632298][T21002] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 325.711037][T21002] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 325.780235][T21002] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 325.807274][ T6019] tipc: Node number set to 1410208719 [ 325.829476][T21017] netlink: 'syz.2.4122': attribute type 2 has an invalid length. [ 325.866202][T21017] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 325.879753][T21002] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 325.992009][T16790] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 326.042779][T16790] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 326.052339][T16790] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 326.074375][T16790] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 326.111561][T21031] netlink: 'syz.0.4125': attribute type 1 has an invalid length. [ 326.139441][T21031] 8021q: adding VLAN 0 to HW filter on device bond0 [ 326.162783][T21031] 8021q: adding VLAN 0 to HW filter on device bond0 [ 326.173805][T21031] bond0: (slave vxcan5): The slave device specified does not support setting the MAC address [ 326.189886][T21031] bond0: (slave vxcan5): Error -95 calling set_mac_address [ 326.218961][T16775] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 326.231671][T16775] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 326.559507][T21054] vlan2: entered promiscuous mode [ 326.564929][T21054] macvtap0: entered promiscuous mode [ 326.778062][T21069] lo speed is unknown, defaulting to 1000 [ 326.812976][T21072] netlink: 'syz.2.4139': attribute type 10 has an invalid length. [ 326.962302][T21072] lo speed is unknown, defaulting to 1000 [ 326.985083][T21069] hsr0 speed is unknown, defaulting to 1000 [ 327.215245][T21044] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 327.285196][T21102] tipc: Enabled bearer , priority 0 [ 327.299650][T21102] syzkaller0: entered promiscuous mode [ 327.322885][T21102] syzkaller0: entered allmulticast mode [ 327.338720][T21109] tipc: Enabling of bearer rejected, already enabled [ 327.511185][T21102] tipc: Resetting bearer [ 327.558173][T21072] hsr0 speed is unknown, defaulting to 1000 [ 327.593133][T21118] lo speed is unknown, defaulting to 1000 [ 327.658292][T21118] lo speed is unknown, defaulting to 1000 [ 327.713028][T21118] lo speed is unknown, defaulting to 1000 [ 327.736788][T21118] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 327.756046][T21101] tipc: Resetting bearer [ 327.797492][T21101] tipc: Disabling bearer [ 327.829044][T21118] lo speed is unknown, defaulting to 1000 [ 327.836894][T21118] lo speed is unknown, defaulting to 1000 [ 327.846614][T21118] lo speed is unknown, defaulting to 1000 [ 327.853627][T21118] lo speed is unknown, defaulting to 1000 [ 327.885231][T21118] lo speed is unknown, defaulting to 1000 [ 327.892199][T21118] lo speed is unknown, defaulting to 1000 [ 327.908466][T21118] lo speed is unknown, defaulting to 1000 [ 327.926115][T21118] lo speed is unknown, defaulting to 1000 [ 328.021520][T21139] FAULT_INJECTION: forcing a failure. [ 328.021520][T21139] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 328.043716][T21118] lo speed is unknown, defaulting to 1000 [ 328.043935][T21139] CPU: 1 UID: 0 PID: 21139 Comm: syz.3.4157 Not tainted syzkaller #0 PREEMPT(full) [ 328.043958][T21139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 328.043969][T21139] Call Trace: [ 328.043975][T21139] [ 328.043982][T21139] dump_stack_lvl+0x189/0x250 [ 328.044006][T21139] ? __pfx____ratelimit+0x10/0x10 [ 328.044034][T21139] ? __pfx_dump_stack_lvl+0x10/0x10 [ 328.044053][T21139] ? __pfx__printk+0x10/0x10 [ 328.044073][T21139] ? __might_fault+0xb0/0x130 [ 328.044099][T21139] ? rcu_is_watching+0x15/0xb0 [ 328.044118][T21139] should_fail_ex+0x414/0x560 [ 328.044140][T21139] _copy_from_user+0x2d/0xb0 [ 328.044160][T21139] ___sys_sendmsg+0x158/0x2a0 [ 328.044179][T21139] ? __pfx____sys_sendmsg+0x10/0x10 [ 328.044198][T21139] ? kstrtouint+0x6e/0xe0 [ 328.044232][T21139] ? __fget_files+0x2a/0x420 [ 328.044246][T21139] ? __fget_files+0x3a0/0x420 [ 328.044270][T21139] __sys_sendmmsg+0x227/0x430 [ 328.044290][T21139] ? __pfx___sys_sendmmsg+0x10/0x10 [ 328.044306][T21139] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 328.044342][T21139] ? ksys_write+0x22a/0x250 [ 328.044364][T21139] ? __pfx_ksys_write+0x10/0x10 [ 328.044383][T21139] ? rcu_is_watching+0x15/0xb0 [ 328.044402][T21139] __x64_sys_sendmmsg+0xa0/0xc0 [ 328.044420][T21139] do_syscall_64+0xfa/0x3b0 [ 328.044435][T21139] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.044452][T21139] ? clear_bhb_loop+0x60/0xb0 [ 328.044467][T21139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.044480][T21139] RIP: 0033:0x7fd3c8b8ebe9 [ 328.044496][T21139] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 328.044511][T21139] RSP: 002b:00007fd3c99e3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 328.044530][T21139] RAX: ffffffffffffffda RBX: 00007fd3c8db5fa0 RCX: 00007fd3c8b8ebe9 [ 328.044542][T21139] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000006 [ 328.044554][T21139] RBP: 00007fd3c99e3090 R08: 0000000000000000 R09: 0000000000000000 [ 328.044565][T21139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 328.044575][T21139] R13: 00007fd3c8db6038 R14: 00007fd3c8db5fa0 R15: 00007fff0d2a4ea8 [ 328.044595][T21139] [ 328.133972][T21145] lo speed is unknown, defaulting to 1000 [ 328.173768][T21151] __nla_validate_parse: 18 callbacks suppressed [ 328.173788][T21151] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4162'. [ 328.206493][T21118] lo speed is unknown, defaulting to 1000 [ 328.299248][T21145] hsr0 speed is unknown, defaulting to 1000 [ 328.327919][T21118] lo speed is unknown, defaulting to 1000 [ 328.763322][T21180] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4172'. [ 328.784927][T21180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4172'. [ 328.819809][T21185] lo speed is unknown, defaulting to 1000 [ 328.862068][T21189] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4173'. [ 328.908042][T21189] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4173'. [ 329.188478][T21185] hsr0 speed is unknown, defaulting to 1000 [ 329.189813][T21188] lo speed is unknown, defaulting to 1000 [ 329.208002][T21185] lo speed is unknown, defaulting to 1000 [ 329.290228][T21204] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4176'. [ 329.445373][T21188] hsr0 speed is unknown, defaulting to 1000 [ 329.452872][T21188] lo speed is unknown, defaulting to 1000 [ 329.496147][T21202] lo speed is unknown, defaulting to 1000 [ 329.570142][T21207] FAULT_INJECTION: forcing a failure. [ 329.570142][T21207] name failslab, interval 1, probability 0, space 0, times 0 [ 329.619033][T21204] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4176'. [ 329.638856][T21207] CPU: 0 UID: 0 PID: 21207 Comm: syz.3.4178 Not tainted syzkaller #0 PREEMPT(full) [ 329.638887][T21207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 329.638897][T21207] Call Trace: [ 329.638903][T21207] [ 329.638911][T21207] dump_stack_lvl+0x189/0x250 [ 329.638935][T21207] ? __pfx____ratelimit+0x10/0x10 [ 329.638957][T21207] ? __pfx_dump_stack_lvl+0x10/0x10 [ 329.638984][T21207] ? __pfx__printk+0x10/0x10 [ 329.639007][T21207] ? fs_reclaim_acquire+0x7d/0x100 [ 329.639030][T21207] ? rcu_is_watching+0x15/0xb0 [ 329.639047][T21207] ? __pfx___might_resched+0x10/0x10 [ 329.639063][T21207] ? lock_acquire+0x5f/0x360 [ 329.639088][T21207] should_fail_ex+0x414/0x560 [ 329.639112][T21207] should_failslab+0xa8/0x100 [ 329.639135][T21207] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 329.639164][T21207] ? __alloc_skb+0x112/0x2d0 [ 329.639182][T21207] __alloc_skb+0x112/0x2d0 [ 329.639197][T21207] netlink_sendmsg+0x5c6/0xb30 [ 329.639216][T21207] ? __pfx_netlink_sendmsg+0x10/0x10 [ 329.639247][T21207] ? is_bpf_text_address+0x26/0x2b0 [ 329.639272][T21207] ? rcu_is_watching+0x15/0xb0 [ 329.639293][T21207] ? aa_sock_msg_perm+0xf1/0x1d0 [ 329.639308][T21207] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 329.639337][T21207] ? __pfx_netlink_sendmsg+0x10/0x10 [ 329.639355][T21207] __sock_sendmsg+0x219/0x270 [ 329.639384][T21207] ____sys_sendmsg+0x52d/0x830 [ 329.639413][T21207] ? __pfx_____sys_sendmsg+0x10/0x10 [ 329.639439][T21207] ? import_iovec+0x74/0xa0 [ 329.639464][T21207] ___sys_sendmsg+0x21f/0x2a0 [ 329.639486][T21207] ? __pfx____sys_sendmsg+0x10/0x10 [ 329.639510][T21207] ? kstrtouint+0x6e/0xe0 [ 329.639541][T21207] ? __fget_files+0x2a/0x420 [ 329.639554][T21207] ? __fget_files+0x3a0/0x420 [ 329.639571][T21207] __sys_sendmmsg+0x227/0x430 [ 329.639589][T21207] ? __pfx___sys_sendmmsg+0x10/0x10 [ 329.639605][T21207] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 329.639638][T21207] ? ksys_write+0x22a/0x250 [ 329.639661][T21207] ? __pfx_ksys_write+0x10/0x10 [ 329.639680][T21207] ? rcu_is_watching+0x15/0xb0 [ 329.639698][T21207] __x64_sys_sendmmsg+0xa0/0xc0 [ 329.639714][T21207] do_syscall_64+0xfa/0x3b0 [ 329.639729][T21207] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.639744][T21207] ? clear_bhb_loop+0x60/0xb0 [ 329.639761][T21207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.639776][T21207] RIP: 0033:0x7fd3c8b8ebe9 [ 329.639792][T21207] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 329.639806][T21207] RSP: 002b:00007fd3c99e3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 329.639826][T21207] RAX: ffffffffffffffda RBX: 00007fd3c8db5fa0 RCX: 00007fd3c8b8ebe9 [ 329.639840][T21207] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000006 [ 329.639853][T21207] RBP: 00007fd3c99e3090 R08: 0000000000000000 R09: 0000000000000000 [ 329.639863][T21207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 329.639872][T21207] R13: 00007fd3c8db6038 R14: 00007fd3c8db5fa0 R15: 00007fff0d2a4ea8 [ 329.639899][T21207] [ 329.957945][T21219] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4180'. [ 330.027974][T16770] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.040972][T16770] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.059840][T21213] tipc: Enabled bearer , priority 10 [ 330.072063][T21202] hsr0 speed is unknown, defaulting to 1000 [ 330.079512][T21202] lo speed is unknown, defaulting to 1000 [ 330.102053][T21210] lo speed is unknown, defaulting to 1000 [ 330.112337][T16770] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.179142][T16770] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.239981][T21210] hsr0 speed is unknown, defaulting to 1000 [ 330.261928][T21225] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 330.284407][T21210] lo speed is unknown, defaulting to 1000 [ 330.291398][T21228] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4184'. [ 330.412150][T21236] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4186'. [ 330.494599][T21244] IPVS: set_ctl: invalid protocol: 108 101.1.1.2:20001 [ 330.785560][T21250] lo speed is unknown, defaulting to 1000 [ 331.082827][T21250] hsr0 speed is unknown, defaulting to 1000 [ 331.158829][T21250] lo speed is unknown, defaulting to 1000 [ 331.379735][T21268] lo speed is unknown, defaulting to 1000 [ 331.560739][T21289] netlink: 'syz.1.4200': attribute type 21 has an invalid length. [ 331.612062][T21293] veth0: entered promiscuous mode [ 331.782367][T21302] tipc: Enabling of bearer rejected, failed to enable media [ 331.792219][T21268] hsr0 speed is unknown, defaulting to 1000 [ 331.799034][T21283] lo speed is unknown, defaulting to 1000 [ 331.911584][T21283] hsr0 speed is unknown, defaulting to 1000 [ 331.919383][T21303] lo speed is unknown, defaulting to 1000 [ 331.920187][T21283] lo speed is unknown, defaulting to 1000 [ 331.958208][T21268] lo speed is unknown, defaulting to 1000 [ 331.968696][T21310] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 332.069174][T21303] hsr0 speed is unknown, defaulting to 1000 [ 332.069213][T21307] lo speed is unknown, defaulting to 1000 [ 332.076834][T21303] lo speed is unknown, defaulting to 1000 [ 332.275454][T21314] syz.2.4207 uses old SIOCAX25GETINFO [ 332.290938][T21318] macvtap1: entered promiscuous mode [ 332.315265][T21318] mac80211_hwsim hwsim42 wlan1: entered promiscuous mode [ 332.323858][T21318] mac80211_hwsim hwsim42 wlan1: left promiscuous mode [ 332.361726][T21307] hsr0 speed is unknown, defaulting to 1000 [ 332.398412][T21307] lo speed is unknown, defaulting to 1000 [ 332.684289][ C1] ================================================================== [ 332.684459][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 332.692661][ C1] BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x471/0x4b0 [ 332.692698][ C1] Read of size 2 at addr ffff88804551742a by task syz.4.4217/21348 [ 332.692714][ C1] [ 332.692724][ C1] CPU: 1 UID: 0 PID: 21348 Comm: syz.4.4217 Not tainted syzkaller #0 PREEMPT(full) [ 332.692744][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 332.692756][ C1] Call Trace: [ 332.692764][ C1] [ 332.692772][ C1] dump_stack_lvl+0x189/0x250 [ 332.692797][ C1] ? rcu_is_watching+0x15/0xb0 [ 332.692818][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 332.692838][ C1] ? rcu_is_watching+0x15/0xb0 [ 332.692855][ C1] ? lock_release+0x4b/0x3e0 [ 332.692885][ C1] ? __virt_addr_valid+0x1c8/0x5c0 [ 332.692911][ C1] ? __virt_addr_valid+0x4a5/0x5c0 [ 332.692936][ C1] print_report+0xca/0x240 [ 332.692954][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 332.692979][ C1] kasan_report+0x118/0x150 [ 332.693007][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 332.693036][ C1] rose_timer_expiry+0x471/0x4b0 [ 332.693063][ C1] call_timer_fn+0x17e/0x5f0 [ 332.693091][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 332.693116][ C1] ? call_timer_fn+0xbe/0x5f0 [ 332.693141][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 332.693173][ C1] ? rcu_is_watching+0x15/0xb0 [ 332.693191][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 332.693218][ C1] __run_timer_base+0x61a/0x860 [ 332.693242][ C1] ? ktime_get+0x3e/0x1f0 [ 332.693269][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 332.693302][ C1] run_timer_softirq+0xb7/0x180 [ 332.693326][ C1] handle_softirqs+0x283/0x870 [ 332.693365][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 332.693385][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 332.693410][ C1] __irq_exit_rcu+0xca/0x1f0 [ 332.693427][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 332.693450][ C1] irq_exit_rcu+0x9/0x30 [ 332.693466][ C1] sysvec_apic_timer_interrupt+0x57/0xc0 [ 332.693494][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 332.693515][ C1] RIP: 0033:0x7ff2f538ebe9 [ 332.693532][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 332.693548][ C1] RSP: 002b:00007ff2f616f0e8 EFLAGS: 00000246 [ 332.693566][ C1] RAX: 0000000000000001 RBX: 00007ff2f55b5fa8 RCX: 00007ff2f538ebe9 [ 332.693580][ C1] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff2f55b5fac [ 332.693593][ C1] RBP: 00007ff2f55b5fa0 R08: 7fffffffffffffff R09: 0000000000000000 [ 332.693607][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 332.693618][ C1] R13: 00007ff2f55b6038 R14: 00007fffb2748490 R15: 00007fffb2748578 [ 332.693642][ C1] [ 332.693649][ C1] [ 332.980880][ C1] Allocated by task 21068: [ 332.985277][ C1] kasan_save_track+0x3e/0x80 [ 332.989959][ C1] __kasan_kmalloc+0x93/0xb0 [ 332.994555][ C1] __kmalloc_cache_noprof+0x230/0x3d0 [ 333.000019][ C1] __genradix_ptr_alloc+0x352/0x4a0 [ 333.005235][ C1] __genradix_prealloc+0x44/0x90 [ 333.010253][ C1] sctp_stream_init+0x14b/0x440 [ 333.015229][ C1] sctp_association_new+0x10dd/0x25f0 [ 333.020961][ C1] sctp_connect_new_asoc+0x2c5/0x690 [ 333.026423][ C1] __sctp_connect+0x5ba/0xd50 [ 333.031206][ C1] sctp_getsockopt_connectx3+0x2c4/0x440 [ 333.037013][ C1] sctp_getsockopt+0x98a/0xb60 [ 333.041866][ C1] do_sock_getsockopt+0x372/0x450 [ 333.047079][ C1] __x64_sys_getsockopt+0x1a5/0x250 [ 333.052542][ C1] do_syscall_64+0xfa/0x3b0 [ 333.057456][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.063434][ C1] [ 333.065747][ C1] Freed by task 21068: [ 333.070066][ C1] kasan_save_track+0x3e/0x80 [ 333.074843][ C1] kasan_save_free_info+0x46/0x50 [ 333.080197][ C1] __kasan_slab_free+0x5b/0x80 [ 333.085303][ C1] kfree+0x18e/0x440 [ 333.089195][ C1] genradix_free_recurse+0x5d/0xa0 [ 333.094594][ C1] genradix_free_recurse+0x5d/0xa0 [ 333.099703][ C1] sctp_stream_free+0xd5/0x110 [ 333.104808][ C1] sctp_association_free+0x26d/0x7f0 [ 333.110437][ C1] sctp_do_sm+0x3eba/0x5a20 [ 333.115295][ C1] sctp_primitive_SHUTDOWN+0x98/0xc0 [ 333.120932][ C1] sctp_close+0x409/0x900 [ 333.125447][ C1] inet_release+0x141/0x190 [ 333.130122][ C1] sock_close+0xc3/0x240 [ 333.134574][ C1] __fput+0x44c/0xa70 [ 333.138668][ C1] task_work_run+0x1d4/0x260 [ 333.143347][ C1] do_exit+0x6b5/0x2300 [ 333.147935][ C1] do_group_exit+0x21c/0x2d0 [ 333.152582][ C1] get_signal+0x1286/0x1340 [ 333.157092][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 333.162897][ C1] exit_to_user_mode_loop+0x75/0x110 [ 333.168268][ C1] do_syscall_64+0x2bd/0x3b0 [ 333.173033][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.179096][ C1] [ 333.181425][ C1] The buggy address belongs to the object at ffff888045517400 [ 333.181425][ C1] which belongs to the cache kmalloc-512 of size 512 [ 333.195663][ C1] The buggy address is located 42 bytes inside of [ 333.195663][ C1] freed 512-byte region [ffff888045517400, ffff888045517600) [ 333.209779][ C1] [ 333.212182][ C1] The buggy address belongs to the physical page: [ 333.218670][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x45514 [ 333.227700][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 333.236280][ C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 333.243898][ C1] page_type: f5(slab) [ 333.247876][ C1] raw: 00fff00000000040 ffff88801a441c80 dead000000000100 dead000000000122 [ 333.256709][ C1] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 333.265719][ C1] head: 00fff00000000040 ffff88801a441c80 dead000000000100 dead000000000122 [ 333.274464][ C1] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 333.283400][ C1] head: 00fff00000000002 ffffea0001154501 00000000ffffffff 00000000ffffffff [ 333.292161][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 333.301000][ C1] page dumped because: kasan: bad access detected [ 333.307583][ C1] page_owner tracks the page as allocated [ 333.313282][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8350, tgid 8340 (syz.1.583), ts 106097400374, free_ts 105861803094 [ 333.335864][ C1] post_alloc_hook+0x240/0x2a0 [ 333.340822][ C1] get_page_from_freelist+0x21e4/0x22c0 [ 333.346630][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 333.352504][ C1] alloc_pages_mpol+0x232/0x4a0 [ 333.357541][ C1] allocate_slab+0x8a/0x370 [ 333.362229][ C1] ___slab_alloc+0xbeb/0x1410 [ 333.367163][ C1] __kmalloc_cache_noprof+0x296/0x3d0 [ 333.372711][ C1] rxrpc_alloc_peer+0x7d/0x330 [ 333.377472][ C1] rxrpc_service_prealloc_one+0x1f4/0xe20 [ 333.383189][ C1] afs_charge_preallocation+0x394/0x4e0 [ 333.388984][ C1] afs_open_socket+0x302/0x3a0 [ 333.393747][ C1] afs_net_init+0x67d/0x880 [ 333.398459][ C1] ops_init+0x35c/0x5c0 [ 333.402776][ C1] setup_net+0x10c/0x320 [ 333.407098][ C1] copy_net_ns+0x31b/0x4d0 [ 333.411788][ C1] create_new_namespaces+0x3f3/0x720 [ 333.417466][ C1] page last free pid 8350 tgid 8340 stack trace: [ 333.424605][ C1] __free_frozen_pages+0xbc4/0xd30 [ 333.430108][ C1] __put_partials+0x156/0x1a0 [ 333.434788][ C1] put_cpu_partial+0x17c/0x250 [ 333.439827][ C1] __slab_free+0x2d5/0x3c0 [ 333.444609][ C1] qlist_free_all+0x97/0x140 [ 333.449547][ C1] kasan_quarantine_reduce+0x148/0x160 [ 333.455102][ C1] __kasan_slab_alloc+0x22/0x80 [ 333.460261][ C1] __kmalloc_node_track_caller_noprof+0x216/0x4e0 [ 333.466866][ C1] kstrdup+0x42/0x100 [ 333.471193][ C1] kobject_set_name_vargs+0x61/0x110 [ 333.476736][ C1] dev_set_name+0xd4/0x120 [ 333.481463][ C1] netdev_register_kobject+0xb7/0x310 [ 333.486999][ C1] register_netdevice+0x126c/0x1ae0 [ 333.492282][ C1] __ip_tunnel_create+0x3e7/0x560 [ 333.497467][ C1] ip_tunnel_init_net+0x2ba/0x800 [ 333.502482][ C1] vti_init_net+0x2f/0x100 [ 333.506901][ C1] [ 333.509210][ C1] Memory state around the buggy address: [ 333.515000][ C1] ffff888045517300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 333.523141][ C1] ffff888045517380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 333.531301][ C1] >ffff888045517400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 333.539654][ C1] ^ [ 333.545388][ C1] ffff888045517480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 333.553708][ C1] ffff888045517500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 333.562104][ C1] ================================================================== [ 333.570284][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 333.577686][ C1] CPU: 1 UID: 0 PID: 21348 Comm: syz.4.4217 Not tainted syzkaller #0 PREEMPT(full) [ 333.587063][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 333.597131][ C1] Call Trace: [ 333.600425][ C1] [ 333.603365][ C1] dump_stack_lvl+0x99/0x250 [ 333.607999][ C1] ? __asan_memcpy+0x40/0x70 [ 333.612699][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 333.618109][ C1] ? __pfx__printk+0x10/0x10 [ 333.623191][ C1] vpanic+0x281/0x750 [ 333.627494][ C1] ? __pfx_vpanic+0x10/0x10 [ 333.632526][ C1] ? rcu_is_watching+0x15/0xb0 [ 333.637450][ C1] panic+0xb9/0xc0 [ 333.641199][ C1] ? __pfx_panic+0x10/0x10 [ 333.645878][ C1] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 333.651943][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 333.657841][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 333.662969][ C1] check_panic_on_warn+0x89/0xb0 [ 333.667910][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 333.673033][ C1] end_report+0x78/0x160 [ 333.677971][ C1] kasan_report+0x129/0x150 [ 333.682616][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 333.688040][ C1] rose_timer_expiry+0x471/0x4b0 [ 333.693215][ C1] call_timer_fn+0x17e/0x5f0 [ 333.698037][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 333.703862][ C1] ? call_timer_fn+0xbe/0x5f0 [ 333.708749][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 333.714238][ C1] ? rcu_is_watching+0x15/0xb0 [ 333.719386][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 333.725247][ C1] __run_timer_base+0x61a/0x860 [ 333.730297][ C1] ? ktime_get+0x3e/0x1f0 [ 333.735009][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 333.740485][ C1] run_timer_softirq+0xb7/0x180 [ 333.745442][ C1] handle_softirqs+0x283/0x870 [ 333.750369][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 333.755213][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 333.761103][ C1] __irq_exit_rcu+0xca/0x1f0 [ 333.766037][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 333.771230][ C1] irq_exit_rcu+0x9/0x30 [ 333.775547][ C1] sysvec_apic_timer_interrupt+0x57/0xc0 [ 333.781390][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 333.787552][ C1] RIP: 0033:0x7ff2f538ebe9 [ 333.792050][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 333.812098][ C1] RSP: 002b:00007ff2f616f0e8 EFLAGS: 00000246 [ 333.818438][ C1] RAX: 0000000000000001 RBX: 00007ff2f55b5fa8 RCX: 00007ff2f538ebe9 [ 333.826783][ C1] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff2f55b5fac [ 333.834834][ C1] RBP: 00007ff2f55b5fa0 R08: 7fffffffffffffff R09: 0000000000000000 [ 333.842800][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 333.851020][ C1] R13: 00007ff2f55b6038 R14: 00007fffb2748490 R15: 00007fffb2748578 [ 333.859356][ C1] [ 333.862796][ C1] Kernel Offset: disabled [ 333.867290][ C1] Rebooting in 86400 seconds..