last executing test programs: 25.428709301s ago: executing program 4 (id=3159): mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x80000000) 25.204005661s ago: executing program 4 (id=3160): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05010000000000000040009ab683eb5f225d0008", @ANYRES32, @ANYBLOB='\x00\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "5ea656daa109997f", "31e696e0894336ba7c0d0a87ba2378a166e49697f62b46eaffffffffffffff00", "dfe262c7", "2ccbe57bd876cbd3"}, 0x38) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000000580)={&(0x7f00000005c0)={0x2, 0x4, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000003a80)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x2}, {0x0}, &(0x7f0000003a00)=[{&(0x7f00000016c0)=""/96, 0x60}, {&(0x7f0000001740)=""/4096, 0x1000}], 0x2, 0x39, 0x2}}], 0x48, 0x4000000}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0x1, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r1}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x11, 0x15, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000001800000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000000000bfa200000000000007020000f8ffffffb703000008000000b704000098d7d41b8500000043000000181100"/68, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000040000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000820000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000440)='\x00'/16, 0x10) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) r5 = socket(0x10, 0x803, 0x2) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r6, @ANYBLOB="0100000001"], 0x3c}}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x2}, 0x8d0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) 25.09820439s ago: executing program 4 (id=3162): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x609, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffa7, 0x12288}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}}, 0x0) r7 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r9, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r9, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback={0xa00, 0xa8aaaafffeaaaa1e}, 0x8000}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r8], 0x5c}}, 0x40) 24.670823833s ago: executing program 4 (id=3163): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) (async) r3 = socket(0x2a, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x89b0, &(0x7f0000000180)={'veth0_virt_wifi\x00', &(0x7f00000001c0)=@ethtool_cmd={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x100000]}}) (async) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={0x0, 0xf4}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) (async) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34080}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0xa6}, @IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x4c}}, 0x0) 24.530066472s ago: executing program 4 (id=3164): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x80) sendmsg$NLBL_CIPSOV4_C_LIST(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, r1, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x880) r2 = accept4(0xffffffffffffffff, &(0x7f0000000240)=@l2={0x1f, 0x0, @fixed}, &(0x7f00000002c0)=0x80, 0x100000) sendmsg$NL80211_CMD_LEAVE_OCB(r2, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7fff, 0x68}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x8}, 0x1) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000840)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000440)={0x388, r1, 0x28, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSCATLST={0x4c, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x799d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8bd0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5143ce2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb280}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x15e22dac}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe9a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x961f}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0xd4, 0xc, 0x0, 0x1, [{0x54, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1e2c49c2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x712c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc47a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8af9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdf16}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x39a81c6b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5d79272}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x58172c36}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8c94}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x676c}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeef4}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f253a3b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x405}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xca89529}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x14cc68eb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1f53}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f71fe6b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x208d92b3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4ffde69a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xff22}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xef03}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xe049bd5}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7c9c6165}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf2ed}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0xd0, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xba42}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1a52a6b9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5502}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4931e476}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x11b8}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5738fe51}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe1d5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa8f7}]}, {0x54, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x587185c0}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6789}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8e6c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4a9e7e1c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x33d1cc18}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5568cea0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x701b10ca}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xad9f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3b6eb249}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf295}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b10a2f3}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4838}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4863bc04}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4bc5c58e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x703fe54b}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x44, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5}, {0x5, 0x3, 0x5}, {0x5}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x128, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x33f4b234}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x57bf22f7}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4d77}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x39d8}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3e53}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75a40e35}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3c0471bb}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xda0b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x29b36122}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59a74a08}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x71d3af1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9cb3}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa87e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xbe73e67}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4a5ed9cd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5ce5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfac1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9fd4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2754}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6ba0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x562a7f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4af7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x48047b10}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5c8b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x36d5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd58}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8a72}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5166b7bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8c29}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x16653759}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x16899735}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x28df}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x46db83a7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x71d5af70}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x388}, 0x1, 0x0, 0x0, 0x80}, 0x10) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f0000000980)={&(0x7f0000000880), 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x70, 0x0, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x6, 0x4c}}}}, [@NL80211_ATTR_STA_FLAGS={0x8, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_WME={0x4}]}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x1}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x21}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0xf}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x2}, @NL80211_ATTR_STA_FLAGS={0x14, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_ASSOCIATED={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004}, 0x4000040) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x401, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ac0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000a40), &(0x7f0000000a80)}, 0x20) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000cc0)={0x0, @loopback, @empty}, &(0x7f0000000d00)=0xc) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000e00)={&(0x7f0000000d40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x6, [@float={0x3, 0x0, 0x0, 0x10, 0x10}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0xa}, {0xf, 0x1}]}]}, {0x0, [0x0, 0x61, 0x2e, 0x5f]}}, &(0x7f0000000dc0)=""/55, 0x46, 0x37, 0x1, 0x6, 0x10000}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001080)={0xffffffffffffffff, 0x20, &(0x7f0000001040)={&(0x7f0000000ec0)=""/98, 0x62, 0x0, &(0x7f0000000f40)=""/243, 0xf3}}, 0x10) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001340)={0x6, 0x25, &(0x7f00000010c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2a8, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@btf_id={0x18, 0x6, 0x3, 0x0, 0x5}, @map_val={0x18, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7b4c}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @tail_call], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001200)='syzkaller\x00', 0xdf3c, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000001240)={0x3, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, &(0x7f0000001280)=[{0x5, 0x4, 0x2, 0x5}, {0x3, 0x4, 0xa, 0xb}, {0x1, 0x5, 0xe, 0x8}, {0x4, 0x3, 0x6}, {0x3, 0x1, 0xf, 0x1}, {0x2, 0x1, 0xc, 0x9}, {0x0, 0x5, 0xf, 0xb}, {0x2, 0x2, 0x1, 0x9}, {0x5, 0x5, 0xc, 0x3}, {0x2, 0x3, 0xb, 0x4}], 0x10, 0x800}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x4, 0x1c, &(0x7f0000000b00)=@raw=[@map_val={0x18, 0x1, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x2}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @exit, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff8d7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @generic={0x84, 0x3, 0x1, 0x256, 0x4}, @ldst={0x0, 0x2, 0x1, 0x5, 0x7, 0xc}], &(0x7f0000000c00)='syzkaller\x00', 0xe02c, 0x54, &(0x7f0000000c40)=""/84, 0x41100, 0x12, '\x00', r5, @fallback=0x2c, r6, 0x8, &(0x7f0000000e40)={0x2, 0x100}, 0x8, 0x10, &(0x7f0000000e80)={0x4, 0xd, 0x7fff, 0x1}, 0x10, r7, r8, 0x0, 0x0, 0x0, 0x10, 0xffff}, 0x94) recvmsg$can_bcm(r2, &(0x7f0000001640)={&(0x7f00000014c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001540)=""/52, 0x34}], 0x1, &(0x7f00000015c0)=""/120, 0x78}, 0x42) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f00000016c0), r2) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000001780)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001740)={&(0x7f0000001700)={0x1c, r9, 0x2, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040040}, 0x14) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000017c0)={0xb070, 0x8001, 0x8, 0x3, 0xffff, 0xe6, 0x574, 0x8001}, 0x20) sendmsg(r2, &(0x7f0000001c00)={&(0x7f0000001800)=@ll={0x11, 0x4, r5, 0x1, 0x4, 0x6, @remote}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001880)="69ead3207e68dffa4c8b5a02522fd441143eea73702ab94420258f1bfe16458711577f478ac24f142e40007c8dfc879cab8c35c32953c4d3564b47c2fa", 0x3d}, {&(0x7f00000018c0)="0efcd46d16775eee9ebda8d436165fe24316f0366915ea229dcf6f509696ed575271d7248de43b82ae6e704cbcfd44a9cacf0152bb09f74835aad337", 0x3c}], 0x2, &(0x7f0000001940)=[{0xb0, 0x115, 0x7f, "bc4827a864e72505bafbb736afdb6946039c1433c01f4c42df88836755b2e96e3aca2b086a5ede87a4e3b8d1b7d631cf03f13b800f8a0909e933fe8b792763007257d2db9b96128861a854edf7482f2ec5aa94a6401f51f2b6d7bafdfedf4adccedbb0b33eeba3d85465fface2585e5c49412316e87f924b947c74bf0812c03b7af60789fca66e5c648660059b5be9ba53200cce82a6cefa093f"}, {0x108, 0x88, 0x7ff, "38ea1e9d153a8c26abc045769657c2ee1defaf5247d8c57d67692036205bf0b4de3593957e1d6251e40a274bf24b8cc7688f2ba40fbe9a40306f198dda894d8d73f2439b3c5898cd8d31472c5f193fe546ac613ae7118b1b76856b4792a02c8bd766a717af7562a97fc1f78ae482df52d8023eef9936dbfa695f563502c65d237504c8b9a8e6a2b505ca119b93459632e07b054ce1969a69fba3062b90fe4419b8c8acef8400b936f5b0829b4200b38dff94bd41ac9207420882ecff31b31b1c9acba0fec898fd42855d3abcc6f9a68dd1d05844d6a7193a0d42c3203cb03dcf4ba78b11b3a7f999a168380e5f4d5d1a4e03c0471ade2a3c"}, {0xe8, 0x104, 0x6, "271f69439fdcb11b432d025d4940f6690b094a49d86467c458b424a9f727b06da1a8de29fb4c629c57ea775ec4db88ffb3fb747969eeabe65d571f345fcbb1dbff565e53debfd04b6e2fd2629aa40dba7c06ea5186d8cd09be44b4fcc5cb1a0ad5b5ffbb67d663387f8b60ceae2860447c1e759e13205153f80de9c7c6f5420f6b54dabbd3ab69baf5ec235918cffb9a91adf42a95112552860ee03c0f663332370e432acb453c3352118936f0066dc295ba269718acd1b1f9a943a6e8d892b99074785b6d70890b1f0132f1d2685f7a54"}], 0x2a0}, 0x200000c0) r10 = syz_genetlink_get_family_id$gtp(&(0x7f0000001c80), r2) r11 = ioctl$NS_GET_PARENT(r6, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000001d80)={&(0x7f0000001c40)={0x10, 0x0, 0x0, 0x17400000}, 0xc, &(0x7f0000001d40)={&(0x7f0000001cc0)={0x78, r10, 0x100, 0x70bd26, 0x25dfdbff, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_I_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8}, @GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_NET_NS_FD={0x8, 0x7, r11}, @GTPA_MS_ADDR6={0x14, 0xc, @private1}, @GTPA_TID={0xc}, @GTPA_I_TEI={0x8, 0x8, 0x4}]}, 0x78}, 0x1, 0x0, 0x0, 0x20008810}, 0x20000800) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001e00), r2) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r2, &(0x7f0000001f00)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e40)={0x68, r12, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1f}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x40}, 0x800) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000002100)={&(0x7f0000001f40)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000020c0)={&(0x7f0000001f80)={0x10c, 0x0, 0x1, 0xa06, 0x0, 0x0, {0x0, 0x0, 0x5}, [@CTA_SEQ_ADJ_REPLY={0x44, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x6057}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x1ff}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x2}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x6}]}, @CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0xe1}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x2}]}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0xa, 0x1, 'H.245\x00'}}, @CTA_FILTER={0x34, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x870}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x10}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x2}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x974}, @CTA_FILTER_ORIG_FLAGS={0x8}]}, @CTA_HELP={0x14, 0x5, 0x0, 0x1, {0xe, 0x1, 'ftp-20000\x00'}}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xbb3}]}, @CTA_SEQ_ADJ_ORIG={0x2c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x7}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x80}, 0x4004040) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000002140)={0x0, 0x0, 0x20, 0x8, @vifc_lcl_ifindex=r5, @multicast2}, 0x10) socket(0x8, 0x806, 0x1) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f00000021c0), r2) sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000002300)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000022c0)={&(0x7f0000002200)={0xa4, r13, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x60, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x45}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xe, 0x14}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x14}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x1d}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x92f}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8001}, 0x80) 24.04573098s ago: executing program 4 (id=3167): r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@dev, @dev, 0x0}, &(0x7f00000000c0)=0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001240000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="44000000090605000000000000000000010000050900020073797a30000006000500010007000000080009400000000114000880100007800a001100b4"], 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) (async) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="44000000090605000000000000000000010000050900020073797a30000006000500010007000000080009400000000114000880100007800a001100b4"], 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000030605000000000000000000000000000500010007"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20008050) (async) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000030605000000000000000000000000000500010007"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20008050) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x38, 0x10, 0x49920d862a92153b, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r1, 0x0, 0x15001}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GTP_ROLE={0x8, 0x4, 0x6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 20.479656431s ago: executing program 3 (id=3203): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$kcm(0xa, 0x1, 0x0) (async) r4 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000500)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtfilter={0x44, 0x2c, 0xd2f, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0xe2}, @TCA_ROUTE4_TO={0x8, 0x2, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc044}, 0x40) (async) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) r7 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) (async) ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x8916, &(0x7f0000000000)={r7}) r8 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x8916, &(0x7f0000000000)={r8}) (async) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8936, &(0x7f0000000000)={r7}) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x4, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000c00) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 20.191232556s ago: executing program 3 (id=3208): socket$nl_netfilter(0x10, 0x3, 0xc) 20.068295597s ago: executing program 3 (id=3211): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x60, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0xfff}, @IFLA_OPERSTATE={0x5, 0x10, 0x40}, @IFLA_IFALIASn={0x4}, @IFLA_VF_PORTS={0x24, 0x18, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, [@IFLA_PORT_PROFILE={0x8, 0x2, '^]^\x00'}, @IFLA_PORT_INSTANCE_UUID={0x14}]}]}]}, 0x60}}, 0x0) 19.922725661s ago: executing program 0 (id=3214): socket$inet(0x2, 0x2, 0x1) r0 = socket(0x2, 0x800, 0x203) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000001800)=[{0x0}, {&(0x7f0000000400)="3245c7ba4a961c6bf10a489a6ebc33838e3496836f66cfd0102b71cc6b4f0af79898bd11b9a6a9aa23c7a7abc19c5976bb1690bd3aef1617", 0x38}, {&(0x7f00000019c0)}], 0x3) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x2000000000000103, &(0x7f0000001fc0)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x2, 0xc4, &(0x7f0000001880)=""/196, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0xffffffff}, 0x8, 0x10, &(0x7f0000000480)={0x5, 0x0, 0x3}, 0x10}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001f00)=ANY=[@ANYRES8=r2, @ANYRES32=r3, @ANYRESOCT=r3, @ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r1, @ANYBLOB="000000000100000003000000000000000000000000000000000000006e0b0215517cd85bf21a8d9faa37435bd5111ce9ef6886605bba", @ANYRESHEX=0x0, @ANYRESOCT=r4], 0x50) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e008000000008", @ANYRES16=r5], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001d80)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) r8 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000000)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) read$alg(r9, &(0x7f0000000500)=""/4096, 0x1000) splice(r8, 0x0, r10, 0x0, 0x400000008000f28, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) 19.838493481s ago: executing program 3 (id=3216): bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x2, 0x4, 0xb, 0x407, 0x1000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000400000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000009500000000000000"], &(0x7f0000000080)='GPL\x00'}, 0x65) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x79, 0x0, &(0x7f0000000440)="e0b9547ed387dbd6d7593ca29acb593567028130aa9b7e0fa52e10816baf77a23961da2769540726871ca3b0f762b620b9d66ac925d72e491f712475b0270450253f3d90092215bcf6ae41f058b073bd33c8c15fd3cd37cdfd28ff9730c5e3550258873d8df81648036d4ff4609ae5e5df06b5a7c85f985b74", 0x0, 0x200a00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 19.609694801s ago: executing program 0 (id=3217): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="200000001000000300000000fbdbdf257a000000", @ANYRES32=0x0, @ANYBLOB="1600000408b5000000"], 0x20}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) shutdown(r0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x23, 0x2, 0x20}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20, 0x0, 0xfe}, @const={0xfffffffe, 0x0, 0x0, 0xa, 0x3}]}}, 0x0, 0x4e, 0x0, 0x0, 0xe61}, 0x28) r1 = socket(0x18, 0x1, 0x1) getsockopt$inet_int(r1, 0x111, 0x32, 0x0, &(0x7f0000000380)) recvmmsg(r0, &(0x7f0000000080), 0x72a, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000480), 0x4) sendmsg$tipc(r2, &(0x7f0000000400)={&(0x7f00000003c0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x4}}, 0x10, &(0x7f0000000200)=[{&(0x7f00000000c0)="257c0100000065666efda463d8", 0xd}, {&(0x7f0000000540)="0d763c2ffdae045976a5fc3bec1a35a5e4ac8ee4", 0x14}], 0x2, 0x0, 0x0, 0x4c840}, 0x4000001) recvmmsg(r2, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{0x0}], 0x1, &(0x7f00000004c0)=""/95, 0x5f}, 0xfffffffc}], 0x1, 0x12260, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff000000000300000000000000000000000200000000000000000000000000000b03000000000000000000000902"], 0x0, 0x56, 0x0, 0x3}, 0x20) unshare(0x26020480) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="02030003120000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af05000600000000000a00000000000000000000000000000000000000000000010b0000000000000002000100000000000000070c0000000005000500000000000a00000000000000fc01000000000000000000000000000107000000000000000100140007"], 0x90}, 0x1, 0x7}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f0000000080)) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={r4}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000004c0)={'syztnl0\x00', &(0x7f0000000200)={'ip6tnl0\x00', 0x0, 0x2b, 0x4, 0x8, 0x9, 0x21, @mcast1, @local, 0x8, 0x1, 0x63, 0x7f}}) 18.882169832s ago: executing program 3 (id=3219): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) (rerun: 32) sendmsg$ETHTOOL_MSG_EEE_GET(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r1, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x880}, 0x4c001) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="701500003c0007010300000000000000017c0000040042800c00018006000600843b00004c150280481514800304"], 0x1570}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 18.437811853s ago: executing program 0 (id=3220): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x28012, r0, 0x0) mmap(&(0x7f00009c5000/0x1000)=nil, 0x1000, 0x3, 0x28012, r0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x8, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x140c00) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, 0x0}], 0x1, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0xc20022, r5}) syz_emit_ethernet(0x82, &(0x7f0000000040)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x80}, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x48, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x0, 0xff, @private1, @private2, [@hopopts={0x3a, 0x1, '\x00', [@calipso={0x7, 0x8, {0x0, 0x0, 0x0, 0x80}}]}]}}}}}}}, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x23) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x85, 0xc, 0x277, 0x0, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x40, 0x1, 0x5}}) ioctl$FICLONE(r6, 0x40049409, r2) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="30000000120005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="000000000000000005002100a800000008000a00", @ANYRES32=r7], 0x30}}, 0x0) read(r6, &(0x7f0000000140)=""/166, 0xa6) 18.285379397s ago: executing program 3 (id=3221): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000000000000004b64ffed850000006d000000a5000000050000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000001340)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r6], 0x1c}}, 0x0) write$nci(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="61030203f401060101b702"], 0xb) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@ipv6_newnexthop={0x30, 0x68, 0x309, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NHA_FDB={0x4}, @NHA_ENCAP={0x14, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, @LWTUNNEL_IP_OPT_VXLAN_GBP={0x8, 0x1, 0x2}}}}]}, 0x30}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000040)='contention_end\x00', r7}, 0x18) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x101801, 0x0) write$rfkill(r9, &(0x7f0000000000)={0x5, 0x0, 0x3, 0xfc}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r10 = socket(0x10, 0x3, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r13 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) ioctl$SIOCAX25GETINFOOLD(r13, 0x89e9, &(0x7f0000000000)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYRES32=r12, @ANYBLOB="00000000100000001c001a"], 0x44}}, 0x0) sendmmsg(r10, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x14, r1, 0x731, 0x0, 0x0, {0x38}}, 0xfffffffffffffe49}, 0x1, 0x2, 0x0, 0x48880}, 0x0) 18.09840914s ago: executing program 1 (id=3222): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000240)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r0], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x2}, 0x94) r2 = accept(r0, &(0x7f0000000080), &(0x7f0000000000)=0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r1, 0x0, 0xd}, 0x18) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x1b, 0x0, 0x0) sendmsg$NL80211_CMD_SET_BSS(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x24000000) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @any, 0x2}, 0xa) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r5 = socket$nl_route(0x10, 0x3, 0x0) connect$bt_rfcomm(r0, &(0x7f0000000100)={0x1f, @none, 0xc}, 0xa) sendmsg$nl_route(r5, 0x0, 0x884) connect$bt_rfcomm(r4, &(0x7f00000001c0)={0x1f, @none, 0x1}, 0xa) shutdown(r0, 0x1) gettid() r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000002070101000000000000000000000006140007800804000000ff7fff0800024096000800"], 0x28}, 0x1, 0x0, 0x0, 0x20000084}, 0x880) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000004c40)=[{{&(0x7f0000000040)=@abs={0x0, 0x0, 0x4e24}, 0x6e, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="14000000000000fa9a77098961998900", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x18, 0x40004}}], 0x1, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000a80)=0x0) getgid() syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) r8 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@dev, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, r7}, {0x0, 0x6}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x1}, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x33}, 0x0, @in=@dev, 0x200, 0x4, 0x0, 0x7}}, 0xe8) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000a00), r10) sendmsg$NET_DM_CMD_START(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)={0x14, r11, 0x1}, 0x14}}, 0x0) sendmsg$NET_DM_CMD_STOP(r9, 0x0, 0x8000) 17.369171952s ago: executing program 0 (id=3224): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000300)={@ipv4={'\x00', '\xff\xff', @multicast1}, @empty, @loopback, 0x80000001, 0x7f, 0xe, 0x80, 0xf, 0x80000}) ioctl$INCFS_IOC_FILL_BLOCKS(r1, 0x80106720, &(0x7f0000000700)={0xa, &(0x7f00000005c0)=[{0x9, 0x50, &(0x7f0000000000)="1f65d20d14de328d0039513ba109000000f2f0770549108a00b5a48ecd08f2cdb00c44af9b21d8f3b4b9e2f17fc30b9e6e37a438fb8b958e3cd71fc79e96934f8081996c7b1a2e733a8ef001d39973c2", 0x0, 0x1}, {0x7, 0xba, &(0x7f0000000080)="c1dc5c1e29b690ff4d922423dcb9ae1f9ac078329ca475b0422ed59ebe1779899f28d8264354a5d71b4fe820da0276bb963266e8aff747952025a708cc1e677b1d45c972cf2d6ba2c09678b05e2d7553513a516f11815650f2fa58c6fb590707cab6ee4c0b871a3a3c61dc6e494b948ee4090f27514c4d5b392d3305e93b7f1bc56fe7472da3ce80bc717a4108be8aa2451b8fad45bc242dd30e1a33d82934bfa2a2799025f81a3c375d7f7b2f5ab38ab075a543e885b5c0fe81"}, {0x7, 0x1f, &(0x7f0000000140)="8ab89afd402cd295d9e6e9cfc502a0c3fc7f1ef09a3865339d8750ee2799f9", 0x1}, {0x8, 0x3b, &(0x7f0000000180)="967cd1ea5a62862ddbef574adcf59d6a997c696608c164447d02b44da4d459f6551ca4aa40296623c899dd34744ecbebff6c71f020e87503b717d2", 0x1, 0x1}, {0x8000, 0xb9, &(0x7f00000001c0)="c79394522204ce3740125ef0dadff09e68fd165e0173d0d34272ae18a4ef25603f90bc84d01a88a9d39468107ca0ff049d21e815dade1c0a1507747aa0b12d42c1e92da4a5acff7d32039e02e6ac3dfa44c7a1c764b496d681b81756890c2034dfd7844a2fb053f361a21552c8f29da28dba0db39771d4879c95c326f6ab9de5cafba5fe07c6d2a2c7a846e2a738385aeb177906fac8c01be94c2b8c79e43a786c708ec633755c48c67b43859a090febc4ea864ea6dbfbe7e6", 0x0, 0x1}, {0x9, 0x22, &(0x7f0000000280)="25fcff2431c1e248c1e23faef59a320ef5d5ca56112e0ef9fc40f632ea0ad5869bbf", 0x0, 0x1}, {0xb2d5, 0x9, &(0x7f0000000300)="5238986b94578cc625", 0x1}, {0x5, 0x1b, &(0x7f0000000400)="02d4c9faad6b5b19b2b63b0fc81e8e16ac9398f4affb20ceb36568", 0x1, 0x1}, {0xffffffff, 0x48, &(0x7f00000004c0)="f2c7bf312ac73ce5187d2f11d21715f1b830c2c5cb530849506a191f2c75b0ca71324387fb2c4735ae2d6ba7c35d9046612ed43c2a081aefbba91c1d7fe1eaae15d548eff94d43d1", 0x0, 0x1}, {0x7, 0x12e, &(0x7f0000000740)="8b032861a8171f80878fe6f9c26c420124a7d7cdd19574e8bd2994bc9942908f20efaf03283d829f11bc05c285035b7730411dc62fea49ba659c6429354961cbdf77175b64525e656b815947cd6f52ff0f35029decea14f7c9c24297f6e68af37735f853a55fbe21728509d3c6b245a35068e3021afc4134f698922342f640e6f1f4f08162389a6bfb23fd37986b3bd1bc11afd91b66da671371ccd013b60a04dfe42115e432503ed81e161ee968909adca6c9cf04d938ef0f0edceec50981cd5498e0a3e3bdcf96b548e4c5ede2378cdfa8850b52c79303941ba84145f810ca03e5feeec4d3dcaf58cb26bd1c847e0c962aaf260b03634a4563c90237427cae64bbeeae38b22cda2a060f0ee612644729564bae5942c4ba3cfe61d9f2c953bf4273c46ded36f232364278f5c6df", 0x0, 0x1}]}) r3 = socket$inet6(0xa, 0x3, 0x7f9) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffffffffffffff2e2be82db1af00000000", 0x18) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000a00), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000a80)=ANY=[@ANYBLOB="2b667265657a6572202d706572665f6576656e74202b6e6574202d6d656d6f7279202b72646d61202b696f202b68756765746c62202a77a89f40f05d0993686e92b30c2e2f4bc220ac270e22de97139df787e5bbfedf4579e87ec52d61e2e764a828fa0eca3643a25ac0363579f5240091b573e04f195f15745364ccd80ce773077954ddcdd8564f4b738d0555efc89ce664e76624a8ede3e32c5a0884e3980fbfbc1c7e777e3da57cec60f47bfe403cf8167c7acead04611a7f00d8"], 0x35) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r3, 0x29, 0x37, &(0x7f0000000000)=ANY=[@ANYBLOB="5e0000000000e7d5"], 0x8) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ_RESET(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000500)={0x28, 0x15, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) 17.202265904s ago: executing program 0 (id=3226): socket$inet(0x2, 0x2, 0x1) r0 = socket(0x2, 0x800, 0x203) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000001800)=[{0x0}, {&(0x7f0000000400)="3245c7ba4a961c6bf10a489a6ebc33838e3496836f66cfd0102b71cc6b4f0af79898bd11b9a6a9aa23c7a7abc19c5976bb1690bd3aef1617", 0x38}, {&(0x7f00000019c0)}], 0x3) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x2000000000000103, &(0x7f0000001fc0)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x2, 0xc4, &(0x7f0000001880)=""/196, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0xffffffff}, 0x8, 0x10, &(0x7f0000000480)={0x5, 0x0, 0x3}, 0x10}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001f00)=ANY=[@ANYRES8=r2, @ANYRES32=r3, @ANYRESOCT=r3, @ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r1, @ANYBLOB="000000000100000003000000000000000000000000000000000000006e0b0215517cd85bf21a8d9faa37435bd5111ce9ef6886605bba", @ANYRESHEX=0x0, @ANYRESOCT=r4], 0x50) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e008000000008", @ANYRES16=r5], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001d80)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) r8 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000000)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) read$alg(r9, &(0x7f0000000500)=""/4096, 0x1000) splice(r8, 0x0, r10, 0x0, 0x400000008000f28, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) 17.082749064s ago: executing program 2 (id=3227): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000270600000ee60000bf2500000000000073350000000000006507000002001000070700004c0000001f75000000000000bf54000000000000070400004400f9f0ad32010000000000950000000000000005000000000000009500000000000000debfa255e44e4cc39f211fb04d7f202e6a53bd86bde99b679b4e6d24b8125690361eec3b181dcfd7c2fb2d1f8975b579a085bee32d414c1f3ab987a9de6385ae8021f4ca33b9b35fe817e98beb9cefe7f40fd6f0ea3affbdaaa897c70fb01d270a7b00d36fb5ab8fa92ac014a106e3e4decc68652503ca54fcef437d96c8a05d59ddcc8abf09cd77e93e940207b03189c5d4661e43df6f1f036c8d85a2ad7615a021f8cbe507ef94fb9f33315366e9ae080000001b532226b63b460d68808a67529637bf7f6731ad0cf1718bae3c8b9d2f89050cb496fe791381af6fab290900000000000000d640a5fde1f7d5eaa97cd25523fbd77300000000000000d67559b0c848aa3e7091f33e2dfc351e903ce85488fb25691249545bcf877011847df184bae6d3f5d0c016ec7d581d5b2fcb494d8c2df1929398ec5c3675ed16c27fff46a695eed7f50c531a612d5677b5e949ee4f16d10e41074702c4e89ee401ec2ec65f38f64189f1fa2cc0a42add3119025764759de2f093c26fe51d2f7635bb06bdf0b97d4a96cb0813e084232421c6026629fbf4c81954d11e154659b54fcf3468577295"], 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000c0000004208000040000000c0"], 0x50) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$int_in(r2, 0x5421, 0x0) connect$bt_sco(r2, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000000000000000000000080654d970008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$kcm(0xa, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x8918, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) accept$unix(r0, 0x0, &(0x7f0000000400)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0xd, 0xd, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000000000000000000ffffffff851000000100000095000000000000001800000020646c2500000000002020207b1af8ff00000000bda100000000000007010000f8ffffffb702000008b19200b703000000000000850000003100000095"], &(0x7f00000000c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r6 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000040)={0x2004}) epoll_ctl$EPOLL_CTL_DEL(r6, 0x2, r7) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x1, 0x8}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x12}]}}]}, 0x38}}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0), 0x10f0, r1}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)="f224d118e13863ab18f8b593bb57892475354e5d886e9bae16c6efaac35c272c08da4fa594170be7fdc27d43366a8a13659921f297fa620f62622a27dc415111bdddda95c584dc75f9e09579338460db33c494a626c541d9fff1c0ec305fdb7f8e6619dac6a5affa5797093140dd5125deaf32e9a8ab5c0d0a00b0c76d8130545e63c5e858c2bb70db00"/149, &(0x7f00000007c0)="50bece05795c2a57e67b1ec8861091dad08fb95a0f25e72bedfa3a7d1add44b85fe29aa617031b5c800a51322d85c00127ba30e9fd2657a6a3b4c749a8852f6afbc9adf78a5c7fcd4e8eb08703b279bb3746dc902d48481b2b2e232e6edca6d6cc0f01e26e2ab8000000fa9884d6547645700f24c3f80b62ff0100000000000007a9684b71228cf2a442e7f7e0ff9fe32ae48573b11b53ec0fd5fc34f62a415f8bf2ae5d2b5696a81069bb717c365d88c6e9ced3827fe613d459c47c4627a5f8901a535ec51c99621c982fb4d12148d647ac56ceed618e5dfe78047d0eee53142208732aae0c6971707fac9ec52fc0ed8ff70dd2e3caf619abab96c3a3c90e24349dd2b181592d26b12abaf512fa6057d97e16439fef60f3c9c7b330190970f64190631dc8fb9413ca8c427e5dae0060b19148517e414db3e760815cdfb1f3e5ec570794ea05d0b7c46347318ca9d1e6a7665e21aa2c799fe7fa8e5c73f146416c6c91e7465685021cddf5b5d044fc2a4a3ee327a1fdee988f8a7c63c02747c03f5de94172affbde9bcb88ccc8cef719a0a1ee103edf9e765553c72358d734763aa612f5eaecb93928adf54e7da0af8e20f2ab6ac4cba73adc9b1687116369e7f682bc04e15c83", 0x7ff, r1}, 0x38) 17.03814255s ago: executing program 1 (id=3228): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ_RESET(r1, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f0000001dc0)=ANY=[@ANYBLOB="281d0000150a010000fcb100000005001200003f6fc26ae15af7c2109ddf079f2c7200080003"], 0x28}}, 0x20004000) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x40}}, 0x0) 16.898400277s ago: executing program 1 (id=3229): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x78, 0x1e, 0x109, 0x102, 0x25dfdbfc, {}, [{0x64, 0x1, [@m_mirred={0x34, 0x8, 0x0, 0x0, {{0xb, 0x9}, {0x4}, {0x6, 0x6, "ab24"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ct={0x2c, 0xe, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x78}, 0x1, 0x2b1e}, 0x2000c000) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0xb, &(0x7f0000005300)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x10) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000200bc0000000000cb580013000000000000"], 0x0, 0x26, 0x0, 0x9}, 0x28) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000004c0)='cubic', 0x6) (async) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) (async) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) (async) sendto$inet6(r5, &(0x7f0000000280)="32780f", 0x3, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) (async) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000000c0)='cubic', 0x5) (async) shutdown(r5, 0x1) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="0000001801040700ff00c5"], 0x24e2) (async) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x40050) (async) r7 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000002c0)={0x0, 0x5, 0x30}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp6_SCTP_CONTEXT(r8, 0x84, 0x11, &(0x7f0000000380)={r9, 0x3}, &(0x7f00000003c0)=0x8) splice(r1, 0x0, r7, 0x0, 0x47, 0x0) (async) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r10, 0x0, 0xf69}, 0x18) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) 16.869740528s ago: executing program 0 (id=3230): syz_emit_ethernet(0xbe, &(0x7f00000008c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x500, 0x0, 0x0, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0xff}, @local}, {0x800, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "6fdfa0d2001efbb3e29a4ac275ca11b984ff5def6ed2e4ea9bc0eabdd34c732b", "df23520b57e4c98679c7795a27c7bf3e7d776b600ba8d82d6ba417e219edd86fb708441efcf75fe803412dae374281c2", "5df814aa2e34e4f8a759805b993e2d69a8f476de686861a9850edbe3", {"2cfee9b9d5b0b2b171b51f9174963b0c", "e40ca7e0a7b4bbc4bc9720c876a57954"}}}}}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="24000000210001000000000000000000020000000000000000000000050019"], 0x24}}, 0x48850) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b032200e0ff25000212475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r4}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=ANY=[@ANYBLOB="140000001000040000000000000000000000000acc000000000a0500000000000000000007000000b50006005bb853d460b5e13a9fc9dfe31ba1a0271ce1ba44f3cb4f03a87e7c4d6dd1e4d0282428190e45a9564417de424e39e20402d176db60493c03dd4e7cea5fc544e30d0734a5b8f2a14c122fcc5f29623c9580b1e98b40d5b7d7b4cf2aab8f3b689d1445304bf804ffac26e5e98684a8ec68e4f05b90580dcc1f577c1978f4a06a33a904c451e551e2df191076ae31f54dc11046ed1a77a7a7c2db2958f5f54dd5fd94338f94030665b88d10bba232dbda5fbd0000004c000000090a01040000000000000000070000000900020073797a31000000000900010073797a3000000000080005400000001c08000a4000000000080003400000004008000f4000000006480200000c0a01030000000000000000070000070900020073797a31000000000900010073797a30000000001c0203801802008004010b80600001800d00010073796e70726f7879000000004c000280080003400000000c06000140000800000600014000060000050002000800000008000340000000000800034000000008080003400000000006000140000700000800034000f30003100001800b00010072656a656374000018000180080001006c6f67000c0002800800064000000001100001800b00010072656a656374000020000180090001006c61737400000000100002800c0002400000000080000000140001800e000100696d6d6564696174650000002800018008000100647570001c0002800800024000000003080002400000001108000240000000170c000180070001006374000010010a800c00028008000340000000044a000100a8d7b12481ee55a9995973ed74660f17b81b9e14e0977f0d4f3f1af91b61536952931687e7a078fcec3b96aa388c85c3106752baade7d3afaa114d5dc50e63a23916b560eb1e000043000100acf1ff8d770582ea606ab2f03f3b72eb65ea5729e43153c22e91ead137f0cbbefafe93609c9ff801d2723ecaa39af5ed6b209fdd4a767308d1ecbfb64fcafb00700001001215aca5336b1f03f309b273eeff1a14b6d9711b916e5282995c8f120b1f638f76a04974743960c61b37d54c8e4801751fa83584f4b0a0791a9c54111a4ed8e77d01f34f6a62fe17e71685371fc8a6e59c5dd5fc71ee9f74c5055998492bd4a98a4d503650125aedc8bd50d9140000001000010000000000000000000084000a1b2dbce7a473712c3f82d0af7c95f2314191e06a67bae715cdf3954eb77f470ada65abc7e65594d776ba135edae27b2fbbaf6ec219e8d30422dabaf7c0d567f4e7ae475bdbdeb4f970f130f995c7def3afca15c608327ec3453e6d10dd066256882dcfb4c27a9fb626964990a004e2c74d7d32acec2182a96c06158e5b9c6e01c140c8cdb3fd33a39bcebed0b0d77e45a6f5f05042c0a68f523f7762fb0397129da5e9a0075b2eec9fb2ea382871b08d14fa3a4ad1f79a9b404fb69b5d3e5c9c8819209e3fbbb4938115e26d64e9eaa03b51eb0c95734d1559b4f3359ff08b34c3"], 0x388}}, 0x4000000) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000001200)={0x10, 0x0, 0xfffffffe, 0x40800100}, 0xc) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0x58, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00'}) ioctl$BTRFS_IOC_DEV_REPLACE(0xffffffffffffffff, 0xca289435, &(0x7f0000000680)={0x2, 0x8, @status={[0xfffffffffffffffe, 0x0, 0x100000000, 0x8, 0x4, 0xfb4]}, [0x8000000000000007, 0x417, 0x1cde, 0x81, 0x5, 0x40, 0x7, 0x100000001, 0xee, 0x2, 0xfffffffffffffff7, 0x7, 0x200, 0x1, 0x10002, 0x100000000, 0x9, 0x1, 0xd27, 0x6, 0x2, 0x480000000000000, 0xffbd, 0x1000, 0x7, 0xff, 0x4bd, 0x18000000, 0x8, 0x62, 0x8001, 0xb1b, 0x7, 0x9, 0x81, 0x0, 0x0, 0x5, 0x8, 0x2, 0x9, 0x0, 0xfffffffffffffff9, 0xb24c, 0x4, 0x800, 0x0, 0x2, 0xe, 0x3, 0x9, 0xffffffff, 0x1, 0x400000003, 0x0, 0x7fff, 0x401, 0x1, 0xfffffffffffffffd, 0xf, 0x100000001, 0x0, 0x6, 0x8]}) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x60004}, 0xc, &(0x7f0000001180)={&(0x7f0000001100)={0x58, 0x2, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x7a}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x1}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x24040804}, 0x44000040) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r1, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000480)={&(0x7f00000016c0)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r2, @ANYBLOB="000129bd7000fddbdf25060000000c00018008000100", @ANYRES32=r4, @ANYBLOB="180001801400020064766d727030000000000000000000004000018008000100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="14000200626f6e64300000000000000000000000080003000000000008000100", @ANYRES32=r12, @ANYBLOB="2800018008000300000000001400020076657468315f746f5f7465616d0000000800030000000000180001801400020069705f767469300000000000000000000c00018008000100", @ANYRES32=r13, @ANYBLOB="f996dd8233b9547ce00dbabf5604897f3e80000383375ee55f261dde66a67af2a7869e8f34a315f40a6d5fb5cbfe8a0524e183aaa6f2c492fbdcdcd6ca991dad865e506284c9a920b0931eaa6366d525884d829cf30f233e57d1a82c15050ccbdff8b7e6a1fa4dc6df2927ddd3d8a5dbb122cf4249c7836dc289d2373cf20197d75a"], 0xc4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000600)=@get={0x1, &(0x7f0000000500)=""/247, 0x7ff}) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002d00010026bdf000fcdbdf25040000000400190008000c"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 16.701078092s ago: executing program 1 (id=3231): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071114200000000008510000002000000850000000500000095000d00000000009500a50000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r2, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000001b40), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x47, 0x0}}, 0x10) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x32) close(0x4) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000080)) 16.654633023s ago: executing program 2 (id=3232): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@getstat={0xe0, 0x15, 0x0, 0x0, 0x0, {{'aegis128-generic\x00'}}}, 0xe0}}, 0x0) sendmsg$nl_crypto(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8000000110001"], 0xe8}}, 0x0) socket$netlink(0x10, 0x3, 0x8) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000040)={0x9, 0x9000000008000000, 0x7, 0x8, 0x10, 0x59b}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="040000000000000004001000fdffff7f00000000000000000c000000010000001500000014000c8006000100d43f000008081159326892b56b00030001000000"], 0x40}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) r2 = socket$rds(0x15, 0x5, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x25, &(0x7f0000001500)={r4, @in6={{0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x28f9fed5}}, 0xfffe}, 0x90) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xc9, 0x8100, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) bind$rds(r2, &(0x7f00000000c0)={0xa}, 0x1c) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x54}, 0x1, 0x0, 0x0, 0x40814}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x40) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000540)={'macsec0\x00', 0x0}) r8 = gettid() r9 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010000304f9fffffffe0adf2500007400", @ANYRES32=r7, @ANYBLOB="049c01000750050008001300", @ANYRES32=r8], 0x3c}, 0x1, 0x0, 0x0, 0x4802}, 0x4000) write$cgroup_pid(r5, &(0x7f0000000100)=r8, 0x12) 16.523487403s ago: executing program 1 (id=3233): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8931, &(0x7f0000000040)={'bridge_slave_0\x00', 0x2}) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c80)=ANY=[@ANYBLOB="640000000206030000000000000000000500000014ec0780080012400000000005001500ff00000016000300686173683a6e65742c706f72742c6e6574000000050005000200000005000400000000000900020073797a31000000000500010007000000"], 0x64}}, 0x0) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000080)=[{0x20, 0x2, 0x0, 0x7f}, {0x6}]}, 0x10) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) (async) bind$inet(r2, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) (async, rerun: 32) connect$inet(r2, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) (async, rerun: 32) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000000)=0xa13, 0x4) (async) sendto(r2, &(0x7f0000000740)="50fb", 0x2, 0x0, 0x0, 0x0) (async) sendto$inet(r2, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x52, 0x0, 0x0) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r2], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a00)={r3, 0x0, 0x0, 0x15, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000540)="a0", 0x0}, 0x50) syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) 16.410334834s ago: executing program 1 (id=3234): r0 = socket(0x1d, 0x2, 0x6) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r0, 0x6a, 0x1, 0x100, 0x4) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6(0xa, 0xa, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0xe23, 0x3, @empty}, 0xff56) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x0, @empty}, 0xa, 0x4, 0x4, 0x3}}, 0x26) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r4, &(0x7f0000000040)="04", 0x1, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r8, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r7, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4, 0x0, 0xfffd}}, 0x26) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB="2503800000000000000008020000"], 0x14}}, 0x0) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000007c0)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x34, 0x1, [@m_mirred={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4e}, {0x4, 0xa}, {0xc}, {0xc, 0x8, {0x1}}}}]}]}, 0x48}}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r9, 0x6, 0xd, &(0x7f00000000c0)='cubic', 0x9) r11 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00aff7c41e3c2478bde53503920000020000000000000000000004000000000000"], 0x0, 0x26}, 0x20) close(r11) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001740)={&(0x7f00000004c0)=@newqdisc={0x24, 0x29, 0xa19702d202eff97b, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {0x1, 0xffe0}, {0xffff, 0xffff}, {0xfff1, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) bind$inet(r9, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 15.808845468s ago: executing program 2 (id=3235): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000300)={@ipv4={'\x00', '\xff\xff', @multicast1}, @empty, @loopback, 0x80000001, 0x7f, 0xe, 0x80, 0xf, 0x80000}) ioctl$INCFS_IOC_FILL_BLOCKS(r1, 0x80106720, &(0x7f0000000700)={0xa, &(0x7f00000005c0)=[{0x9, 0x50, &(0x7f0000000000)="1f65d20d14de328d0039513ba109000000f2f0770549108a00b5a48ecd08f2cdb00c44af9b21d8f3b4b9e2f17fc30b9e6e37a438fb8b958e3cd71fc79e96934f8081996c7b1a2e733a8ef001d39973c2", 0x0, 0x1}, {0x7, 0xba, &(0x7f0000000080)="c1dc5c1e29b690ff4d922423dcb9ae1f9ac078329ca475b0422ed59ebe1779899f28d8264354a5d71b4fe820da0276bb963266e8aff747952025a708cc1e677b1d45c972cf2d6ba2c09678b05e2d7553513a516f11815650f2fa58c6fb590707cab6ee4c0b871a3a3c61dc6e494b948ee4090f27514c4d5b392d3305e93b7f1bc56fe7472da3ce80bc717a4108be8aa2451b8fad45bc242dd30e1a33d82934bfa2a2799025f81a3c375d7f7b2f5ab38ab075a543e885b5c0fe81"}, {0x7, 0x1f, &(0x7f0000000140)="8ab89afd402cd295d9e6e9cfc502a0c3fc7f1ef09a3865339d8750ee2799f9", 0x1}, {0x8, 0x3b, &(0x7f0000000180)="967cd1ea5a62862ddbef574adcf59d6a997c696608c164447d02b44da4d459f6551ca4aa40296623c899dd34744ecbebff6c71f020e87503b717d2", 0x1, 0x1}, {0x8000, 0xb9, &(0x7f00000001c0)="c79394522204ce3740125ef0dadff09e68fd165e0173d0d34272ae18a4ef25603f90bc84d01a88a9d39468107ca0ff049d21e815dade1c0a1507747aa0b12d42c1e92da4a5acff7d32039e02e6ac3dfa44c7a1c764b496d681b81756890c2034dfd7844a2fb053f361a21552c8f29da28dba0db39771d4879c95c326f6ab9de5cafba5fe07c6d2a2c7a846e2a738385aeb177906fac8c01be94c2b8c79e43a786c708ec633755c48c67b43859a090febc4ea864ea6dbfbe7e6", 0x0, 0x1}, {0x9, 0x22, &(0x7f0000000280)="25fcff2431c1e248c1e23faef59a320ef5d5ca56112e0ef9fc40f632ea0ad5869bbf", 0x0, 0x1}, {0xb2d5, 0x9, &(0x7f0000000300)="5238986b94578cc625", 0x1}, {0x5, 0x1b, &(0x7f0000000400)="02d4c9faad6b5b19b2b63b0fc81e8e16ac9398f4affb20ceb36568", 0x1, 0x1}, {0xffffffff, 0x48, &(0x7f00000004c0)="f2c7bf312ac73ce5187d2f11d21715f1b830c2c5cb530849506a191f2c75b0ca71324387fb2c4735ae2d6ba7c35d9046612ed43c2a081aefbba91c1d7fe1eaae15d548eff94d43d1", 0x0, 0x1}, {0x7, 0x12e, &(0x7f0000000740)="8b032861a8171f80878fe6f9c26c420124a7d7cdd19574e8bd2994bc9942908f20efaf03283d829f11bc05c285035b7730411dc62fea49ba659c6429354961cbdf77175b64525e656b815947cd6f52ff0f35029decea14f7c9c24297f6e68af37735f853a55fbe21728509d3c6b245a35068e3021afc4134f698922342f640e6f1f4f08162389a6bfb23fd37986b3bd1bc11afd91b66da671371ccd013b60a04dfe42115e432503ed81e161ee968909adca6c9cf04d938ef0f0edceec50981cd5498e0a3e3bdcf96b548e4c5ede2378cdfa8850b52c79303941ba84145f810ca03e5feeec4d3dcaf58cb26bd1c847e0c962aaf260b03634a4563c90237427cae64bbeeae38b22cda2a060f0ee612644729564bae5942c4ba3cfe61d9f2c953bf4273c46ded36f232364278f5c6df", 0x0, 0x1}]}) r3 = socket$inet6(0xa, 0x3, 0x7f9) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffffffffffffff2e2be82db1af00000000", 0x18) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000a00), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000a80)=ANY=[@ANYBLOB="2b667265657a6572202d706572665f6576656e74202b6e6574202d6d656d6f7279202b72646d61202b696f202b68756765746c62202a77a89f40f05d0993686e92b30c2e2f4bc220ac270e22de97139df787e5bbfedf4579e87ec52d61e2e764a828fa0eca3643a25ac0363579f5240091b573e04f195f15745364ccd80ce773077954ddcdd8564f4b738d0555efc89ce664e76624a8ede3e32c5a0884e3980fbfbc1c7e777e3da57cec60f47bfe403cf8167c7acead04611a7f00d8"], 0x35) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r3, 0x29, 0x37, &(0x7f0000000000)=ANY=[@ANYBLOB="5e0000000000e7d5"], 0x8) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ_RESET(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000500)={0x28, 0x15, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) 15.73669185s ago: executing program 2 (id=3236): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xa, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_MAX_P={0x8, 0x4, 0xc}, @TCA_GRED_LIMIT={0x8, 0x5, 0x3}, @TCA_GRED_DPS={0x10, 0x3, {0x9, 0x4, 0x1, 0x6}}, @TCA_GRED_MAX_P={0x8, 0x4, 0xfffffffc}, @TCA_GRED_DPS={0xfffffffffffffff1, 0x3, {0x8, 0xe, 0x1, 0x1}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r6 = socket$isdn(0x22, 0x2, 0x11) bind$isdn(r6, &(0x7f0000000000)={0x22, 0x1, 0xe, 0x0, 0xb}, 0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000ec0)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r5}, @IFLA_HSR_SLAVE2={0x8, 0x2, r7}, @IFLA_HSR_PROTOCOL={0x5, 0x7, 0x1}]}}}]}, 0x48}}, 0x0) 15.558452499s ago: executing program 2 (id=3237): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001500)=ANY=[@ANYBLOB="d8000000000203000000000000000000020000053c0002802c00018014000300fc00000000000000000000000000000114000400000000000000000000000000000000010c000280050001002100000004000380040001"], 0xd8}}, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000000040)=0x78983c75, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000c40), 0x12) (async) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) (async) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) pread64(r4, &(0x7f0000001840)=""/4096, 0x1000, 0x1) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000100)=@id={0x1e, 0x3, 0x1, {0x4e24, 0x1}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x2, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4aef6a06}, [@call={0x85, 0x0, 0x0, 0x43}, @ldst={0x6, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x93, &(0x7f00000005c0)=""/147, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x61e5cc96, 0x0, 0xfffffffffffffc8d}, 0x4c) 15.553295829s ago: executing program 2 (id=3238): r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={0xffffffffffffffff}, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r0, 0xe0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0), 0x0, 0xda, &(0x7f0000000200)=[{}, {}], 0x10, 0x10, &(0x7f0000000240), &(0x7f00000003c0), 0x8, 0x1e, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r2}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0xe, &(0x7f0000000600)=ANY=[@ANYRESDEC=r0], 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x80000009, 0x2}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x80000009}}}, 0x10, 0x0}, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r2, r4, 0x11, 0x0, @val=@perf_event={0x6}}, 0x18) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9c000000100001002abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="8201000000420000140003006272696467655f736c6176655f30000008000400d4000000600016805c00018010000200f9ffffff"], 0x9c}}, 0x0) 2.500651081s ago: executing program 32 (id=3221): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000000000000004b64ffed850000006d000000a5000000050000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000001340)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r6], 0x1c}}, 0x0) write$nci(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="61030203f401060101b702"], 0xb) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@ipv6_newnexthop={0x30, 0x68, 0x309, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NHA_FDB={0x4}, @NHA_ENCAP={0x14, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, @LWTUNNEL_IP_OPT_VXLAN_GBP={0x8, 0x1, 0x2}}}}]}, 0x30}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000040)='contention_end\x00', r7}, 0x18) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x101801, 0x0) write$rfkill(r9, &(0x7f0000000000)={0x5, 0x0, 0x3, 0xfc}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r10 = socket(0x10, 0x3, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r13 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) ioctl$SIOCAX25GETINFOOLD(r13, 0x89e9, &(0x7f0000000000)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYRES32=r12, @ANYBLOB="00000000100000001c001a"], 0x44}}, 0x0) sendmmsg(r10, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x14, r1, 0x731, 0x0, 0x0, {0x38}}, 0xfffffffffffffe49}, 0x1, 0x2, 0x0, 0x48880}, 0x0) 1.002053537s ago: executing program 33 (id=3230): syz_emit_ethernet(0xbe, &(0x7f00000008c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x500, 0x0, 0x0, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0xff}, @local}, {0x800, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "6fdfa0d2001efbb3e29a4ac275ca11b984ff5def6ed2e4ea9bc0eabdd34c732b", "df23520b57e4c98679c7795a27c7bf3e7d776b600ba8d82d6ba417e219edd86fb708441efcf75fe803412dae374281c2", "5df814aa2e34e4f8a759805b993e2d69a8f476de686861a9850edbe3", {"2cfee9b9d5b0b2b171b51f9174963b0c", "e40ca7e0a7b4bbc4bc9720c876a57954"}}}}}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="24000000210001000000000000000000020000000000000000000000050019"], 0x24}}, 0x48850) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b032200e0ff25000212475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r4}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=ANY=[@ANYBLOB="140000001000040000000000000000000000000acc000000000a0500000000000000000007000000b50006005bb853d460b5e13a9fc9dfe31ba1a0271ce1ba44f3cb4f03a87e7c4d6dd1e4d0282428190e45a9564417de424e39e20402d176db60493c03dd4e7cea5fc544e30d0734a5b8f2a14c122fcc5f29623c9580b1e98b40d5b7d7b4cf2aab8f3b689d1445304bf804ffac26e5e98684a8ec68e4f05b90580dcc1f577c1978f4a06a33a904c451e551e2df191076ae31f54dc11046ed1a77a7a7c2db2958f5f54dd5fd94338f94030665b88d10bba232dbda5fbd0000004c000000090a01040000000000000000070000000900020073797a31000000000900010073797a3000000000080005400000001c08000a4000000000080003400000004008000f4000000006480200000c0a01030000000000000000070000070900020073797a31000000000900010073797a30000000001c0203801802008004010b80600001800d00010073796e70726f7879000000004c000280080003400000000c06000140000800000600014000060000050002000800000008000340000000000800034000000008080003400000000006000140000700000800034000f30003100001800b00010072656a656374000018000180080001006c6f67000c0002800800064000000001100001800b00010072656a656374000020000180090001006c61737400000000100002800c0002400000000080000000140001800e000100696d6d6564696174650000002800018008000100647570001c0002800800024000000003080002400000001108000240000000170c000180070001006374000010010a800c00028008000340000000044a000100a8d7b12481ee55a9995973ed74660f17b81b9e14e0977f0d4f3f1af91b61536952931687e7a078fcec3b96aa388c85c3106752baade7d3afaa114d5dc50e63a23916b560eb1e000043000100acf1ff8d770582ea606ab2f03f3b72eb65ea5729e43153c22e91ead137f0cbbefafe93609c9ff801d2723ecaa39af5ed6b209fdd4a767308d1ecbfb64fcafb00700001001215aca5336b1f03f309b273eeff1a14b6d9711b916e5282995c8f120b1f638f76a04974743960c61b37d54c8e4801751fa83584f4b0a0791a9c54111a4ed8e77d01f34f6a62fe17e71685371fc8a6e59c5dd5fc71ee9f74c5055998492bd4a98a4d503650125aedc8bd50d9140000001000010000000000000000000084000a1b2dbce7a473712c3f82d0af7c95f2314191e06a67bae715cdf3954eb77f470ada65abc7e65594d776ba135edae27b2fbbaf6ec219e8d30422dabaf7c0d567f4e7ae475bdbdeb4f970f130f995c7def3afca15c608327ec3453e6d10dd066256882dcfb4c27a9fb626964990a004e2c74d7d32acec2182a96c06158e5b9c6e01c140c8cdb3fd33a39bcebed0b0d77e45a6f5f05042c0a68f523f7762fb0397129da5e9a0075b2eec9fb2ea382871b08d14fa3a4ad1f79a9b404fb69b5d3e5c9c8819209e3fbbb4938115e26d64e9eaa03b51eb0c95734d1559b4f3359ff08b34c3"], 0x388}}, 0x4000000) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000001200)={0x10, 0x0, 0xfffffffe, 0x40800100}, 0xc) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0x58, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00'}) ioctl$BTRFS_IOC_DEV_REPLACE(0xffffffffffffffff, 0xca289435, &(0x7f0000000680)={0x2, 0x8, @status={[0xfffffffffffffffe, 0x0, 0x100000000, 0x8, 0x4, 0xfb4]}, [0x8000000000000007, 0x417, 0x1cde, 0x81, 0x5, 0x40, 0x7, 0x100000001, 0xee, 0x2, 0xfffffffffffffff7, 0x7, 0x200, 0x1, 0x10002, 0x100000000, 0x9, 0x1, 0xd27, 0x6, 0x2, 0x480000000000000, 0xffbd, 0x1000, 0x7, 0xff, 0x4bd, 0x18000000, 0x8, 0x62, 0x8001, 0xb1b, 0x7, 0x9, 0x81, 0x0, 0x0, 0x5, 0x8, 0x2, 0x9, 0x0, 0xfffffffffffffff9, 0xb24c, 0x4, 0x800, 0x0, 0x2, 0xe, 0x3, 0x9, 0xffffffff, 0x1, 0x400000003, 0x0, 0x7fff, 0x401, 0x1, 0xfffffffffffffffd, 0xf, 0x100000001, 0x0, 0x6, 0x8]}) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x60004}, 0xc, &(0x7f0000001180)={&(0x7f0000001100)={0x58, 0x2, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x7a}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x1}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x24040804}, 0x44000040) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r1, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000480)={&(0x7f00000016c0)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r2, @ANYBLOB="000129bd7000fddbdf25060000000c00018008000100", @ANYRES32=r4, @ANYBLOB="180001801400020064766d727030000000000000000000004000018008000100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="14000200626f6e64300000000000000000000000080003000000000008000100", @ANYRES32=r12, @ANYBLOB="2800018008000300000000001400020076657468315f746f5f7465616d0000000800030000000000180001801400020069705f767469300000000000000000000c00018008000100", @ANYRES32=r13, @ANYBLOB="f996dd8233b9547ce00dbabf5604897f3e80000383375ee55f261dde66a67af2a7869e8f34a315f40a6d5fb5cbfe8a0524e183aaa6f2c492fbdcdcd6ca991dad865e506284c9a920b0931eaa6366d525884d829cf30f233e57d1a82c15050ccbdff8b7e6a1fa4dc6df2927ddd3d8a5dbb122cf4249c7836dc289d2373cf20197d75a"], 0xc4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000600)=@get={0x1, &(0x7f0000000500)=""/247, 0x7ff}) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002d00010026bdf000fcdbdf25040000000400190008000c"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 969.686788ms ago: executing program 34 (id=3234): r0 = socket(0x1d, 0x2, 0x6) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r0, 0x6a, 0x1, 0x100, 0x4) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6(0xa, 0xa, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0xe23, 0x3, @empty}, 0xff56) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x0, @empty}, 0xa, 0x4, 0x4, 0x3}}, 0x26) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r4, &(0x7f0000000040)="04", 0x1, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r8, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r7, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4, 0x0, 0xfffd}}, 0x26) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB="2503800000000000000008020000"], 0x14}}, 0x0) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000007c0)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x34, 0x1, [@m_mirred={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4e}, {0x4, 0xa}, {0xc}, {0xc, 0x8, {0x1}}}}]}]}, 0x48}}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r9, 0x6, 0xd, &(0x7f00000000c0)='cubic', 0x9) r11 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00aff7c41e3c2478bde53503920000020000000000000000000004000000000000"], 0x0, 0x26}, 0x20) close(r11) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001740)={&(0x7f00000004c0)=@newqdisc={0x24, 0x29, 0xa19702d202eff97b, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {0x1, 0xffe0}, {0xffff, 0xffff}, {0xfff1, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) bind$inet(r9, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 0s ago: executing program 35 (id=3238): r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={0xffffffffffffffff}, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r0, 0xe0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0), 0x0, 0xda, &(0x7f0000000200)=[{}, {}], 0x10, 0x10, &(0x7f0000000240), &(0x7f00000003c0), 0x8, 0x1e, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r2}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0xe, &(0x7f0000000600)=ANY=[@ANYRESDEC=r0], 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x80000009, 0x2}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x80000009}}}, 0x10, 0x0}, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r2, r4, 0x11, 0x0, @val=@perf_event={0x6}}, 0x18) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9c000000100001002abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="8201000000420000140003006272696467655f736c6176655f30000008000400d4000000600016805c00018010000200f9ffffff"], 0x9c}}, 0x0) kernel console output (not intermixed with test programs): .584509][T12818] ? alloc_pages_mpol+0x3cd/0x4a0 [ 320.584541][T12818] ? packet_set_ring+0x6f3/0x2120 [ 320.584562][T12818] vzalloc_noprof+0xb2/0xf0 [ 320.584591][T12818] ? packet_set_ring+0x6f3/0x2120 [ 320.584614][T12818] packet_set_ring+0x6f3/0x2120 [ 320.584661][T12818] ? __pfx_packet_set_ring+0x10/0x10 [ 320.584704][T12818] ? _copy_from_user+0x94/0xb0 [ 320.584736][T12818] packet_setsockopt+0xc5a/0x12c0 [ 320.584761][T12818] ? __pfx_packet_setsockopt+0x10/0x10 [ 320.584788][T12818] ? __lock_acquire+0xab9/0xd20 [ 320.584824][T12818] ? aa_sk_perm+0x81e/0x950 [ 320.584861][T12818] ? __pfx_aa_sk_perm+0x10/0x10 [ 320.584895][T12818] ? __fget_files+0x2a/0x420 [ 320.584923][T12818] ? aa_sock_opt_perm+0xff/0x1b0 [ 320.584947][T12818] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 320.584968][T12818] ? __pfx_packet_setsockopt+0x10/0x10 [ 320.584991][T12818] do_sock_setsockopt+0x17c/0x1b0 [ 320.585024][T12818] __x64_sys_setsockopt+0x13f/0x1b0 [ 320.585057][T12818] do_syscall_64+0xfa/0x3b0 [ 320.585081][T12818] ? lockdep_hardirqs_on+0x9c/0x150 [ 320.585104][T12818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.585126][T12818] ? clear_bhb_loop+0x60/0xb0 [ 320.585152][T12818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.585172][T12818] RIP: 0033:0x7f2ce1d8eec9 [ 320.585191][T12818] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 320.585210][T12818] RSP: 002b:00007f2ce2c20038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 320.585232][T12818] RAX: ffffffffffffffda RBX: 00007f2ce1fe5fa0 RCX: 00007f2ce1d8eec9 [ 320.585248][T12818] RDX: 000000000000000d RSI: 0000000000000107 RDI: 0000000000000003 [ 320.585261][T12818] RBP: 00007f2ce1e11f91 R08: 000000000000001c R09: 0000000000000000 [ 320.585274][T12818] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 320.585288][T12818] R13: 00007f2ce1fe6038 R14: 00007f2ce1fe5fa0 R15: 00007ffffbf45b28 [ 320.585323][T12818] [ 320.585782][T12818] Mem-Info: [ 320.729764][T12814] macsec2: entered promiscuous mode [ 320.738482][T12818] active_anon:4673 inactive_anon:0 isolated_anon:0 [ 320.738482][T12818] active_file:3336 inactive_file:39971 isolated_file:0 [ 320.738482][T12818] unevictable:768 dirty:201 writeback:0 [ 320.738482][T12818] slab_reclaimable:12134 slab_unreclaimable:266016 [ 320.738482][T12818] mapped:30480 shmem:1356 pagetables:1148 [ 320.738482][T12818] sec_pagetables:0 bounce:0 [ 320.738482][T12818] kernel_misc_reclaimable:0 [ 320.738482][T12818] free:1158865 free_pcp:17130 free_cma:0 [ 320.764757][T12814] ip6gretap0: entered promiscuous mode [ 320.777178][T12818] Node 0 active_anon:18792kB inactive_anon:0kB active_file:13344kB inactive_file:159684kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:121920kB dirty:804kB writeback:0kB shmem:3888kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13108kB pagetables:4444kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 320.972612][T12818] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 321.009750][T12818] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 321.041308][T12818] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 321.047763][T12818] Node 0 DMA32 free:738164kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:18892kB inactive_anon:0kB active_file:13344kB inactive_file:157856kB unevictable:1536kB writepending:828kB present:3129332kB managed:2559852kB mlocked:0kB bounce:0kB free_pcp:48136kB local_pcp:17260kB free_cma:0kB [ 321.081945][T12818] lowmem_reserve[]: 0 0 1 1 1 [ 321.087226][T12818] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 321.119387][T12818] lowmem_reserve[]: 0 0 0 0 0 [ 321.126564][T12818] Node 1 Normal free:3884420kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:18128kB local_pcp:6992kB free_cma:0kB [ 321.175706][T12818] lowmem_reserve[]: 0 0 0 0 0 [ 321.180653][T12818] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 321.194634][T12818] Node 0 DMA32: 1551*4kB (UM) 1132*8kB (UM) 429*16kB (UM) 472*32kB (UME) 129*64kB (UME) 42*128kB (UME) 47*256kB (UM) 22*512kB (UM) 15*1024kB (UME) 7*2048kB (UME) 155*4096kB (UM) = 738732kB [ 321.258253][T12818] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 321.286259][T12818] Node 1 Normal: 193*4kB (UE) 46*8kB (UME) 41*16kB (UME) 102*32kB (UME) 27*64kB (UM) 4*128kB (UM) 3*256kB (ME) 3*512kB (UM) 2*1024kB (ME) 1*2048kB (E) 945*4096kB (M) = 3884420kB [ 321.307096][T12833] __nla_validate_parse: 1 callbacks suppressed [ 321.307118][T12833] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1796'. [ 321.324325][T12818] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 321.345822][T12818] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 321.349023][T12833] netlink: 'syz.1.1796': attribute type 3 has an invalid length. [ 321.374030][T12818] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 321.381619][T12833] syz_tun: entered allmulticast mode [ 321.393953][T12818] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 321.408535][T12833] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 321.412630][T12818] 44660 total pagecache pages [ 321.440679][T12818] 0 pages in swap cache [ 321.466610][T12818] Free swap = 124996kB [ 321.470834][T12818] Total swap = 124996kB [ 321.492570][T12818] 2097051 pages RAM [ 321.509921][T12839] sit0: left promiscuous mode [ 321.512691][T12818] 0 pages HighMem/MovableOnly [ 321.535088][T12818] 424998 pages reserved [ 321.539293][T12818] 0 pages cma reserved [ 321.550225][T12839] 8021q: adding VLAN 0 to HW filter on device  [ 321.626380][T12844] netlink: 344 bytes leftover after parsing attributes in process `syz.4.1799'. [ 321.635781][T12839] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 321.696718][T12850] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1801'. [ 321.707526][T12846] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1800'. [ 321.742992][T12832] syz_tun: left allmulticast mode [ 321.816341][T12856] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1803'. [ 322.018597][T12866] macvtap1: entered promiscuous mode [ 322.026151][T12866] veth1_to_hsr: entered promiscuous mode [ 322.032200][T12866] macvtap1: entered allmulticast mode [ 322.039257][T12869] netlink: 'syz.1.1804': attribute type 13 has an invalid length. [ 322.048251][T12869] netlink: 'syz.1.1804': attribute type 17 has an invalid length. [ 322.153478][T12866] veth1_to_hsr: entered allmulticast mode [ 322.224045][T12869] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 322.441521][T12890] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1811'. [ 322.457453][T12890] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1811'. [ 322.480896][T12890] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1811'. [ 322.490867][T12890] macsec0: left allmulticast mode [ 322.497396][T12890] macsec0: left promiscuous mode [ 322.502945][T12890] bridge0: port 3(macsec0) entered disabled state [ 322.541538][T12890] bridge_slave_1: left promiscuous mode [ 322.568179][T12890] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.617883][T12890] bridge_slave_0: left allmulticast mode [ 322.642768][T12903] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1815'. [ 322.643887][T12890] bridge_slave_0: left promiscuous mode [ 322.697939][T12890] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.813148][T12903] bridge0: entered promiscuous mode [ 322.827386][T12903] macsec0: entered allmulticast mode [ 322.832911][T12903] bridge0: entered allmulticast mode [ 322.841067][T12903] bridge0: port 3(macsec0) entered blocking state [ 322.848807][T12903] bridge0: port 3(macsec0) entered disabled state [ 322.866670][T12903] bridge0: left allmulticast mode [ 322.872006][T12903] bridge0: left promiscuous mode [ 323.135415][T12924] syzkaller1: entered promiscuous mode [ 323.142986][T12924] syzkaller1: entered allmulticast mode [ 323.289252][T12937] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1825'. [ 323.322839][T12937] netlink: 'syz.3.1825': attribute type 16 has an invalid length. [ 323.406218][T12943] IPv6: NLM_F_REPLACE set, but no existing node found! [ 323.425442][T12943] netlink: 'syz.3.1825': attribute type 1 has an invalid length. [ 324.082972][T12960] netlink: 'syz.4.1831': attribute type 1 has an invalid length. [ 324.090962][T12960] netlink: 'syz.4.1831': attribute type 1 has an invalid length. [ 324.528268][T12973] IPVS: Unknown mcast interface: vcan0 [ 324.708489][T12976] sctp: [Deprecated]: syz.2.1838 (pid 12976) Use of int in max_burst socket option. [ 324.708489][T12976] Use struct sctp_assoc_value instead [ 324.835717][T12972] lo speed is unknown, defaulting to 1000 [ 325.260129][T12987] netlink: 'syz.3.1840': attribute type 4 has an invalid length. [ 325.801806][T12976] lo speed is unknown, defaulting to 1000 [ 326.341059][T13000] vti0: entered promiscuous mode [ 326.749478][T13017] __nla_validate_parse: 9 callbacks suppressed [ 326.749497][T13017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1846'. [ 326.785880][T13017] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1846'. [ 326.991126][T13014] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1846'. [ 327.189564][T13026] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1850'. [ 327.203806][T13025] netlink: 192 bytes leftover after parsing attributes in process `syz.1.1849'. [ 327.235088][T13026] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1850'. [ 327.581063][T13045] netlink: 'syz.0.1855': attribute type 9 has an invalid length. [ 327.901753][T13054] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1859'. [ 328.012192][T13061] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1860'. [ 328.144451][T13064] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1860'. [ 328.357769][T13041] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 328.575428][T13081] netlink: 348 bytes leftover after parsing attributes in process `syz.2.1865'. [ 329.266459][T13105] netlink: 'syz.1.1873': attribute type 15 has an invalid length. [ 329.472065][T13115] tipc: Enabled bearer , priority 0 [ 329.490619][T13115] syzkaller0: entered promiscuous mode [ 329.504468][T13115] syzkaller0: entered allmulticast mode [ 329.546360][T13115] tipc: Resetting bearer [ 329.564672][T13114] tipc: Resetting bearer [ 329.634468][T13114] tipc: Disabling bearer [ 329.859393][T13132] batadv_slave_0: entered promiscuous mode [ 330.176522][T13157] bridge0: port 3(erspan0) entered blocking state [ 330.184189][T13157] bridge0: port 3(erspan0) entered disabled state [ 330.195212][T13157] erspan0: entered allmulticast mode [ 330.212936][T13157] erspan0: entered promiscuous mode [ 330.298250][T13164] erspan0: left allmulticast mode [ 330.304147][T13164] erspan0: left promiscuous mode [ 330.311109][T13164] bridge0: port 3(erspan0) entered disabled state [ 330.350627][T13168] netlink: 'syz.2.1890': attribute type 66 has an invalid length. [ 330.911888][T13154] lo speed is unknown, defaulting to 1000 [ 330.955983][T13176] siw: device registration error -23 [ 331.196510][T13191] tipc: Enabled bearer , priority 0 [ 331.215073][T13187] syzkaller0: entered promiscuous mode [ 331.231075][T13187] syzkaller0: entered allmulticast mode [ 331.244287][T13187] netlink: 'syz.0.1896': attribute type 1 has an invalid length. [ 331.482673][T13187] 8021q: adding VLAN 0 to HW filter on device bond3 [ 331.561490][T13191] bond3: (slave veth9): Enslaving as an active interface with a down link [ 331.747565][T13185] tipc: Resetting bearer [ 331.836235][T13185] tipc: Disabling bearer [ 332.376171][T13220] __nla_validate_parse: 11 callbacks suppressed [ 332.376192][T13220] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1904'. [ 332.839829][T13233] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 332.878298][T13238] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 332.966591][T13235] batadv_slave_0: entered promiscuous mode [ 333.023224][T13243] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan1, syncid = 3, id = 0 [ 333.102260][T13245] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1914'. [ 333.154438][T13251] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1914'. [ 333.251820][T13255] netlink: 'syz.3.1915': attribute type 1 has an invalid length. [ 333.273054][T13255] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1915'. [ 333.309165][T13259] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1915'. [ 333.360923][T13255] netlink: 'syz.3.1915': attribute type 1 has an invalid length. [ 333.383358][T13264] netlink: 'syz.1.1916': attribute type 1 has an invalid length. [ 333.406389][T13264] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1916'. [ 333.415616][T13255] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1915'. [ 333.590729][T13264] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 333.829526][T13260] lo speed is unknown, defaulting to 1000 [ 334.036860][T13279] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1920'. [ 334.089551][T13279] batman_adv: batadv0: Removing interface: ip6gretap1 [ 334.362658][T13287] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1923'. [ 334.790549][T13294] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1925'. [ 334.805502][T13294] netlink: 'syz.0.1925': attribute type 1 has an invalid length. [ 335.327425][T13319] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.495709][T13319] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.606164][T13319] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.803743][T13319] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.048852][T13340] ip6gretap0: entered promiscuous mode [ 336.134780][ T9745] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.181239][ T9374] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.211591][ T9748] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.261066][ T9748] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.592430][T13356] netlink: 'syz.3.1940': attribute type 1 has an invalid length. [ 336.641819][T13356] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 337.228121][T13374] IPVS: Scheduler module ip_vs_sip not found [ 337.770864][T13162] Set syz1 is full, maxelem 65536 reached [ 337.880501][T13404] 8021q: adding VLAN 0 to HW filter on device bond0 [ 338.595409][T13441] netlink: 'syz.0.1965': attribute type 4 has an invalid length. [ 338.647742][T13442] netlink: 'syz.0.1965': attribute type 4 has an invalid length. [ 338.677926][T13443] netlink: 'syz.0.1965': attribute type 4 has an invalid length. [ 338.858098][T13445] netlink: 'syz.3.1966': attribute type 1 has an invalid length. [ 339.244016][T13435] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 339.250409][T13435] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 339.301172][T13456] __nla_validate_parse: 7 callbacks suppressed [ 339.301194][T13456] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1968'. [ 339.398234][T13435] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 339.408038][T13435] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 339.457150][T13435] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 339.463114][T13435] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 339.555442][T13435] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 339.561408][T13435] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 339.670873][T13460] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1969'. [ 339.704531][T13460] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1969'. [ 339.756788][T13462] netlink: 'syz.0.1971': attribute type 1 has an invalid length. [ 340.175306][T13469] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1973'. [ 340.994422][T13462] lo speed is unknown, defaulting to 1000 [ 341.494844][T13474] lo speed is unknown, defaulting to 1000 [ 341.550603][T13500] netlink: 14679 bytes leftover after parsing attributes in process `syz.4.1977'. [ 341.580090][T13497] netlink: 277 bytes leftover after parsing attributes in process `syz.1.1976'. [ 341.605511][T13501] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1977'. [ 341.636740][T13497] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1976'. [ 342.074653][T13516] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1979'. [ 342.094059][T13516] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1979'. [ 343.091575][T13559] netlink: 'syz.2.1992': attribute type 1 has an invalid length. [ 343.127008][T13559] 8021q: adding VLAN 0 to HW filter on device bond7 [ 343.562752][T13576] netlink: 'syz.0.1997': attribute type 4 has an invalid length. [ 343.696978][T13581] netlink: 'syz.0.1999': attribute type 21 has an invalid length. [ 343.823773][T13592] netlink: 'syz.0.2001': attribute type 16 has an invalid length. [ 343.832205][T13592] netlink: 'syz.0.2001': attribute type 3 has an invalid length. [ 345.295303][T13630] hsr0: entered allmulticast mode [ 345.304723][T13630] hsr_slave_0: entered allmulticast mode [ 345.310428][T13630] hsr_slave_1: entered allmulticast mode [ 345.440763][T13599] lo speed is unknown, defaulting to 1000 [ 345.546432][T13643] __nla_validate_parse: 8 callbacks suppressed [ 345.546451][T13643] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2014'. [ 345.735612][T13654] tipc: Enabled bearer , priority 0 [ 345.755664][T13646] syzkaller0: entered promiscuous mode [ 345.761194][T13646] syzkaller0: entered allmulticast mode [ 345.861966][T13658] siw: device registration error -23 [ 345.883658][T13646] tipc: Resetting bearer [ 345.898577][T13645] tipc: Resetting bearer [ 346.025493][T13645] tipc: Disabling bearer [ 346.303871][T13668] lo speed is unknown, defaulting to 1000 [ 346.976919][T13691] lo speed is unknown, defaulting to 1000 [ 347.371275][T13701] lo speed is unknown, defaulting to 1000 [ 347.543487][T13709] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2029'. [ 347.555862][T13709] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2029'. [ 347.720049][T13710] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2029'. [ 347.980544][T13712] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2030'. [ 348.432267][T13724] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2033'. [ 348.446388][T13733] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2035'. [ 348.466232][T13740] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2036'. [ 348.566054][T13746] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2038'. [ 348.658126][T13746] bridge_slave_1: left allmulticast mode [ 348.674942][T13746] bridge_slave_1: left promiscuous mode [ 348.691677][T13746] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.702832][T13746] bridge_slave_0: left allmulticast mode [ 348.718294][T13746] bridge_slave_0: left promiscuous mode [ 348.751669][T13746] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.886609][T13765] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2041'. [ 349.218162][T13777] netlink: 'syz.1.2047': attribute type 13 has an invalid length. [ 349.269864][T13784] sctp: [Deprecated]: syz.2.2048 (pid 13784) Use of int in max_burst socket option deprecated. [ 349.269864][T13784] Use struct sctp_assoc_value instead [ 349.295097][T13777] netlink: 'syz.1.2047': attribute type 17 has an invalid length. [ 349.416922][T13777] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 349.459798][T13779] lo speed is unknown, defaulting to 1000 [ 349.482179][T13787] syzkaller1: tun_chr_ioctl cmd 2148553947 [ 350.782449][T13815] lo speed is unknown, defaulting to 1000 [ 350.798033][T13818] tipc: Enabled bearer , priority 0 [ 350.823090][T13818] tipc: Disabling bearer [ 351.027587][T13831] __nla_validate_parse: 3 callbacks suppressed [ 351.027606][T13831] netlink: 14196 bytes leftover after parsing attributes in process `syz.2.2060'. [ 351.089873][T13837] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2062'. [ 351.120623][T13837] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2062'. [ 351.366420][T13844] lo speed is unknown, defaulting to 1000 [ 351.402104][T13842] tipc: Enabled bearer , priority 0 [ 351.442732][T13842] syzkaller0: entered promiscuous mode [ 351.475472][T13842] syzkaller0: entered allmulticast mode [ 351.655443][T13850] tipc: Resetting bearer [ 351.769454][T13850] tipc: Disabling bearer [ 351.792929][T13856] netlink: 348 bytes leftover after parsing attributes in process `syz.1.2066'. [ 351.807519][T13857] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2067'. [ 351.939952][T13865] sit0: entered promiscuous mode [ 351.960532][T13865] netlink: 'syz.3.2068': attribute type 1 has an invalid length. [ 351.976020][T13865] netlink: 1 bytes leftover after parsing attributes in process `syz.3.2068'. [ 352.277143][T13877] netlink: 'syz.2.2071': attribute type 1 has an invalid length. [ 352.381919][T13877] 8021q: adding VLAN 0 to HW filter on device bond8 [ 352.514600][T13881] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2071'. [ 352.548243][T13877] lo speed is unknown, defaulting to 1000 [ 353.315328][T13908] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2079'. [ 353.330269][T13908] netlink: 7 bytes leftover after parsing attributes in process `syz.1.2079'. [ 353.629173][T13922] netlink: 'syz.3.2082': attribute type 5 has an invalid length. [ 354.272936][T13942] lo speed is unknown, defaulting to 1000 [ 354.506985][T13950] lo speed is unknown, defaulting to 1000 [ 355.635673][T13994] delete_channel: no stack [ 355.650624][T13998] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2097'. [ 356.218151][T14029] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2103'. [ 356.244804][T14029] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2103'. [ 356.311788][T14029] 8021q: adding VLAN 0 to HW filter on device bond7 [ 356.631811][T14046] lo speed is unknown, defaulting to 1000 [ 356.698723][T14045] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2107'. [ 356.799715][T14053] syz.1.2108: vmalloc error: size 136314880, failed to allocated page array size 266240, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 356.820120][T14053] CPU: 0 UID: 0 PID: 14053 Comm: syz.1.2108 Not tainted syzkaller #0 PREEMPT(full) [ 356.820151][T14053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 356.820165][T14053] Call Trace: [ 356.820173][T14053] [ 356.820183][T14053] dump_stack_lvl+0x189/0x250 [ 356.820218][T14053] ? __pfx_dump_stack_lvl+0x10/0x10 [ 356.820243][T14053] ? __pfx__printk+0x10/0x10 [ 356.820273][T14053] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 356.820298][T14053] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 356.820334][T14053] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 356.820361][T14053] warn_alloc+0x214/0x310 [ 356.820401][T14053] ? __pfx_warn_alloc+0x10/0x10 [ 356.820444][T14053] ? __get_vm_area_node+0x28f/0x300 [ 356.820474][T14053] ? hash_netiface_create+0x358/0xfe0 [ 356.820511][T14053] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 356.820540][T14053] ? do_syscall_64+0xfa/0x3b0 [ 356.820599][T14053] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 356.820637][T14053] ? rcu_is_watching+0x15/0xb0 [ 356.820659][T14053] ? hash_netiface_create+0x358/0xfe0 [ 356.820690][T14053] ? hash_netiface_create+0x358/0xfe0 [ 356.820721][T14053] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 356.820752][T14053] ? hash_netiface_create+0x358/0xfe0 [ 356.820784][T14053] ? hash_netiface_create+0x2fe/0xfe0 [ 356.820821][T14053] hash_netiface_create+0x358/0xfe0 [ 356.820863][T14053] ? __nla_parse+0x40/0x60 [ 356.820885][T14053] ? __pfx_hash_netiface_create+0x10/0x10 [ 356.820920][T14053] ip_set_create+0xa94/0x1940 [ 356.820954][T14053] ? ip_set_create+0x4a2/0x1940 [ 356.821001][T14053] ? __pfx_ip_set_create+0x10/0x10 [ 356.821077][T14053] nfnetlink_rcv_msg+0xb4a/0x1130 [ 356.821101][T14053] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 356.821146][T14053] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 356.821226][T14053] netlink_rcv_skb+0x205/0x470 [ 356.821253][T14053] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 356.821277][T14053] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 356.821322][T14053] ? bpf_lsm_capable+0x9/0x20 [ 356.821350][T14053] ? security_capable+0x7e/0x2e0 [ 356.821392][T14053] nfnetlink_rcv+0x282/0x2590 [ 356.821417][T14053] ? __dev_queue_xmit+0x27b/0x3b50 [ 356.821449][T14053] ? __dev_queue_xmit+0x1d79/0x3b50 [ 356.821492][T14053] ? __dev_queue_xmit+0x27b/0x3b50 [ 356.821537][T14053] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 356.821558][T14053] ? __pfx___dev_queue_xmit+0x10/0x10 [ 356.821606][T14053] ? ref_tracker_free+0x63a/0x7d0 [ 356.821640][T14053] ? __asan_memcpy+0x40/0x70 [ 356.821663][T14053] ? __pfx_ref_tracker_free+0x10/0x10 [ 356.821715][T14053] ? skb_clone+0x246/0x3a0 [ 356.821749][T14053] ? __netlink_deliver_tap+0x807/0x850 [ 356.821774][T14053] ? netlink_deliver_tap+0x2e/0x1b0 [ 356.821808][T14053] ? netlink_deliver_tap+0x2e/0x1b0 [ 356.821843][T14053] netlink_unicast+0x82f/0x9e0 [ 356.821876][T14053] ? __pfx_netlink_unicast+0x10/0x10 [ 356.821901][T14053] ? netlink_sendmsg+0x642/0xb30 [ 356.821924][T14053] ? skb_put+0x11b/0x210 [ 356.821955][T14053] netlink_sendmsg+0x805/0xb30 [ 356.821991][T14053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 356.822022][T14053] ? aa_sock_msg_perm+0xf1/0x1d0 [ 356.822059][T14053] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 356.822081][T14053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 356.822108][T14053] __sock_sendmsg+0x21c/0x270 [ 356.822148][T14053] ____sys_sendmsg+0x505/0x830 [ 356.822183][T14053] ? __pfx_____sys_sendmsg+0x10/0x10 [ 356.822224][T14053] ? import_iovec+0x74/0xa0 [ 356.822256][T14053] ___sys_sendmsg+0x21f/0x2a0 [ 356.822289][T14053] ? __pfx____sys_sendmsg+0x10/0x10 [ 356.822366][T14053] ? __fget_files+0x2a/0x420 [ 356.822398][T14053] ? __fget_files+0x3a0/0x420 [ 356.822441][T14053] __x64_sys_sendmsg+0x19b/0x260 [ 356.822473][T14053] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 356.822512][T14053] ? rcu_is_watching+0x15/0xb0 [ 356.822538][T14053] ? do_syscall_64+0xbe/0x3b0 [ 356.822567][T14053] do_syscall_64+0xfa/0x3b0 [ 356.822589][T14053] ? lockdep_hardirqs_on+0x9c/0x150 [ 356.822613][T14053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.822635][T14053] ? clear_bhb_loop+0x60/0xb0 [ 356.822662][T14053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.822683][T14053] RIP: 0033:0x7f1e0798eec9 [ 356.822703][T14053] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 356.822722][T14053] RSP: 002b:00007f1e0889a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 356.822745][T14053] RAX: ffffffffffffffda RBX: 00007f1e07be5fa0 RCX: 00007f1e0798eec9 [ 356.822762][T14053] RDX: 0000000000004000 RSI: 0000200000000000 RDI: 0000000000000007 [ 356.822776][T14053] RBP: 00007f1e07a11f91 R08: 0000000000000000 R09: 0000000000000000 [ 356.822790][T14053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 356.822802][T14053] R13: 00007f1e07be6038 R14: 00007f1e07be5fa0 R15: 00007fff49f0ed28 [ 356.822839][T14053] [ 356.822847][T14053] Mem-Info: [ 357.345774][T14053] active_anon:7720 inactive_anon:0 isolated_anon:0 [ 357.345774][T14053] active_file:3336 inactive_file:39985 isolated_file:0 [ 357.345774][T14053] unevictable:768 dirty:216 writeback:0 [ 357.345774][T14053] slab_reclaimable:12381 slab_unreclaimable:265975 [ 357.345774][T14053] mapped:34359 shmem:4372 pagetables:1158 [ 357.345774][T14053] sec_pagetables:0 bounce:0 [ 357.345774][T14053] kernel_misc_reclaimable:0 [ 357.345774][T14053] free:1155964 free_pcp:12381 free_cma:0 [ 357.370236][T14068] lo speed is unknown, defaulting to 1000 [ 357.392868][T14053] Node 0 active_anon:30880kB inactive_anon:0kB active_file:13344kB inactive_file:159740kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:137436kB dirty:864kB writeback:0kB shmem:15952kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13416kB pagetables:4484kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 357.431079][T14053] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 357.502240][T14053] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 357.542610][T14053] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 357.548659][T14053] Node 0 DMA32 free:723524kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30832kB inactive_anon:0kB active_file:13344kB inactive_file:157912kB unevictable:1536kB writepending:864kB present:3129332kB managed:2559852kB mlocked:0kB bounce:0kB free_pcp:31988kB local_pcp:12092kB free_cma:0kB [ 357.583065][T14053] lowmem_reserve[]: 0 0 1 1 1 [ 357.603179][T14053] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 357.636606][T14053] lowmem_reserve[]: 0 0 0 0 0 [ 357.641389][T14053] Node 1 Normal free:3884700kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17832kB local_pcp:6984kB free_cma:0kB [ 357.673021][T14053] lowmem_reserve[]: 0 0 0 0 0 [ 357.679681][T14053] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 357.693152][T14053] Node 0 DMA32: 755*4kB (ME) 69*8kB (M) 49*16kB (M) 137*32kB (UM) 162*64kB (UME) 39*128kB (UM) 46*256kB (UME) 25*512kB (UME) 15*1024kB (UME) 10*2048kB (UM) 156*4096kB (UM) = 723492kB [ 357.711877][T14053] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 357.724274][T14053] Node 1 Normal: 191*4kB (UE) 46*8kB (UME) 41*16kB (UME) 109*32kB (UME) 28*64kB (UM) 4*128kB (UM) 3*256kB (ME) 3*512kB (UM) 2*1024kB (ME) 1*2048kB (E) 945*4096kB (M) = 3884700kB [ 357.742432][T14053] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 357.752180][T14053] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 357.762017][T14053] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 357.772800][T14053] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 357.782441][T14053] 46764 total pagecache pages [ 357.787339][T14053] 0 pages in swap cache [ 357.791528][T14053] Free swap = 124996kB [ 357.796153][T14053] Total swap = 124996kB [ 357.800345][T14053] 2097051 pages RAM [ 357.805247][T14053] 0 pages HighMem/MovableOnly [ 357.810104][T14053] 424998 pages reserved [ 357.814434][T14053] 0 pages cma reserved [ 358.385744][T14079] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 358.541081][T14098] tipc: Enabling of bearer rejected, already enabled [ 358.687909][T14106] lo speed is unknown, defaulting to 1000 [ 358.915534][T14116] netlink: 'syz.2.2120': attribute type 10 has an invalid length. [ 358.929577][T14116] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 359.161213][T14129] tipc: Enabled bearer , priority 0 [ 359.184069][T14128] syzkaller0: entered promiscuous mode [ 359.189579][T14128] syzkaller0: entered allmulticast mode [ 359.239554][T14131] vlan3: entered promiscuous mode [ 359.376505][T14139] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2126'. [ 359.403116][T14129] tipc: Resetting bearer [ 359.515839][T14129] tipc: Disabling bearer [ 359.583521][T14139] netlink: 'syz.3.2126': attribute type 1 has an invalid length. [ 359.601885][T14139] netlink: 5624 bytes leftover after parsing attributes in process `syz.3.2126'. [ 359.607217][T14148] Bluetooth: MGMT ver 1.23 [ 359.991677][T14171] IPv6: Can't replace route, no match found [ 360.048698][T14170] tipc: Enabled bearer , priority 0 [ 360.101285][T14162] syzkaller0: entered promiscuous mode [ 360.130557][T14162] syzkaller0: entered allmulticast mode [ 360.200796][T14162] tipc: Resetting bearer [ 360.249583][T14160] tipc: Resetting bearer [ 360.409048][T14160] tipc: Disabling bearer [ 360.575190][T14195] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2139'. [ 360.688786][T14200] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2140'. [ 360.802682][T14209] lo speed is unknown, defaulting to 1000 [ 360.809497][T14208] tipc: Can't bind to reserved service type 1 [ 360.816932][T14208] netlink: 'syz.2.2144': attribute type 39 has an invalid length. [ 360.872833][T14217] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2144'. [ 360.905473][T14218] netlink: 'syz.3.2146': attribute type 3 has an invalid length. [ 360.913651][T14217] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2144'. [ 360.913691][T14217] netlink: 'syz.2.2144': attribute type 5 has an invalid length. [ 360.913711][T14217] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2144'. [ 360.954139][T14217] vlan2: entered allmulticast mode [ 360.959333][T14217] bridge_slave_0: entered allmulticast mode [ 361.174932][T14221] netlink: 'syz.3.2147': attribute type 1 has an invalid length. [ 361.625798][T14238] netlink: 'syz.4.2150': attribute type 1 has an invalid length. [ 361.634397][T14238] __nla_validate_parse: 1 callbacks suppressed [ 361.634416][T14238] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2150'. [ 361.688035][T14238] netlink: 'syz.4.2150': attribute type 1 has an invalid length. [ 361.698812][T14238] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2150'. [ 361.799391][T14245] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2151'. [ 361.829849][T14245] nbd: must specify at least one socket [ 361.837564][T14246] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2152'. [ 362.110244][T14263] netlink: 'syz.3.2158': attribute type 1 has an invalid length. [ 362.149830][T14263] netlink: 'syz.3.2158': attribute type 2 has an invalid length. [ 362.888765][T14298] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2165'. [ 363.686385][T14343] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 363.734944][T14343] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2179'. [ 364.314391][T14363] netlink: 'syz.1.2184': attribute type 1 has an invalid length. [ 364.387665][T14363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2184'. [ 364.457304][T14370] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2185'. [ 364.646151][T14376] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2186'. [ 365.338754][T14406] netlink: 'syz.1.2194': attribute type 1 has an invalid length. [ 365.365464][T14410] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2195'. [ 365.427187][T14406] 8021q: adding VLAN 0 to HW filter on device bond0 [ 365.457822][T14408] lo speed is unknown, defaulting to 1000 [ 365.541152][T14412] vlan2: entered allmulticast mode [ 365.569286][T14412] veth1: entered allmulticast mode [ 365.622785][T14412] bond0: (slave vlan2): Enslaving as an active interface with a down link [ 365.709347][T14425] syzkaller1: entered promiscuous mode [ 365.736320][T14425] syzkaller1: entered allmulticast mode [ 365.810751][T14434] netlink: 'syz.3.2200': attribute type 1 has an invalid length. [ 365.896468][T14434] bond8: entered promiscuous mode [ 365.902080][T14434] 8021q: adding VLAN 0 to HW filter on device bond8 [ 366.305883][T14453] lo speed is unknown, defaulting to 1000 [ 366.339217][T14452] lo speed is unknown, defaulting to 1000 [ 366.371577][T14455] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 366.383559][T14462] lo speed is unknown, defaulting to 1000 [ 366.389784][T14455] netlink: 'syz.3.2206': attribute type 1 has an invalid length. [ 366.436021][T14455] bond9: entered promiscuous mode [ 366.441922][T14455] 8021q: adding VLAN 0 to HW filter on device bond9 [ 366.505895][T14466] bond9: (slave bridge6): making interface the new active one [ 366.514200][T14466] bridge6: entered promiscuous mode [ 366.522302][T14466] bond9: (slave bridge6): Enslaving as an active interface with an up link [ 366.690460][T14483] __nla_validate_parse: 3 callbacks suppressed [ 366.690484][T14483] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2213'. [ 367.052012][T14473] lo speed is unknown, defaulting to 1000 [ 367.306358][T14519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2220'. [ 367.545153][T14532] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2221'. [ 367.688632][T14536] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2225'. [ 367.809323][T14545] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 368.152702][T14569] syzkaller1: entered promiscuous mode [ 368.174701][T14569] syzkaller1: entered allmulticast mode [ 368.327602][T14574] pimreg3: entered allmulticast mode [ 368.396521][T14586] sctp: [Deprecated]: syz.1.2239 (pid 14586) Use of int in max_burst socket option deprecated. [ 368.396521][T14586] Use struct sctp_assoc_value instead [ 368.492452][T14590] pim6reg1: entered promiscuous mode [ 368.507339][T14590] pim6reg1: entered allmulticast mode [ 368.543614][T14573] lo speed is unknown, defaulting to 1000 [ 368.609920][T14595] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2241'. [ 368.918583][T14616] bond0: (slave team0): Releasing backup interface [ 368.931812][T14614] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2244'. [ 368.947342][T14616] bond0: (slave dummy0): Releasing backup interface [ 368.961117][T14616] bond0: (slave batadv0): Releasing backup interface [ 368.977761][T14616] bond0: (slave bond_slave_0): Releasing backup interface [ 368.998379][T14616] bond0: (slave bond_slave_1): Releasing backup interface [ 369.012291][T14616] team0: Port device team_slave_0 removed [ 369.020710][T14616] team0: Port device team_slave_1 removed [ 369.027293][T14616] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 369.038953][T14616] bond1: (slave bridge1): Releasing active interface [ 369.058191][T14616] team0: Port device bridge3 removed [ 369.702634][T14656] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2255'. [ 369.769005][T14660] wg1: entered promiscuous mode [ 369.775357][T14660] wg1: entered allmulticast mode [ 369.972215][T14664] tipc: Enabled bearer , priority 0 [ 370.036600][T14664] syzkaller0: entered promiscuous mode [ 370.042347][T14664] syzkaller0: entered allmulticast mode [ 370.049656][T14664] tipc: Resetting bearer [ 370.078539][T14662] tipc: Resetting bearer [ 371.967936][T14662] tipc: Disabling bearer [ 371.978698][T14678] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 372.179509][T14702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2265'. [ 372.210534][T14707] bridge0: entered allmulticast mode [ 372.230440][T14707] pim6reg: entered allmulticast mode [ 372.272057][T14713] tipc: Enabling of bearer rejected, already enabled [ 372.317850][T14718] netlink: 'syz.4.2270': attribute type 13 has an invalid length. [ 372.490734][T14726] xt_l2tp: v2 sid > 0xffff: 1114112 [ 372.555861][T14728] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2272'. [ 372.871286][T14739] pimreg3: entered allmulticast mode [ 373.439724][T14770] netlink: 664 bytes leftover after parsing attributes in process `syz.4.2285'. [ 373.451922][T14770] netlink: 664 bytes leftover after parsing attributes in process `syz.4.2285'. [ 373.614142][T14783] ip_vti0: entered promiscuous mode [ 373.644474][T14778] netlink: 'syz.2.2288': attribute type 11 has an invalid length. [ 373.645347][T14783] netlink: 'syz.1.2289': attribute type 2 has an invalid length. [ 373.813055][T14783] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2289'. [ 373.872759][T14783] netlink: 'syz.1.2289': attribute type 17 has an invalid length. [ 373.887843][T14784] lo speed is unknown, defaulting to 1000 [ 373.916783][T14783] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 374.241264][T14804] netlink: 'syz.2.2294': attribute type 5 has an invalid length. [ 374.319417][T14812] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2292'. [ 374.329627][T14804] batman_adv: batadv0: Adding interface: vxlan0 [ 374.357530][T14804] batman_adv: batadv0: The MTU of interface vxlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 374.386520][T14804] batman_adv: batadv0: Interface activated: vxlan0 [ 374.399607][T14799] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2293'. [ 374.424518][T14807] lo speed is unknown, defaulting to 1000 [ 374.430667][ T9747] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.455088][ T9747] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.498683][T14803] lo speed is unknown, defaulting to 1000 [ 374.616998][ T9747] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.632797][ T9747] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.689817][T14810] lo speed is unknown, defaulting to 1000 [ 375.042135][T14815] lo speed is unknown, defaulting to 1000 [ 375.201426][T14830] sctp: [Deprecated]: syz.1.2300 (pid 14830) Use of int in max_burst socket option. [ 375.201426][T14830] Use struct sctp_assoc_value instead [ 375.228000][T14832] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2301'. [ 375.449880][T14843] netlink: 'syz.1.2303': attribute type 1 has an invalid length. [ 375.467065][T14837] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 375.575271][T14852] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2303'. [ 375.631548][T14843] bond2: entered promiscuous mode [ 375.681443][T14843] 8021q: adding VLAN 0 to HW filter on device bond2 [ 375.868565][T14860] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2307'. [ 375.928060][T14857] lo speed is unknown, defaulting to 1000 [ 376.386640][T14881] lo speed is unknown, defaulting to 1000 [ 376.533821][T14889] netlink: 'syz.2.2312': attribute type 18 has an invalid length. [ 376.551983][T14891] netlink: del zone limit has 8 unknown bytes [ 376.560463][T14889] netlink: 'syz.2.2312': attribute type 18 has an invalid length. [ 376.890385][T14904] vlan3: entered allmulticast mode [ 376.912606][T14904] bridge_slave_0: entered allmulticast mode [ 377.152440][T14897] lo speed is unknown, defaulting to 1000 [ 377.330304][T14908] lo speed is unknown, defaulting to 1000 [ 377.610846][T14930] IPv6: sit2: Disabled Multicast RS [ 377.646956][T14930] sit2: entered allmulticast mode [ 378.080489][T14945] lo speed is unknown, defaulting to 1000 [ 378.580943][T14968] __nla_validate_parse: 2 callbacks suppressed [ 378.580966][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.610793][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.621173][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.630910][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.642236][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.659532][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.679713][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.718627][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.823373][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 378.852884][T14968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 379.054101][T14979] siw: device registration error -23 [ 379.133163][T14979] netlink: 'syz.2.2338': attribute type 1 has an invalid length. [ 379.220748][T14985] lo speed is unknown, defaulting to 1000 [ 379.332397][T14988] syzkaller1: entered promiscuous mode [ 379.338939][T14988] syzkaller1: entered allmulticast mode [ 380.065100][T15005] tunl0: Caught tx_queue_len zero misconfig [ 380.072219][T15021] netlink: 'syz.1.2347': attribute type 7 has an invalid length. [ 380.087003][T15021] netlink: 'syz.1.2347': attribute type 8 has an invalid length. [ 380.096396][T15005] sch_fq: defrate 4294967293 ignored. [ 380.136906][T15022] netlink: 'syz.1.2347': attribute type 7 has an invalid length. [ 380.175060][T15022] netlink: 'syz.1.2347': attribute type 8 has an invalid length. [ 380.238325][T15022] delete_channel: no stack [ 380.549767][T15037] bridge5: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 381.250956][T15077] netlink: 'syz.4.2363': attribute type 1 has an invalid length. [ 381.465857][T15077] 8021q: adding VLAN 0 to HW filter on device bond3 [ 381.938441][T15120] tipc: Enabling of bearer rejected, failed to enable media [ 381.980226][T15120] tipc: Enabling of bearer rejected, failed to enable media [ 382.019502][T15126] netlink: 'syz.0.2377': attribute type 11 has an invalid length. [ 382.689581][T15169] lo speed is unknown, defaulting to 1000 [ 382.962774][T15180] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 383.135962][T15192] netlink: 'syz.2.2395': attribute type 30 has an invalid length. [ 383.181540][T15192] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 383.344198][T15210] openvswitch: netlink: Missing key (keys=40, expected=100) [ 383.477731][T15215] syzkaller1: entered promiscuous mode [ 383.483420][T15215] syzkaller1: entered allmulticast mode [ 383.501272][T15213] lo speed is unknown, defaulting to 1000 [ 383.736792][T15213] pimreg: entered allmulticast mode [ 383.753434][T15213] pimreg: left allmulticast mode [ 383.884756][T15228] __nla_validate_parse: 161 callbacks suppressed [ 383.884778][T15228] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2405'. [ 384.312060][T15247] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2409'. [ 384.420132][T15249] lo speed is unknown, defaulting to 1000 [ 384.471439][T15254] netlink: 'syz.4.2413': attribute type 12 has an invalid length. [ 384.517500][T15256] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2414'. [ 384.562124][T15256] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2414'. [ 384.572698][T15254] syzkaller1: entered promiscuous mode [ 384.578553][T15254] syzkaller1: entered allmulticast mode [ 384.592505][T15251] netlink: 'syz.0.2412': attribute type 9 has an invalid length. [ 384.795574][T15261] ip_vti0: left promiscuous mode [ 384.802492][T15261] ip_vti0: entered allmulticast mode [ 384.863839][T15263] lo speed is unknown, defaulting to 1000 [ 384.887719][T15252] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2411'. [ 384.985146][T15272] netlink: 'syz.4.2418': attribute type 21 has an invalid length. [ 384.988980][T15273] lo speed is unknown, defaulting to 1000 [ 385.312032][T15272] lo: Caught tx_queue_len zero misconfig [ 385.422063][T15292] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2419'. [ 385.488839][T15286] netlink: 'syz.0.2419': attribute type 5 has an invalid length. [ 386.020638][T15324] Can't find ip_set type hash:ip,por[ [ 386.025171][T15330] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2428'. [ 386.088368][T15330] vlan3: entered allmulticast mode [ 386.106602][T15330] bridge_slave_0: entered allmulticast mode [ 386.506793][T15335] lo speed is unknown, defaulting to 1000 [ 386.870758][T15342] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2429'. [ 387.327730][T15387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2442'. [ 387.346501][T15385] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2445'. [ 387.832136][T15407] netlink: 'syz.1.2451': attribute type 1 has an invalid length. [ 387.842153][T15407] netlink: 'syz.1.2451': attribute type 2 has an invalid length. [ 387.850929][T15407] netlink: 'syz.1.2451': attribute type 1 has an invalid length. [ 388.049444][T15415] netlink: 'syz.3.2452': attribute type 2 has an invalid length. [ 388.098532][T15415] openvswitch: netlink: Missing key (keys=40, expected=100) [ 388.106629][T15423] openvswitch: netlink: Missing key (keys=40, expected=100) [ 388.321959][T15430] netlink: 'syz.1.2455': attribute type 4 has an invalid length. [ 388.645366][T15444] lo speed is unknown, defaulting to 1000 [ 388.691027][T15446] lo speed is unknown, defaulting to 1000 [ 389.061181][T15461] syzkaller1: entered promiscuous mode [ 389.080728][T15461] syzkaller1: entered allmulticast mode [ 389.531941][T15488] netlink: 'syz.0.2471': attribute type 10 has an invalid length. [ 389.585597][T15488] __nla_validate_parse: 4 callbacks suppressed [ 389.585621][T15488] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2471'. [ 389.627329][T15488] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 389.678063][T15493] rdma_rxe: rxe_newlink: failed to add lo [ 390.816384][T15554] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2485'. [ 390.933434][T15554] lo speed is unknown, defaulting to 1000 [ 390.980041][T15541] tipc: Enabled bearer , priority 0 [ 391.082052][T15560] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.100895][T15541] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 391.115654][T15541] tipc: Resetting bearer [ 391.172867][T15560] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.255588][T15560] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.336873][T15578] netlink: 'syz.0.2489': attribute type 6 has an invalid length. [ 391.468725][T15533] tipc: Disabling bearer [ 391.497654][T15560] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.530489][T15582] tipc: Enabled bearer , priority 0 [ 391.550225][T15582] syzkaller0: entered promiscuous mode [ 391.556877][T15582] syzkaller0: entered allmulticast mode [ 391.697140][T15585] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2491'. [ 391.716960][T15589] netlink: 'syz.1.2493': attribute type 1 has an invalid length. [ 391.716993][ T9745] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 391.760670][ T9749] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 391.834220][ T9749] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 391.880492][T15582] tipc: Resetting bearer [ 391.897425][ T9749] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 391.932269][T15564] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 391.990753][T15580] tipc: Resetting bearer [ 392.194674][T15580] tipc: Disabling bearer [ 392.220245][T15564] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.340412][T15564] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.460821][T15610] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2499'. [ 392.476434][T15564] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.596285][T15598] lo speed is unknown, defaulting to 1000 [ 392.629652][T15614] vlan3: entered allmulticast mode [ 392.707684][T15614] bridge_slave_0: entered allmulticast mode [ 392.819690][T15620] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2503'. [ 393.043530][ T9749] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.065950][ T9749] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.087536][T15631] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2507'. [ 393.118576][T15631] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2507'. [ 393.154747][ T9749] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.156576][T15631] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2507'. [ 393.206385][ T9749] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.258630][T15638] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2508'. [ 393.312980][T15638] vlan3: entered promiscuous mode [ 393.335139][T15638] bond0: entered promiscuous mode [ 393.553529][T15652] netlink: 'syz.4.2512': attribute type 13 has an invalid length. [ 393.566935][T15652] netlink: 'syz.4.2512': attribute type 17 has an invalid length. [ 393.807569][T15652] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 394.100255][T15682] lo speed is unknown, defaulting to 1000 [ 394.496045][T15693] lo speed is unknown, defaulting to 1000 [ 394.526400][T15699] siw: device registration error -23 [ 395.096825][T15707] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 395.171492][T15717] netlink: 'syz.2.2524': attribute type 21 has an invalid length. [ 395.198574][T15717] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2524'. [ 395.363698][T15723] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2525'. [ 395.391929][T15710] lo speed is unknown, defaulting to 1000 [ 395.411617][T15717] netlink: 'syz.2.2524': attribute type 4 has an invalid length. [ 395.426277][T15717] netlink: 'syz.2.2524': attribute type 5 has an invalid length. [ 395.436885][T15717] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2524'. [ 396.076294][T15750] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2530'. [ 396.276695][T15763] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2535'. [ 396.470184][T15769] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2537'. [ 396.485520][T15771] netlink: 'syz.0.2538': attribute type 4 has an invalid length. [ 396.518834][T15771] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2538'. [ 396.598258][T15771] .`: renamed from bond0 (while UP) [ 396.995527][T15782] lo speed is unknown, defaulting to 1000 [ 397.019240][T15790] netlink: 6 bytes leftover after parsing attributes in process `syz.3.2540'. [ 397.065111][T15792] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2541'. [ 397.079996][T15792] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2541'. [ 397.114014][T15790] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 397.152296][T15792] netlink: 'syz.2.2541': attribute type 12 has an invalid length. [ 397.198323][T15792] netlink: 'syz.2.2541': attribute type 14 has an invalid length. [ 399.341213][T15889] lo speed is unknown, defaulting to 1000 [ 400.385171][T15933] __nla_validate_parse: 10 callbacks suppressed [ 400.385194][T15933] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2578'. [ 400.438169][T15933] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2578'. [ 400.460519][T15933] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2578'. [ 400.785103][T15952] netlink: 'syz.3.2586': attribute type 3 has an invalid length. [ 400.794538][T15952] netlink: 'syz.3.2586': attribute type 1 has an invalid length. [ 400.802318][T15952] netlink: 192 bytes leftover after parsing attributes in process `syz.3.2586'. [ 400.828489][T15952] NCSI netlink: No device for ifindex 0 [ 400.833075][T15954] lo speed is unknown, defaulting to 1000 [ 400.961471][T15960] lo speed is unknown, defaulting to 1000 [ 401.075030][T15964] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2588'. [ 401.372423][T15978] netlink: 788 bytes leftover after parsing attributes in process `syz.4.2593'. [ 401.415347][T15971] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2590'. [ 401.487745][T15971] 8021q: VLANs not supported on nlmon0 [ 401.567936][T15989] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2592'. [ 401.604894][T15987] lo speed is unknown, defaulting to 1000 [ 401.991435][T15996] lo speed is unknown, defaulting to 1000 [ 402.201857][T15986] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 402.347013][T16012] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2599'. [ 402.492387][T16016] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2599'. [ 402.501775][T16012] macvtap1: entered promiscuous mode [ 402.501805][T16012] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 402.960586][T16015] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 403.984882][T16085] veth11: entered promiscuous mode [ 404.596730][T16107] pimreg3: entered allmulticast mode [ 404.648234][T16110] nbd: must specify a size in bytes for the device [ 404.656740][T16109] nbd: must specify a size in bytes for the device [ 405.139866][T16137] netlink: 'syz.3.2632': attribute type 5 has an invalid length. [ 405.164721][T16143] netlink: 'syz.3.2632': attribute type 5 has an invalid length. [ 405.395838][T16155] __nla_validate_parse: 17 callbacks suppressed [ 405.395859][T16155] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2637'. [ 405.432951][T16159] netlink: 240 bytes leftover after parsing attributes in process `syz.3.2635'. [ 405.642019][T16167] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2639'. [ 405.674520][T16167] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2639'. [ 405.727182][T16167] netlink: 5 bytes leftover after parsing attributes in process `syz.3.2639'. [ 405.896536][T16173] lo speed is unknown, defaulting to 1000 [ 405.948983][T16185] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2643'. [ 406.032555][T16185] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2643'. [ 406.090603][T16189] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551607) [ 406.101878][T16189] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 406.151366][T16193] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 406.182425][T16194] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 406.463205][T16216] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2654'. [ 406.477708][T16211] netlink: 'syz.1.2651': attribute type 29 has an invalid length. [ 406.487335][T16211] netlink: 'syz.1.2651': attribute type 29 has an invalid length. [ 406.496658][T16211] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2651'. [ 406.506716][T16216] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 406.544041][T16224] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2649'. [ 406.704884][T16236] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 406.712168][T16236] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 406.776217][T16243] netlink: 'syz.4.2655': attribute type 1 has an invalid length. [ 406.905265][T16245] netlink: 'syz.3.2660': attribute type 22 has an invalid length. [ 406.950397][T16250] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 406.988576][T16252] netlink: 'syz.0.2661': attribute type 6 has an invalid length. [ 407.258791][T16256] lo speed is unknown, defaulting to 1000 [ 407.476698][T16285] netlink: 'syz.1.2670': attribute type 2 has an invalid length. [ 407.819441][T16294] netlink: 'syz.0.2672': attribute type 1 has an invalid length. [ 407.947827][T16297] veth1_to_batadv: entered promiscuous mode [ 408.216647][T16297] veth1_to_batadv: left promiscuous mode [ 408.224782][T16302] netlink: 'syz.2.2674': attribute type 9 has an invalid length. [ 408.257761][T16299] bond0: (slave gretap2): making interface the new active one [ 408.269398][T16299] bond0: (slave gretap2): Enslaving as an active interface with an up link [ 408.398484][T16308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 408.412620][T16308] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 408.445437][T16306] lo speed is unknown, defaulting to 1000 [ 408.756096][T16328] netlink: 'syz.0.2680': attribute type 10 has an invalid length. [ 408.830787][T16328] .`: (slave syz_tun): Enslaving as an active interface with an up link [ 409.686606][T16362] lo speed is unknown, defaulting to 1000 [ 409.784489][T16364] lo speed is unknown, defaulting to 1000 [ 410.153949][T16380] lo speed is unknown, defaulting to 1000 [ 410.185446][T16389] netlink: 'syz.4.2697': attribute type 1 has an invalid length. [ 410.209856][T16388] C: renamed from team_slave_0 [ 410.222304][T16388] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 410.404881][T16399] __nla_validate_parse: 11 callbacks suppressed [ 410.404901][T16399] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2699'. [ 410.498057][T16404] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2699'. [ 410.558508][T16399] 8021q: adding VLAN 0 to HW filter on device bond10 [ 410.609385][T16404] macsec1: entered promiscuous mode [ 410.616602][T16404] bond10: entered promiscuous mode [ 410.638353][T16404] macsec1: entered allmulticast mode [ 410.651802][T16404] bond10: entered allmulticast mode [ 410.676298][T16404] bond10: left allmulticast mode [ 410.687286][T16404] bond10: left promiscuous mode [ 411.129613][T16422] lo speed is unknown, defaulting to 1000 [ 411.231787][T16426] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2706'. [ 411.667138][T16447] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2712'. [ 411.914920][T16458] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2714'. [ 411.938672][T16458] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2714'. [ 412.064695][T16463] validate_nla: 3 callbacks suppressed [ 412.064715][T16463] netlink: 'syz.1.2716': attribute type 1 has an invalid length. [ 412.135625][T16463] netlink: 228 bytes leftover after parsing attributes in process `syz.1.2716'. [ 412.228637][T16467] erspan0: entered promiscuous mode [ 412.237675][T16467] erspan0: left promiscuous mode [ 412.576940][T16482] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2722'. [ 412.793347][T16485] ip_vti0: left allmulticast mode [ 412.898811][T16496] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2724'. [ 412.981227][T16485] bridge_slave_1: left allmulticast mode [ 413.003829][T16485] ip6gretap2: left promiscuous mode [ 413.019309][T16485] ip6gretap2: left allmulticast mode [ 413.034500][T16485] macsec2: left promiscuous mode [ 413.100844][T16485] vlan2: left allmulticast mode [ 413.106172][T16485] veth1: left allmulticast mode [ 413.115166][T16485] bond2: left promiscuous mode [ 413.364768][T16511] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2730'. [ 413.411567][T16515] netlink: 'syz.1.2731': attribute type 13 has an invalid length. [ 413.429590][T16515] netlink: 'syz.1.2731': attribute type 17 has an invalid length. [ 413.579282][T16515] ip6gretap0: left promiscuous mode [ 413.599083][T16515] 8021q: adding VLAN 0 to HW filter on device  [ 413.623878][T16515] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 413.724192][T16539] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 413.761142][T16546] netlink: 'syz.0.2738': attribute type 1 has an invalid length. [ 413.857994][T16546] 8021q: adding VLAN 0 to HW filter on device bond5 [ 413.881110][T16549] netlink: 'syz.1.2739': attribute type 4 has an invalid length. [ 414.090088][T16550] veth13: entered promiscuous mode [ 414.111611][T16550] bond5: (slave veth13): Enslaving as an active interface with an up link [ 415.031557][T16618] netlink: 'syz.4.2755': attribute type 6 has an invalid length. [ 415.057435][T16618] netlink: 'syz.4.2755': attribute type 6 has an invalid length. [ 415.245755][T16629] syzkaller1: entered promiscuous mode [ 415.258571][T16629] syzkaller1: entered allmulticast mode [ 415.528486][T16643] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 415.642722][T16653] __nla_validate_parse: 6 callbacks suppressed [ 415.642744][T16653] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2763'. [ 415.821874][T16658] netlink: 284 bytes leftover after parsing attributes in process `syz.2.2764'. [ 415.889106][T16662] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2766'. [ 416.147159][T16674] macsec0: entered promiscuous mode [ 416.161331][T16674] macsec0: left promiscuous mode [ 416.185816][T16679] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2771'. [ 416.215633][T16679] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2771'. [ 416.261106][T16675] netlink: 'syz.0.2768': attribute type 1 has an invalid length. [ 416.270003][T16675] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 416.461318][T16689] vlan3: entered allmulticast mode [ 416.526719][T16689] bridge_slave_0: entered allmulticast mode [ 416.656197][T16692] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2772'. [ 417.119090][T16720] tipc: New replicast peer: 255.255.255.255 [ 417.153415][T16720] tipc: Enabled bearer , priority 10 [ 417.296894][T16727] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2780'. [ 417.314703][T16727] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2780'. [ 417.753019][T16741] netlink: 19 bytes leftover after parsing attributes in process `syz.2.2783'. [ 417.830498][T16745] geneve5: entered promiscuous mode [ 417.857435][ T1112] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.888540][ T1112] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.904085][ T1112] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.924121][ T1112] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.986791][T16751] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2788'. [ 417.997101][T16754] sctp: [Deprecated]: syz.3.2786 (pid 16754) Use of int in maxseg socket option. [ 417.997101][T16754] Use struct sctp_assoc_value instead [ 418.656221][T16770] lo speed is unknown, defaulting to 1000 [ 418.936894][T16789] netlink: 'syz.4.2800': attribute type 1 has an invalid length. [ 419.830535][T16822] lo speed is unknown, defaulting to 1000 [ 420.578683][T16836] lo speed is unknown, defaulting to 1000 [ 421.171478][T16851] __nla_validate_parse: 4 callbacks suppressed [ 421.171503][T16851] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2816'. [ 421.486318][T16854] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2817'. [ 421.558738][T16854] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2817'. [ 421.725264][T16861] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2820'. [ 421.810011][T16861] IPVS: Unknown mcast interface: veth0_to_bond [ 423.334719][T16900] batman_adv: batadv0: Adding interface: macvtap1 [ 423.352015][T16900] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 423.412694][T16900] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 423.666160][T16910] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2835'. [ 424.485309][T16931] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2845'. [ 424.528043][T16931] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2845'. [ 424.561013][T16931] netlink: 'syz.2.2845': attribute type 15 has an invalid length. [ 425.116903][T16947] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2852'. [ 425.144992][T16947] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2852'. [ 425.170459][T16947] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2852'. [ 425.634665][ T30] audit: type=1107 audit(1759197368.811:4): pid=16973 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 425.816605][T16989] netlink: 'syz.2.2862': attribute type 6 has an invalid length. [ 425.983664][T16995] netlink: 'syz.1.2867': attribute type 39 has an invalid length. [ 426.142972][T17000] 8021q: VLANs not supported on ipvlan1 [ 426.192401][T17000] macsec1: entered promiscuous mode [ 426.256669][T17000] macsec1: entered allmulticast mode [ 426.378523][T17014] __nla_validate_parse: 6 callbacks suppressed [ 426.378545][T17014] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2874'. [ 426.409119][T17018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2876'. [ 426.628800][T17029] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2879'. [ 426.638745][T17029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2879'. [ 426.726523][T17034] ip6gretap1: entered allmulticast mode [ 426.837449][T17042] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2885'. [ 426.865257][T17046] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2885'. [ 426.975046][T17051] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2883'. [ 427.009507][T17050] syz_tun: entered allmulticast mode [ 427.051849][T17050] dvmrp8: entered allmulticast mode [ 427.190876][T17055] lo speed is unknown, defaulting to 1000 [ 427.306506][T17050] lo speed is unknown, defaulting to 1000 [ 427.473993][T17070] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2892'. [ 427.749692][T17076] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2893'. [ 427.786107][T17076] bond0: entered promiscuous mode [ 427.815424][T17076] gretap2: entered promiscuous mode [ 427.839659][T17078] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2893'. [ 427.851287][ T5867] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 427.864257][ T5867] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 427.868803][T17076] bond0: left promiscuous mode [ 427.877225][T17076] gretap2: left promiscuous mode [ 427.881748][ T5867] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 427.898714][ T5867] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 427.907495][ T5867] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 427.935817][T17078] bond0: entered promiscuous mode [ 427.941265][T17078] gretap2: entered promiscuous mode [ 427.949387][T17078] bond0: left promiscuous mode [ 427.957219][T17078] gretap2: left promiscuous mode [ 427.970386][T17049] syz_tun: left allmulticast mode [ 427.977072][T17049] dvmrp8: left allmulticast mode [ 428.044415][T17079] lo speed is unknown, defaulting to 1000 [ 428.946501][T17079] chnl_net:caif_netlink_parms(): no params data found [ 428.978958][T17110] netlink: 'syz.0.2903': attribute type 13 has an invalid length. [ 429.076147][T17110] netlink: 'syz.0.2903': attribute type 13 has an invalid length. [ 429.165615][ T13] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.178193][ T13] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.265235][ T13] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.367100][ T13] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.440207][T17149] FAULT_INJECTION: forcing a failure. [ 429.440207][T17149] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 429.453676][T17149] CPU: 1 UID: 0 PID: 17149 Comm: syz.0.2912 Not tainted syzkaller #0 PREEMPT(full) [ 429.453706][T17149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 429.453724][T17149] Call Trace: [ 429.453735][T17149] [ 429.453744][T17149] dump_stack_lvl+0x189/0x250 [ 429.453773][T17149] ? __pfx____ratelimit+0x10/0x10 [ 429.453798][T17149] ? __pfx_dump_stack_lvl+0x10/0x10 [ 429.453822][T17149] ? __pfx__printk+0x10/0x10 [ 429.453850][T17149] ? __might_fault+0xb0/0x130 [ 429.453889][T17149] should_fail_ex+0x414/0x560 [ 429.453923][T17149] _copy_from_user+0x2d/0xb0 [ 429.453951][T17149] ___sys_sendmsg+0x158/0x2a0 [ 429.453982][T17149] ? __pfx____sys_sendmsg+0x10/0x10 [ 429.454047][T17149] ? __fget_files+0x2a/0x420 [ 429.454077][T17149] ? __fget_files+0x3a0/0x420 [ 429.454119][T17149] __x64_sys_sendmsg+0x19b/0x260 [ 429.454150][T17149] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 429.454189][T17149] ? __pfx_ksys_write+0x10/0x10 [ 429.454212][T17149] ? rcu_is_watching+0x15/0xb0 [ 429.454238][T17149] ? do_syscall_64+0xbe/0x3b0 [ 429.454267][T17149] do_syscall_64+0xfa/0x3b0 [ 429.454289][T17149] ? lockdep_hardirqs_on+0x9c/0x150 [ 429.454312][T17149] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.454333][T17149] ? clear_bhb_loop+0x60/0xb0 [ 429.454359][T17149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.454379][T17149] RIP: 0033:0x7f3f47d8eec9 [ 429.454398][T17149] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 429.454417][T17149] RSP: 002b:00007f3f48c3d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 429.454439][T17149] RAX: ffffffffffffffda RBX: 00007f3f47fe5fa0 RCX: 00007f3f47d8eec9 [ 429.454455][T17149] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 429.454476][T17149] RBP: 00007f3f48c3d090 R08: 0000000000000000 R09: 0000000000000000 [ 429.454489][T17149] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 429.454502][T17149] R13: 00007f3f47fe6038 R14: 00007f3f47fe5fa0 R15: 00007ffd21a7c498 [ 429.454537][T17149] [ 429.455873][T17144] tipc: Enabled bearer , priority 0 [ 429.823440][T17137] syzkaller0: entered promiscuous mode [ 429.829096][T17137] syzkaller0: entered allmulticast mode [ 429.845873][T17137] tipc: Resetting bearer [ 429.858886][T17079] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.867575][T17079] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.886245][T17079] bridge_slave_0: entered allmulticast mode [ 429.905284][T17079] bridge_slave_0: entered promiscuous mode [ 429.928160][T17159] bond0: Caught tx_queue_len zero misconfig [ 429.934873][ T5867] Bluetooth: hci1: command tx timeout [ 430.028769][ T13] tipc: Resetting bearer [ 430.097376][T17136] tipc: Resetting bearer [ 431.811265][T17136] tipc: Disabling bearer [ 431.820695][T17079] bridge0: port 2(bridge_slave_1) entered blocking state [ 431.828729][T17079] bridge0: port 2(bridge_slave_1) entered disabled state [ 431.836573][T17079] bridge_slave_1: entered allmulticast mode [ 431.844696][T17079] bridge_slave_1: entered promiscuous mode [ 431.890049][T17190] bridge7: port 1(macvlan2) entered blocking state [ 431.897657][T17190] bridge7: port 1(macvlan2) entered disabled state [ 431.907409][T17190] macvlan2: entered allmulticast mode [ 431.915706][T17190] macvlan2: entered promiscuous mode [ 432.014622][ T5867] Bluetooth: hci1: command tx timeout [ 432.092054][T17079] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 432.124469][T17198] tipc: Enabling of bearer rejected, failed to enable media [ 432.137594][T17079] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 432.319742][T17079] team0: Port device team_slave_0 added [ 432.342760][T17079] team0: Port device team_slave_1 added [ 432.518022][T17079] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 432.526283][T17079] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 432.579108][T17079] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 432.641715][T17079] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 432.661781][T17079] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 432.689367][T17079] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 432.816419][T17235] __nla_validate_parse: 5 callbacks suppressed [ 432.816440][T17235] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2932'. [ 432.866036][T17079] hsr_slave_0: entered promiscuous mode [ 432.872914][T17079] hsr_slave_1: entered promiscuous mode [ 433.338042][T17257] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2938'. [ 433.348031][T17257] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2938'. [ 433.435309][T17261] IPVS: set_ctl: invalid protocol: 58 255.255.255.255:20000 [ 433.580905][T17267] tipc: Enabling of bearer rejected, failed to enable media [ 433.881880][T17079] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 433.935508][T17079] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 433.968484][T17079] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 433.975135][T17285] netlink: 'syz.1.2948': attribute type 1 has an invalid length. [ 433.990995][T17286] atomic_op ffff888021be6998 conn xmit_atomic 0000000000000000 [ 434.026842][T17286] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2946'. [ 434.041328][T17079] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 434.095308][ T5867] Bluetooth: hci1: command tx timeout [ 434.236947][T17288] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 434.249256][T17288] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 434.388177][T17285] macvlan0: entered promiscuous mode [ 434.394871][T17285] macvlan0: entered allmulticast mode [ 434.401225][T17285] bond5: entered promiscuous mode [ 434.407826][T17285] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 434.422672][T17285] bond5: left promiscuous mode [ 434.624333][T17308] netlink: 'syz.1.2951': attribute type 14 has an invalid length. [ 434.681286][T17308] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (11) [ 434.794572][T17318] netlink: 'syz.4.2954': attribute type 8 has an invalid length. [ 434.797354][T17079] 8021q: adding VLAN 0 to HW filter on device bond0 [ 434.818361][T17318] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2954'. [ 434.880228][T17079] 8021q: adding VLAN 0 to HW filter on device team0 [ 434.901012][ T9747] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.908260][ T9747] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.938234][T17324] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2956'. [ 434.958724][T17324] netlink: 35 bytes leftover after parsing attributes in process `syz.2.2956'. [ 434.963029][ T9747] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.976204][ T9747] bridge0: port 2(bridge_slave_1) entered forwarding state [ 435.018906][T17079] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 435.030377][T17079] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 435.268692][T17338] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2958'. [ 435.552301][T17079] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 435.797603][T17079] veth0_vlan: entered promiscuous mode [ 435.847423][T17079] veth1_vlan: entered promiscuous mode [ 435.942073][T17371] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2967'. [ 435.977067][T17079] veth0_macvtap: entered promiscuous mode [ 436.040565][T17079] veth1_macvtap: entered promiscuous mode [ 436.106314][T17079] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 436.148801][T17079] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 436.177366][ T5867] Bluetooth: hci1: command tx timeout [ 436.186184][T17382] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2970'. [ 436.238592][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.259945][T17374] lo speed is unknown, defaulting to 1000 [ 436.290399][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.384737][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.417508][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.601463][T17390] lo speed is unknown, defaulting to 1000 [ 436.680438][T17393] lo speed is unknown, defaulting to 1000 [ 436.911755][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.938169][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 437.257619][T17420] team_slave_1: Caught tx_queue_len zero misconfig [ 437.320161][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 437.342075][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 437.469891][T17424] netlink: 'syz.4.2979': attribute type 1 has an invalid length. [ 437.719378][T17432] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 438.130594][T17446] __nla_validate_parse: 2 callbacks suppressed [ 438.130615][T17446] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2987'. [ 438.163467][T17446] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2987'. [ 438.178835][T17446] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2987'. [ 438.205129][T17446] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2987'. [ 438.288424][T17452] ip_vti0: entered promiscuous mode [ 438.314212][T17452] netlink: 'syz.2.2989': attribute type 2 has an invalid length. [ 438.328091][T17454] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2990'. [ 438.371852][T17456] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2991'. [ 438.440861][ T5864] .`: (slave syz_tun): Releasing backup interface [ 438.539710][ T5871] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 438.555928][ T5871] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 438.565042][ T5871] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 438.578110][ T5871] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 438.588976][ T5871] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 438.833801][T17469] lo speed is unknown, defaulting to 1000 [ 438.927717][T17481] netlink: 240 bytes leftover after parsing attributes in process `syz.3.2994'. [ 439.236209][T17489] lo speed is unknown, defaulting to 1000 [ 439.239868][T17502] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2999'. [ 439.260682][T17502] geneve2: entered promiscuous mode [ 439.267790][T17502] geneve2: entered allmulticast mode [ 439.286846][ T9374] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 35326 - 0 [ 439.326885][T17502] vlan3: entered promiscuous mode [ 439.332063][T17502] bond0: entered promiscuous mode [ 439.357486][ T9374] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 35326 - 0 [ 439.368161][ T9374] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 35326 - 0 [ 439.377383][ T9374] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 35326 - 0 [ 439.420799][T17469] chnl_net:caif_netlink_parms(): no params data found [ 439.756344][T17469] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.793787][T17469] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.801372][T17469] bridge_slave_0: entered allmulticast mode [ 439.820013][T17469] bridge_slave_0: entered promiscuous mode [ 439.836718][T17522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3004'. [ 439.840137][T17529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3006'. [ 439.897452][T17528] nft_compat: unsupported protocol 0 [ 439.920294][T17469] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.943299][T17469] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.950677][T17469] bridge_slave_1: entered allmulticast mode [ 439.971076][T17530] netlink: 'syz.2.3006': attribute type 11 has an invalid length. [ 439.975872][T17469] bridge_slave_1: entered promiscuous mode [ 440.136527][T17469] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 440.171644][T17469] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 440.300793][T17469] team0: Port device team_slave_0 added [ 440.360505][T17469] team0: Port device team_slave_1 added [ 440.521136][T17469] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 440.535190][T17469] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 440.562137][T17469] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 440.584166][T17469] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 440.591399][T17469] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 440.618729][T17469] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 440.657677][ T5871] Bluetooth: hci0: command tx timeout [ 440.677242][T17547] lo speed is unknown, defaulting to 1000 [ 441.089559][T17469] hsr_slave_0: entered promiscuous mode [ 441.118325][T17469] hsr_slave_1: entered promiscuous mode [ 441.136871][T17469] debugfs: 'hsr0' already exists in 'hsr' [ 441.142662][T17469] Cannot create hsr debugfs directory [ 441.605404][T17582] tipc: Enabled bearer , priority 0 [ 441.728540][T17570] tipc: Disabling bearer [ 441.820530][T17469] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.851832][T17469] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.936688][T17616] netlink: 'syz.3.3031': attribute type 1 has an invalid length. [ 441.997051][T17619] netlink: 'syz.2.3030': attribute type 19 has an invalid length. [ 442.031094][T17616] veth3: entered promiscuous mode [ 442.048636][T17469] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.060388][T17469] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.113640][T17616] bridge_slave_0: left allmulticast mode [ 442.119454][T17616] bridge_slave_0: left promiscuous mode [ 442.128219][T17616] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.176232][T17616] bridge_slave_1: left allmulticast mode [ 442.181937][T17616] bridge_slave_1: left promiscuous mode [ 442.190879][T17616] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.210001][T17616] bond0: (slave bond_slave_0): Releasing backup interface [ 442.226888][T17616] bond0: (slave bond_slave_1): Releasing backup interface [ 442.258641][T17616] team0: Port device team_slave_0 removed [ 442.272252][T17616] team0: Port device team_slave_1 removed [ 442.280281][T17616] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 442.288333][T17616] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 442.298067][T17616] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 442.306352][T17616] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 442.317836][T17616] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 442.373724][T17621] ¾x9ÿ: renamed from bridge_slave_0 [ 442.408864][T17469] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.422717][T17469] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.562796][T17628] : (slave bond_slave_0): Releasing backup interface [ 442.602009][ T30] audit: type=1800 audit(1759197385.781:5): pid=17631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3033" name="memory.events" dev="tmpfs" ino=3109 res=0 errno=0 [ 442.637309][T17628] : (slave bond_slave_1): Releasing backup interface [ 442.662479][T17628] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 442.674784][T17628] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 442.689181][T17628] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 442.712088][T17469] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.724491][T17469] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.738398][ T5871] Bluetooth: hci0: command tx timeout [ 442.955560][T17469] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 442.973110][T17469] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 442.988567][T17469] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 443.019136][T17469] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 443.272122][T17469] 8021q: adding VLAN 0 to HW filter on device bond0 [ 443.310747][T17469] 8021q: adding VLAN 0 to HW filter on device team0 [ 443.355258][ T9374] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.362492][ T9374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 443.400623][T17660] __nla_validate_parse: 6 callbacks suppressed [ 443.400645][T17660] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3041'. [ 443.417500][ T9374] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.424829][ T9374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 443.476943][T17660] macvtap2: entered promiscuous mode [ 443.505158][T17660] macvtap2: entered allmulticast mode [ 443.527407][T17660] erspan0: entered allmulticast mode [ 443.544714][T17668] netlink: 252 bytes leftover after parsing attributes in process `syz.3.3043'. [ 443.608090][T17660] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3041'. [ 443.739164][T17672] lo speed is unknown, defaulting to 1000 [ 444.122737][T17469] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 444.242131][T17469] veth0_vlan: entered promiscuous mode [ 444.300496][T17469] veth1_vlan: entered promiscuous mode [ 444.338822][T17469] veth0_macvtap: entered promiscuous mode [ 444.352006][T17469] veth1_macvtap: entered promiscuous mode [ 444.514289][T17469] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.550185][T17469] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.597834][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.645927][T17705] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3052'. [ 444.693346][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.714580][ T9374] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.815338][ T5871] Bluetooth: hci0: command tx timeout [ 444.872751][ T9374] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.881822][T17707] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3052'. [ 444.911559][T17712] vlan0: entered allmulticast mode [ 444.921379][T17712] batadv0: entered allmulticast mode [ 444.930278][T17715] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3055'. [ 444.964040][T17715] netlink: 'syz.3.3055': attribute type 11 has an invalid length. [ 445.030962][ T9374] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.085142][T17724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3056'. [ 445.119368][ T9374] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.190988][ T9374] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.209399][ T9374] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.235068][ T1112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.244549][ T1112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.391655][ T9374] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.409912][ T9374] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.467209][T17747] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3061'. [ 445.911044][T17771] netlink: 120 bytes leftover after parsing attributes in process `syz.0.3068'. [ 446.059593][T17776] netlink: 'syz.3.3070': attribute type 1 has an invalid length. [ 446.342681][T17785] Bluetooth: MGMT ver 1.23 [ 446.356259][T17789] netlink: 'syz.4.3075': attribute type 1 has an invalid length. [ 446.615571][ T5867] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 446.627223][ T5867] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 446.637046][ T5867] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 446.645419][ T5867] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 446.655024][ T5867] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 446.795325][T17803] lo speed is unknown, defaulting to 1000 [ 446.894226][ T5871] Bluetooth: hci0: command tx timeout [ 446.959278][ T12] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.988117][ T12] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 35326 - 0 [ 447.061724][T17820] netlink: 'syz.1.3082': attribute type 21 has an invalid length. [ 447.076750][T17820] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3082'. [ 447.121122][ T9747] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.121312][T17820] netlink: 'syz.1.3082': attribute type 21 has an invalid length. [ 447.146022][ T9747] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.158291][T17834] netlink: 'syz.3.3087': attribute type 4 has an invalid length. [ 447.170341][ T9747] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.204494][ T12] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.229392][ T12] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 35326 - 0 [ 447.257104][ T9747] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 447.355039][ T12] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.393008][ T12] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 35326 - 0 [ 447.518624][ T12] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.559499][ T12] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 35326 - 0 [ 447.586331][ T30] audit: type=1800 audit(1759197390.771:6): pid=17853 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3094" name="memory.events" dev="tmpfs" ino=55 res=0 errno=0 [ 447.782852][T17845] tc_dump_action: action bad kind [ 447.796603][T17854] lo speed is unknown, defaulting to 1000 [ 448.131567][T17803] chnl_net:caif_netlink_parms(): no params data found [ 448.266321][ T12] batman_adv: batadv0: Interface deactivated: vxlan0 [ 448.526392][T17901] __nla_validate_parse: 5 callbacks suppressed [ 448.526414][T17901] netlink: 140 bytes leftover after parsing attributes in process `syz.1.3102'. [ 448.692362][T17906] netlink: 'syz.0.3106': attribute type 7 has an invalid length. [ 448.734221][ T5871] Bluetooth: hci2: command tx timeout [ 449.000962][ T12] batman_adv: batadv0: Removing interface: vxlan0 [ 449.450907][ T12] bond0 (unregistering): Released all slaves [ 449.466840][ T12] bond1 (unregistering): Released all slaves [ 449.607578][ T12] bond2 (unregistering): Released all slaves [ 449.623694][ T12] bond3 (unregistering): Released all slaves [ 449.737241][ T12] bond4 (unregistering): Released all slaves [ 449.845002][ T12] bond5 (unregistering): Released all slaves [ 449.956124][ T12] bond6 (unregistering): Released all slaves [ 450.061965][ T12] bond7 (unregistering): Released all slaves [ 450.176111][ T12] bond8 (unregistering): Released all slaves [ 450.191381][ T12] bond9 (unregistering): Released all slaves [ 450.297230][ T12] bond10 (unregistering): Released all slaves [ 450.505576][T17803] bridge0: port 1(bridge_slave_0) entered blocking state [ 450.512891][T17803] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.527865][T17803] bridge_slave_0: entered allmulticast mode [ 450.547420][T17803] bridge_slave_0: entered promiscuous mode [ 450.612727][T17938] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 450.784220][ T12] tipc: Disabling bearer [ 450.806430][ T12] tipc: Left network mode [ 450.820798][ T5871] Bluetooth: hci2: command tx timeout [ 450.827406][T17803] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.844917][T17803] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.855204][T17803] bridge_slave_1: entered allmulticast mode [ 450.865605][T17803] bridge_slave_1: entered promiscuous mode [ 450.940951][ T12] IPVS: stopping master sync thread 7129 ... [ 450.958910][T17944] lo speed is unknown, defaulting to 1000 [ 451.068656][T17956] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3114'. [ 451.082195][T17803] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 451.147488][T17956] bridge0: port 2(batadv_slave_1) entered disabled state [ 451.255633][T17956] batadv_slave_1 (unregistering): left allmulticast mode [ 451.265936][T17960] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3114'. [ 451.271383][T17957] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3115'. [ 451.275289][T17956] bridge0: port 2(batadv_slave_1) entered disabled state [ 451.353092][T17803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.474773][T17960] macsec2: entered promiscuous mode [ 451.480340][T17960] macsec2: entered allmulticast mode [ 451.486427][T17960] ip6gretap0: entered allmulticast mode [ 451.568606][T17967] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3115'. [ 451.634448][T17969] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3118'. [ 451.661345][T17803] team0: Port device team_slave_0 added [ 451.712103][T17803] team0: Port device team_slave_1 added [ 451.880070][T17977] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 452.115552][T17983] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3121'. [ 452.407161][T17803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 452.416520][T17803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 452.443595][T17803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 452.519145][ T9374] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.541387][ T9374] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.554097][ T9374] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.567026][ T9374] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.587336][T17803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 452.595325][T17803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 452.627505][T17803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 452.654087][ T9374] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.663111][ T9374] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.759170][ T9374] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.770898][ T9374] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.827540][T17985] lo speed is unknown, defaulting to 1000 [ 452.895252][ T5871] Bluetooth: hci2: command tx timeout [ 452.950447][T17803] hsr_slave_0: entered promiscuous mode [ 452.965092][T17803] hsr_slave_1: entered promiscuous mode [ 452.978286][T17803] debugfs: 'hsr0' already exists in 'hsr' [ 452.993975][T17803] Cannot create hsr debugfs directory [ 453.192237][T17997] lo speed is unknown, defaulting to 1000 [ 453.370834][T18009] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3128'. [ 453.382001][T12264] IPVS: starting estimator thread 0... [ 453.429742][ T12] veth1_to_hsr: left allmulticast mode [ 453.436081][ T12] veth1_to_hsr: left promiscuous mode [ 453.473970][T18010] IPVS: using max 30 ests per chain, 72000 per kthread [ 453.482420][ T12] pimreg3 (unregistering): left allmulticast mode [ 454.086343][ T12] vxcan1 (unregistering): left allmulticast mode [ 454.656673][T18029] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3132'. [ 454.951172][ T12] IPVS: stop unused estimator thread 0... [ 454.973882][ T5871] Bluetooth: hci2: command tx timeout [ 455.324654][T18026] delete_channel: no stack [ 455.587349][T17803] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 455.631657][T17803] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 455.677466][T17803] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 455.715458][T17803] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 456.076013][T17803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 456.126755][T18070] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 456.170450][T18071] siw: device registration error -23 [ 456.215587][T17803] 8021q: adding VLAN 0 to HW filter on device team0 [ 456.259721][ T9745] bridge0: port 1(bridge_slave_0) entered blocking state [ 456.266978][ T9745] bridge0: port 1(bridge_slave_0) entered forwarding state [ 456.339309][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 456.346584][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 456.396722][T18068] netlink: 'syz.0.3141': attribute type 4 has an invalid length. [ 456.400218][T18076] ip6gre1: entered allmulticast mode [ 456.462799][T18079] batman_adv: batadv0: Adding interface: macvtap1 [ 456.487519][T18079] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.527869][T18079] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 457.168442][T18102] tipc: Started in network mode [ 457.193474][T18102] tipc: Node identity 9e5bb0b4bc61, cluster identity 4711 [ 457.215888][T18102] tipc: Enabled bearer , priority 0 [ 457.258666][T18101] tipc: Disabling bearer [ 457.341532][T17803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 457.521791][T17803] veth0_vlan: entered promiscuous mode [ 457.618383][T17803] veth1_vlan: entered promiscuous mode [ 457.679912][T17803] veth0_macvtap: entered promiscuous mode [ 457.715696][T17803] veth1_macvtap: entered promiscuous mode [ 457.742207][T18120] bond0: (slave rose0): Error: Device can not be enslaved while up [ 457.764276][T18121] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3157'. [ 457.781501][T17803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 457.790582][T18121] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3157'. [ 457.806620][T18121] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3157'. [ 457.825425][T17803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 457.846449][T18121] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3157'. [ 457.932021][ T9748] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.965432][ T9748] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.010600][ T9748] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.060626][T18127] lo speed is unknown, defaulting to 1000 [ 458.099286][T18134] netlink: 'syz.4.3162': attribute type 1 has an invalid length. [ 458.176343][T18134] 8021q: adding VLAN 0 to HW filter on device bond4 [ 458.334885][ T9748] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.377303][T18134] bond4: (slave gretap2): making interface the new active one [ 458.400951][T18134] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 458.462240][ T1112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.511567][ T1112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.559085][ T1112] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.569010][ T1112] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.767418][T18154] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3167'. [ 458.793046][T18155] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3167'. [ 458.856494][T18154] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3167'. [ 458.892502][T18154] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3167'. [ 458.954217][T18153] lo speed is unknown, defaulting to 1000 [ 459.089287][T18160] lo speed is unknown, defaulting to 1000 [ 459.536132][T18176] tipc: Started in network mode [ 459.559091][T18176] tipc: Node identity 6, cluster identity 3 [ 459.604484][T18176] tipc: Node number set to 6 [ 459.843108][T18187] netlink: 'syz.3.3174': attribute type 21 has an invalid length. [ 459.874407][T18187] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3174'. [ 459.995846][T18192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3174'. [ 460.217023][ T5867] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 460.227902][ T5867] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 460.237937][ T5867] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 460.248707][ T5867] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 460.261052][ T5867] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 460.284597][ T5878] syz_tun (unregistering): left allmulticast mode [ 460.409894][T18203] lo speed is unknown, defaulting to 1000 [ 460.562807][T18214] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3182'. [ 460.588986][T18217] FAULT_INJECTION: forcing a failure. [ 460.588986][T18217] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 460.625642][T18217] CPU: 1 UID: 0 PID: 18217 Comm: syz.2.3183 Not tainted syzkaller #0 PREEMPT(full) [ 460.625673][T18217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 460.625687][T18217] Call Trace: [ 460.625696][T18217] [ 460.625706][T18217] dump_stack_lvl+0x189/0x250 [ 460.625736][T18217] ? __pfx____ratelimit+0x10/0x10 [ 460.625760][T18217] ? __pfx_dump_stack_lvl+0x10/0x10 [ 460.625785][T18217] ? __pfx__printk+0x10/0x10 [ 460.625814][T18217] ? __might_fault+0xb0/0x130 [ 460.625856][T18217] should_fail_ex+0x414/0x560 [ 460.625893][T18217] _copy_from_iter+0x1de/0x1790 [ 460.625915][T18217] ? __lock_acquire+0xab9/0xd20 [ 460.625947][T18217] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 460.626064][T18217] ? policy_nodemask+0x27c/0x720 [ 460.626093][T18217] ? __pfx__copy_from_iter+0x10/0x10 [ 460.626125][T18217] ? set_page_refcounted+0xa0/0x1e0 [ 460.626154][T18217] ? page_copy_sane+0x4e/0x280 [ 460.626181][T18217] copy_page_from_iter+0xdd/0x170 [ 460.626211][T18217] tun_get_user+0x1d7b/0x3e90 [ 460.626245][T18217] ? tun_get_user+0x6f6/0x3e90 [ 460.626279][T18217] ? aa_file_perm+0x44d/0x1550 [ 460.626301][T18217] ? __pfx_tun_get_user+0x10/0x10 [ 460.626324][T18217] ? _parse_integer_limit+0x1ae/0x1f0 [ 460.626368][T18217] ? __lock_acquire+0xab9/0xd20 [ 460.626405][T18217] ? ref_tracker_alloc+0x318/0x460 [ 460.626436][T18217] ? __lock_acquire+0xab9/0xd20 [ 460.626468][T18217] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 460.626508][T18217] ? tun_get+0x1c/0x2f0 [ 460.626538][T18217] ? tun_get+0x1c/0x2f0 [ 460.626560][T18217] ? tun_get+0x1c/0x2f0 [ 460.626589][T18217] tun_chr_write_iter+0x113/0x200 [ 460.626617][T18217] vfs_write+0x5c9/0xb30 [ 460.626650][T18217] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 460.626675][T18217] ? __pfx_vfs_write+0x10/0x10 [ 460.626715][T18217] ? __fget_files+0x2a/0x420 [ 460.626757][T18217] ksys_write+0x145/0x250 [ 460.626788][T18217] ? __pfx_ksys_write+0x10/0x10 [ 460.626812][T18217] ? rcu_is_watching+0x15/0xb0 [ 460.626839][T18217] ? do_syscall_64+0xbe/0x3b0 [ 460.626868][T18217] do_syscall_64+0xfa/0x3b0 [ 460.626892][T18217] ? lockdep_hardirqs_on+0x9c/0x150 [ 460.626915][T18217] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.626937][T18217] ? clear_bhb_loop+0x60/0xb0 [ 460.626964][T18217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.626993][T18217] RIP: 0033:0x7fd8bcb8d97f [ 460.627013][T18217] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 460.627033][T18217] RSP: 002b:00007fd8badf6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 460.627056][T18217] RAX: ffffffffffffffda RBX: 00007fd8bcde5fa0 RCX: 00007fd8bcb8d97f [ 460.627072][T18217] RDX: 0000000000000036 RSI: 0000200000000340 RDI: 00000000000000c8 [ 460.627086][T18217] RBP: 00007fd8badf6090 R08: 0000000000000000 R09: 0000000000000000 [ 460.627100][T18217] R10: 0000000000000036 R11: 0000000000000293 R12: 0000000000000001 [ 460.627113][T18217] R13: 00007fd8bcde6038 R14: 00007fd8bcde5fa0 R15: 00007ffffbe4ea88 [ 460.627160][T18217] [ 461.172103][T18232] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3187'. [ 461.210193][T18222] syzkaller0: entered promiscuous mode [ 461.223977][T18222] syzkaller0: entered allmulticast mode [ 461.549984][T18240] lo speed is unknown, defaulting to 1000 [ 461.558045][T18203] chnl_net:caif_netlink_parms(): no params data found [ 461.572424][T18252] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3190'. [ 461.797750][T18262] netlink: 200 bytes leftover after parsing attributes in process `syz.3.3195'. [ 461.842572][T18262] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3195'. [ 461.865767][T18264] bond0: Error: Cannot enslave bond to itself. [ 461.895870][T18269] netlink: 'syz.2.3194': attribute type 1 has an invalid length. [ 462.022343][T18273] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3196'. [ 462.068500][T18203] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.077459][T18203] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.085077][T18203] bridge_slave_0: entered allmulticast mode [ 462.096050][T18203] bridge_slave_0: entered promiscuous mode [ 462.126594][T18203] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.135841][T18203] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.148204][T18203] bridge_slave_1: entered allmulticast mode [ 462.157275][T18203] bridge_slave_1: entered promiscuous mode [ 462.318815][T18288] tipc: Failed to remove unknown binding: 66,1,1/0:631907548/631907550 [ 462.335284][ T5867] Bluetooth: hci4: command tx timeout [ 462.353702][T18203] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 462.365956][T18288] tipc: Failed to remove unknown binding: 66,1,1/0:631907548/631907550 [ 462.373597][T18203] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 462.460039][T18203] team0: Port device team_slave_0 added [ 462.480615][T18203] team0: Port device team_slave_1 added [ 462.578181][T18203] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 462.596850][T18203] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.619550][T18296] netlink: 240 bytes leftover after parsing attributes in process `syz.0.3201'. [ 462.650278][T18203] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 462.666990][T18203] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 462.675335][T18203] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.705298][T18203] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 462.742396][T18298] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3202'. [ 462.867538][T18203] hsr_slave_0: entered promiscuous mode [ 462.878682][T18203] hsr_slave_1: entered promiscuous mode [ 462.885896][T18203] debugfs: 'hsr0' already exists in 'hsr' [ 462.892412][T18203] Cannot create hsr debugfs directory [ 463.155149][T18325] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 463.346057][T18330] lo speed is unknown, defaulting to 1000 [ 463.918871][T18203] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.090965][T18357] netlink: 'syz.1.3218': attribute type 11 has an invalid length. [ 464.340970][T18368] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 464.414804][ T5867] Bluetooth: hci4: command tx timeout [ 464.908468][T18203] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.048571][ T12] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 465.109402][T18203] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.125498][T18383] syz.3.3221 uses old SIOCAX25GETINFO [ 465.206829][T18203] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.232434][T18386] __nla_validate_parse: 4 callbacks suppressed [ 465.232455][T18386] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3222'. [ 465.782571][T18395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3224'. [ 465.810737][T18203] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 465.831558][T18203] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 465.862069][T18203] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 465.881268][T18203] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 465.990904][T18406] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3226'. [ 466.039406][T18203] 8021q: adding VLAN 0 to HW filter on device bond0 [ 466.064390][T18203] 8021q: adding VLAN 0 to HW filter on device team0 [ 466.080870][ T1112] bridge0: port 1(bridge_slave_0) entered blocking state [ 466.088133][ T1112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 466.110412][ T9745] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.117659][ T9745] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.174237][T18413] netlink: 240 bytes leftover after parsing attributes in process `syz.0.3226'. [ 466.251117][T18415] netlink: 'syz.1.3229': attribute type 9 has an invalid length. [ 466.280077][T18415] netlink: 'syz.1.3229': attribute type 7 has an invalid length. [ 466.361276][T18415] netlink: 'syz.1.3229': attribute type 8 has an invalid length. [ 466.406722][T18423] netlink: 'syz.0.3230': attribute type 10 has an invalid length. [ 466.477563][T18427] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3232'. [ 466.486921][T18423] team0: Port device dummy0 added [ 466.494255][ T5871] Bluetooth: hci4: command tx timeout [ 466.566966][T18431] RDS: rds_bind could not find a transport for 100:806:aaaa:aaaa:aaaa::2, load rds_tcp or rds_rdma? [ 466.589777][T18431] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3232'. [ 466.592410][T18203] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.612253][T18431] veth1_macvtap: left promiscuous mode [ 466.639879][T18434] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3233'. [ 467.001363][T18203] veth0_vlan: entered promiscuous mode [ 467.016094][T18203] veth1_vlan: entered promiscuous mode [ 467.047030][T18203] veth0_macvtap: entered promiscuous mode [ 467.057927][T18203] veth1_macvtap: entered promiscuous mode [ 467.078756][T18203] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 467.094990][T18203] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 467.109984][ T1112] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.120651][ T1112] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.130276][ T1112] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.140378][ T1112] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.214377][ T5871] Bluetooth: hci1: command 0x0c1a tx timeout [ 467.222994][T18382] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 467.234757][T18382] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 467.345735][T18453] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3235'. [ 467.417238][T18455] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3236'. [ 467.437643][T18455] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3236'. [ 467.453293][T18455] bond0: entered promiscuous mode [ 467.458519][T18455] bond_slave_0: entered promiscuous mode [ 467.465078][T18455] bond_slave_1: entered promiscuous mode [ 467.472584][T18455] batadv0: entered promiscuous mode [ 467.482019][T18455] debugfs: 'hsr1' already exists in 'hsr' [ 467.487858][T18455] Cannot create hsr debugfs directory [ 467.495184][T18455] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 467.507088][T18454] delete_channel: no stack [ 467.667165][T18462] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 467.929685][T18382] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 467.937180][T18382] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 467.976681][T18382] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 467.982740][T18382] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 468.575011][ T5871] Bluetooth: hci4: command 0x0419 tx timeout [ 468.582913][T18382] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 468.588954][T18382] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 470.840978][ T9374] macvlan2: left allmulticast mode [ 470.847300][ T9374] macvlan2: left promiscuous mode [ 470.853867][ T9374] bridge7: port 1(macvlan2) entered disabled state [ 470.962615][ T9374] ip6gretap0 (unregistering): left promiscuous mode [ 471.221150][ T9374] bond0 (unregistering): (slave gretap2): Releasing active interface [ 471.340034][ T9374] bond2 (unregistering): (slave geneve3): Releasing active interface [ 471.348971][ T9374] geneve3 (unregistering): left promiscuous mode [ 471.368003][ T9374] bond1 (unregistering): (slave geneve0): Releasing active interface [ 471.808381][ T9374] .` (unregistering): (slave 30): Releasing backup interface [ 471.819285][ T9374] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 471.828993][ T9374] .` (unregistering): Released all slaves [ 471.945477][ T9374] bond1 (unregistering): Released all slaves [ 472.059184][ T9374] bond2 (unregistering): Released all slaves [ 472.170575][ T9374] bond3 (unregistering): (slave veth9): Releasing active interface [ 472.180530][ T9374] bond3 (unregistering): Released all slaves [ 472.195168][ T9374] bond4 (unregistering): Released all slaves [ 472.215680][ T9374] bond0 (unregistering): Released all slaves [ 472.331801][ T9374] bond5 (unregistering): (slave veth13): Releasing backup interface [ 472.342846][ T9374] bond5 (unregistering): Released all slaves [ 472.484941][ T9374] tipc: Disabling bearer [ 472.490475][ T9374] tipc: Left network mode [ 472.516711][ T9374] IPVS: stopping backup sync thread 6636 ... [ 616.093502][ T31] INFO: task kworker/u8:9:9374 blocked for more than 143 seconds. [ 616.101560][ T31] Not tainted syzkaller #0 [ 616.106656][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 616.115494][ T31] task:kworker/u8:9 state:D stack:20936 pid:9374 tgid:9374 ppid:2 task_flags:0x4208160 flags:0x00004000 [ 616.128361][ T31] Workqueue: netns cleanup_net [ 616.133701][ T31] Call Trace: [ 616.137030][ T31] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 616.139975][ T31] __schedule+0x1798/0x4cc0 [ 616.145003][ T31] ? __lock_acquire+0xab9/0xd20 [ 616.149930][ T31] ? __lock_acquire+0xab9/0xd20 [ 616.156828][ T31] ? __pfx___schedule+0x10/0x10 [ 616.161751][ T31] ? schedule+0x91/0x360 [ 616.166673][ T31] schedule+0x165/0x360 [ 616.170876][ T31] schedule_preempt_disabled+0x13/0x30 [ 616.193833][ T31] __mutex_lock+0x7e6/0x1350 [ 616.198516][ T31] ? __mutex_lock+0x5bb/0x1350 [ 616.242170][ T31] ? rfkill_unregister+0xc8/0x220 [ 616.252688][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 616.260455][ T31] ? __pfx_device_del+0x10/0x10 [ 616.265704][ T31] rfkill_unregister+0xc8/0x220 [ 616.270604][ T31] wiphy_unregister+0x238/0xae0 [ 616.275628][ T31] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 616.281555][ T31] ? __pfx_wiphy_unregister+0x10/0x10 [ 616.286981][ T31] ? kasan_quarantine_put+0xdd/0x220 [ 616.292286][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 616.297553][ T31] ? kfree+0x18e/0x440 [ 616.301646][ T31] ieee80211_unregister_hw+0x1e2/0x2c0 [ 616.307195][ T31] mac80211_hwsim_del_radio+0x275/0x460 [ 616.312788][ T31] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 616.320216][ T31] hwsim_exit_net+0x584/0x640 [ 616.325446][ T31] ? __pfx_hwsim_exit_net+0x10/0x10 [ 616.330697][ T31] ? __ip_vs_dev_cleanup_batch+0x238/0x260 [ 616.337221][ T31] ops_undo_list+0x49a/0x990 [ 616.341842][ T31] ? __pfx_ops_undo_list+0x10/0x10 [ 616.347595][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 616.352909][ T31] cleanup_net+0x4c5/0x800 [ 616.358016][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 616.362988][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 616.368359][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 616.374226][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 616.379985][ T31] process_scheduled_works+0xae1/0x17b0 [ 616.385680][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 616.391783][ T31] worker_thread+0x8a0/0xda0 [ 616.396490][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 616.402854][ T31] ? __kthread_parkme+0x7b/0x200 [ 616.407861][ T31] kthread+0x70e/0x8a0 [ 616.411995][ T31] ? __pfx_worker_thread+0x10/0x10 [ 616.418211][ T31] ? __pfx_kthread+0x10/0x10 [ 616.422857][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 616.428292][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 616.433639][ T31] ? __pfx_kthread+0x10/0x10 [ 616.438274][ T31] ret_from_fork+0x439/0x7d0 [ 616.442892][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 616.448065][ T31] ? __switch_to_asm+0x39/0x70 [ 616.452842][ T31] ? __switch_to_asm+0x33/0x70 [ 616.457691][ T31] ? __pfx_kthread+0x10/0x10 [ 616.462326][ T31] ret_from_fork_asm+0x1a/0x30 [ 616.467158][ T31] [ 616.470206][ T31] INFO: task kworker/0:14:12264 blocked for more than 143 seconds. [ 616.478208][ T31] Not tainted syzkaller #0 [ 616.483212][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 616.491897][ T31] task:kworker/0:14 state:D stack:23480 pid:12264 tgid:12264 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 616.504352][ T31] Workqueue: events rfkill_global_led_trigger_worker [ 616.511174][ T31] Call Trace: [ 616.514526][ T31] [ 616.517469][ T31] __schedule+0x1798/0x4cc0 [ 616.522090][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 616.527559][ T31] ? __pfx___schedule+0x10/0x10 [ 616.532435][ T31] ? schedule+0x91/0x360 [ 616.536726][ T31] schedule+0x165/0x360 [ 616.540901][ T31] schedule_preempt_disabled+0x13/0x30 [ 616.546434][ T31] __mutex_lock+0x7e6/0x1350 [ 616.551040][ T31] ? __mutex_lock+0x5bb/0x1350 [ 616.555961][ T31] ? rfkill_global_led_trigger_worker+0x27/0xd0 [ 616.562338][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 616.567430][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 616.573222][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 616.578978][ T31] rfkill_global_led_trigger_worker+0x27/0xd0 [ 616.585122][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 616.590892][ T31] process_scheduled_works+0xae1/0x17b0 [ 616.596624][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 616.602658][ T31] worker_thread+0x8a0/0xda0 [ 616.607343][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 616.613771][ T31] ? __kthread_parkme+0x7b/0x200 [ 616.618743][ T31] kthread+0x70e/0x8a0 [ 616.622818][ T31] ? __pfx_worker_thread+0x10/0x10 [ 616.627993][ T31] ? __pfx_kthread+0x10/0x10 [ 616.632599][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 616.637857][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 616.643060][ T31] ? __pfx_kthread+0x10/0x10 [ 616.647715][ T31] ret_from_fork+0x439/0x7d0 [ 616.652422][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 616.657659][ T31] ? __switch_to_asm+0x39/0x70 [ 616.662456][ T31] ? __switch_to_asm+0x33/0x70 [ 616.667284][ T31] ? __pfx_kthread+0x10/0x10 [ 616.671900][ T31] ret_from_fork_asm+0x1a/0x30 [ 616.676761][ T31] [ 616.679865][ T31] INFO: task syz-executor:18203 blocked for more than 143 seconds. [ 616.687941][ T31] Not tainted syzkaller #0 [ 616.692926][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 616.701651][ T31] task:syz-executor state:D stack:21496 pid:18203 tgid:18203 ppid:1 task_flags:0x400140 flags:0x00004004 [ 616.713686][ T31] Call Trace: [ 616.717000][ T31] [ 616.719965][ T31] __schedule+0x1798/0x4cc0 [ 616.724551][ T31] ? __lock_acquire+0xab9/0xd20 [ 616.729480][ T31] ? __lock_acquire+0xab9/0xd20 [ 616.734592][ T31] ? __pfx___schedule+0x10/0x10 [ 616.739682][ T31] ? schedule+0x91/0x360 [ 616.744534][ T31] schedule+0x165/0x360 [ 616.748750][ T31] schedule_preempt_disabled+0x13/0x30 [ 616.754382][ T31] __mutex_lock+0x7e6/0x1350 [ 616.759023][ T31] ? __mutex_lock+0x5bb/0x1350 [ 616.763876][ T31] ? rfkill_fop_open+0x12d/0x820 [ 616.769025][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 616.774229][ T31] ? __raw_spin_lock_init+0x45/0x100 [ 616.779560][ T31] ? __init_waitqueue_head+0xa9/0x150 [ 616.785120][ T31] rfkill_fop_open+0x12d/0x820 [ 616.790017][ T31] ? __pfx_rfkill_fop_open+0x10/0x10 [ 616.795365][ T31] misc_open+0x2b9/0x330 [ 616.799627][ T31] chrdev_open+0x4c9/0x5e0 [ 616.804130][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 616.809102][ T31] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 616.815560][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 616.820624][ T31] do_dentry_open+0x950/0x13f0 [ 616.825505][ T31] vfs_open+0x3b/0x340 [ 616.829579][ T31] ? path_openat+0x2ecd/0x3830 [ 616.834376][ T31] path_openat+0x2ee5/0x3830 [ 616.838977][ T31] ? arch_stack_walk+0xfc/0x150 [ 616.843889][ T31] ? stack_depot_save_flags+0x40/0x860 [ 616.849411][ T31] ? __pfx_path_openat+0x10/0x10 [ 616.854604][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.860825][ T31] do_filp_open+0x1fa/0x410 [ 616.865429][ T31] ? __lock_acquire+0xab9/0xd20 [ 616.870344][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 616.875518][ T31] ? _raw_spin_unlock+0x28/0x50 [ 616.880421][ T31] ? alloc_fd+0x64c/0x6c0 [ 616.884865][ T31] do_sys_openat2+0x121/0x1c0 [ 616.889556][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 616.895618][ T31] ? fput_close_sync+0x119/0x200 [ 616.900617][ T31] ? __pfx_fput_close_sync+0x10/0x10 [ 616.905985][ T31] __x64_sys_openat+0x138/0x170 [ 616.910853][ T31] do_syscall_64+0xfa/0x3b0 [ 616.915512][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.921614][ T31] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 616.927848][ T31] ? clear_bhb_loop+0x60/0xb0 [ 616.932632][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.938683][ T31] RIP: 0033:0x7f160818d710 [ 616.943250][ T31] RSP: 002b:00007ffdf049b060 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 616.951692][ T31] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f160818d710 [ 616.959723][ T31] RDX: 0000000000000002 RSI: 00007f1608212a45 RDI: 00000000ffffff9c [ 616.967742][ T31] RBP: 00007f1608212a45 R08: 0000000000000000 R09: 0000000000000000 [ 616.976018][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000008 [ 616.984077][ T31] R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 [ 616.992109][ T31] [ 616.995217][ T31] INFO: task syz.3.3221:18377 blocked for more than 144 seconds. [ 617.002981][ T31] Not tainted syzkaller #0 [ 617.013885][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 617.022781][ T31] task:syz.3.3221 state:D stack:25096 pid:18377 tgid:18377 ppid:17079 task_flags:0x400040 flags:0x00004004 [ 617.035872][ T31] Call Trace: [ 617.039202][ T31] [ 617.042164][ T31] __schedule+0x1798/0x4cc0 [ 617.047180][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.052069][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.059614][ T31] ? __pfx___schedule+0x10/0x10 [ 617.064677][ T31] ? schedule+0x91/0x360 [ 617.068961][ T31] schedule+0x165/0x360 [ 617.073729][ T31] schedule_preempt_disabled+0x13/0x30 [ 617.079260][ T31] __mutex_lock+0x7e6/0x1350 [ 617.083963][ T31] ? __mutex_lock+0x5bb/0x1350 [ 617.088777][ T31] ? rfkill_unregister+0xc8/0x220 [ 617.093920][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 617.098985][ T31] ? __pfx_device_del+0x10/0x10 [ 617.103963][ T31] rfkill_unregister+0xc8/0x220 [ 617.108852][ T31] nfc_unregister_device+0x96/0x2a0 [ 617.114145][ T31] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 617.119894][ T31] virtual_ncidev_close+0x56/0x90 [ 617.124965][ T31] __fput+0x44c/0xa70 [ 617.128964][ T31] task_work_run+0x1d1/0x260 [ 617.133678][ T31] ? __pfx_task_work_run+0x10/0x10 [ 617.138824][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 617.144413][ T31] exit_to_user_mode_loop+0xec/0x110 [ 617.149747][ T31] do_syscall_64+0x2bd/0x3b0 [ 617.154468][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 617.159717][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.165877][ T31] ? clear_bhb_loop+0x60/0xb0 [ 617.170585][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.176518][ T31] RIP: 0033:0x7f32ddb8eec9 [ 617.180940][ T31] RSP: 002b:00007ffcf86e8598 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 617.189420][ T31] RAX: 0000000000000000 RBX: 00007f32ddde7da0 RCX: 00007f32ddb8eec9 [ 617.197505][ T31] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 617.205520][ T31] RBP: 00007f32ddde7da0 R08: 00000000000001e4 R09: 0000001af86e888f [ 617.213657][ T31] R10: 00007f32ddde7cb0 R11: 0000000000000246 R12: 0000000000071b5b [ 617.221699][ T31] R13: 00007f32ddde6180 R14: ffffffffffffffff R15: 00007ffcf86e86b0 [ 617.229772][ T31] [ 617.232812][ T31] INFO: task syz.3.3221:18382 blocked for more than 144 seconds. [ 617.240626][ T31] Not tainted syzkaller #0 [ 617.245659][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 617.254402][ T31] task:syz.3.3221 state:D stack:25624 pid:18382 tgid:18377 ppid:17079 task_flags:0x400140 flags:0x00004006 [ 617.266399][ T31] Call Trace: [ 617.269685][ T31] [ 617.272646][ T31] __schedule+0x1798/0x4cc0 [ 617.277269][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.282168][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.287124][ T31] ? __pfx___schedule+0x10/0x10 [ 617.292009][ T31] ? schedule+0x91/0x360 [ 617.296651][ T31] schedule+0x165/0x360 [ 617.300851][ T31] schedule_preempt_disabled+0x13/0x30 [ 617.306399][ T31] __mutex_lock+0x7e6/0x1350 [ 617.311031][ T31] ? __mutex_lock+0x5bb/0x1350 [ 617.315843][ T31] ? nfc_rfkill_set_block+0x50/0x2e0 [ 617.321147][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 617.326224][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 617.331432][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 617.337355][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 617.343755][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 617.349504][ T31] nfc_rfkill_set_block+0x50/0x2e0 [ 617.354746][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 617.360525][ T31] rfkill_set_block+0x1cf/0x440 [ 617.365478][ T31] rfkill_fop_write+0x44b/0x570 [ 617.370348][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 617.375848][ T31] ? security_file_permission+0x70/0x290 [ 617.381557][ T31] ? rw_verify_area+0x255/0x4d0 [ 617.386457][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.391321][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 617.396761][ T31] vfs_write+0x27b/0xb30 [ 617.401049][ T31] ? __pfx_vfs_write+0x10/0x10 [ 617.405882][ T31] ? __fget_files+0x2a/0x420 [ 617.410491][ T31] ? __fget_files+0x2a/0x420 [ 617.415148][ T31] ? __fget_files+0x3a0/0x420 [ 617.419867][ T31] ? __fget_files+0x2a/0x420 [ 617.424548][ T31] ksys_write+0x145/0x250 [ 617.428909][ T31] ? __pfx_ksys_write+0x10/0x10 [ 617.433885][ T31] ? rcu_is_watching+0x15/0xb0 [ 617.438769][ T31] ? do_syscall_64+0xbe/0x3b0 [ 617.443546][ T31] do_syscall_64+0xfa/0x3b0 [ 617.448094][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 617.453745][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.460056][ T31] ? clear_bhb_loop+0x60/0xb0 [ 617.464812][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.470726][ T31] RIP: 0033:0x7f32ddb8eec9 [ 617.475197][ T31] RSP: 002b:00007f32de9e1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 617.483653][ T31] RAX: ffffffffffffffda RBX: 00007f32ddde6090 RCX: 00007f32ddb8eec9 [ 617.491657][ T31] RDX: 0000000000000008 RSI: 0000200000000000 RDI: 0000000000000009 [ 617.499834][ T31] RBP: 00007f32ddc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 617.507867][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 617.515994][ T31] R13: 00007f32ddde6128 R14: 00007f32ddde6090 R15: 00007ffcf86e8438 [ 617.524160][ T31] [ 617.527260][ T31] INFO: task syz.0.3230:18423 blocked for more than 144 seconds. [ 617.535399][ T31] Not tainted syzkaller #0 [ 617.540374][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 617.549127][ T31] task:syz.0.3230 state:D stack:21480 pid:18423 tgid:18421 ppid:17469 task_flags:0x400140 flags:0x00004004 [ 617.561400][ T31] Call Trace: [ 617.564778][ T31] [ 617.567752][ T31] __schedule+0x1798/0x4cc0 [ 617.572374][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.577397][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.582307][ T31] ? __pfx___schedule+0x10/0x10 [ 617.587282][ T31] ? schedule+0x91/0x360 [ 617.591550][ T31] schedule+0x165/0x360 [ 617.595858][ T31] schedule_preempt_disabled+0x13/0x30 [ 617.601352][ T31] __mutex_lock+0x7e6/0x1350 [ 617.606000][ T31] ? __mutex_lock+0x5bb/0x1350 [ 617.610962][ T31] ? rfkill_register+0x37/0x8e0 [ 617.615976][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 617.621010][ T31] ? netdev_run_todo+0xe1d/0xea0 [ 617.626025][ T31] ? nl80211_common_reg_change_event+0x55d/0x6b0 [ 617.632551][ T31] ? __pfx_netdev_run_todo+0x10/0x10 [ 617.637935][ T31] ? __queue_delayed_work+0x212/0x2d0 [ 617.643488][ T31] rfkill_register+0x37/0x8e0 [ 617.648291][ T31] wiphy_register+0x2231/0x2aa0 [ 617.653276][ T31] ? __pfx_wiphy_register+0x10/0x10 [ 617.658527][ T31] ? ieee80211_init_rate_ctrl_alg+0x114/0x5f0 [ 617.664678][ T31] ieee80211_register_hw+0x3473/0x40d0 [ 617.670185][ T31] ? ieee80211_register_hw+0x1481/0x40d0 [ 617.675880][ T31] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 617.681716][ T31] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 617.687704][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 617.693722][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 617.700180][ T31] ? __hrtimer_setup+0x187/0x210 [ 617.705206][ T31] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 617.711061][ T31] mac80211_hwsim_new_radio+0x2f7a/0x5210 [ 617.716875][ T31] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 617.722959][ T31] ? __nla_validate_parse+0x2400/0x2d40 [ 617.728560][ T31] ? ____sys_sendmsg+0x505/0x830 [ 617.733583][ T31] hwsim_new_radio_nl+0xf5b/0x1bd0 [ 617.738750][ T31] ? __pfx___nla_validate_parse+0x10/0x10 [ 617.744556][ T31] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 617.750159][ T31] ? __nla_parse+0x40/0x60 [ 617.754762][ T31] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 617.761137][ T31] genl_family_rcv_msg_doit+0x215/0x300 [ 617.766767][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 617.772863][ T31] ? bpf_lsm_capable+0x9/0x20 [ 617.777641][ T31] ? security_capable+0x7e/0x2e0 [ 617.782627][ T31] genl_rcv_msg+0x60e/0x790 [ 617.787196][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 617.792237][ T31] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 617.797848][ T31] ? __asan_memcpy+0x40/0x70 [ 617.802466][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 617.807922][ T31] netlink_rcv_skb+0x205/0x470 [ 617.812727][ T31] ? __lock_acquire+0xab9/0xd20 [ 617.817639][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 617.822704][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 617.828063][ T31] ? down_read+0x1ad/0x2e0 [ 617.832497][ T31] genl_rcv+0x28/0x40 [ 617.836532][ T31] netlink_unicast+0x82f/0x9e0 [ 617.841358][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 617.846699][ T31] ? netlink_sendmsg+0x642/0xb30 [ 617.851641][ T31] ? skb_put+0x11b/0x210 [ 617.856179][ T31] netlink_sendmsg+0x805/0xb30 [ 617.860994][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 617.866379][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 617.871353][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 617.876685][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 617.881984][ T31] __sock_sendmsg+0x21c/0x270 [ 617.886742][ T31] ____sys_sendmsg+0x505/0x830 [ 617.891541][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 617.896894][ T31] ? import_iovec+0x74/0xa0 [ 617.901412][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 617.906147][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 617.911391][ T31] ? __fget_files+0x2a/0x420 [ 617.916074][ T31] ? __fget_files+0x3a0/0x420 [ 617.920774][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 617.925773][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 617.931293][ T31] ? rcu_is_watching+0x15/0xb0 [ 617.937109][ T31] ? do_syscall_64+0xbe/0x3b0 [ 617.941841][ T31] do_syscall_64+0xfa/0x3b0 [ 617.946416][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 617.951622][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.957825][ T31] ? clear_bhb_loop+0x60/0xb0 [ 617.962517][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.968477][ T31] RIP: 0033:0x7fb157d8eec9 [ 617.972899][ T31] RSP: 002b:00007fb158c67038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 617.981374][ T31] RAX: ffffffffffffffda RBX: 00007fb157fe5fa0 RCX: 00007fb157d8eec9 [ 617.989417][ T31] RDX: 0000000020000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 617.997442][ T31] RBP: 00007fb157e11f91 R08: 0000000000000000 R09: 0000000000000000 [ 618.005447][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 618.014115][ T31] R13: 00007fb157fe6038 R14: 00007fb157fe5fa0 R15: 00007ffe78caa238 [ 618.022239][ T31] [ 618.025368][ T31] INFO: task syz.1.3234:18445 blocked for more than 145 seconds. [ 618.033551][ T31] Not tainted syzkaller #0 [ 618.038643][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 618.047486][ T31] task:syz.1.3234 state:D stack:26920 pid:18445 tgid:18439 ppid:5874 task_flags:0x400140 flags:0x00004004 [ 618.060187][ T31] Call Trace: [ 618.063979][ T31] [ 618.066946][ T31] __schedule+0x1798/0x4cc0 [ 618.071467][ T31] ? __lock_acquire+0xab9/0xd20 [ 618.076429][ T31] ? __lock_acquire+0xab9/0xd20 [ 618.081399][ T31] ? __pfx___schedule+0x10/0x10 [ 618.086352][ T31] ? schedule+0x91/0x360 [ 618.090689][ T31] schedule+0x165/0x360 [ 618.095128][ T31] schedule_preempt_disabled+0x13/0x30 [ 618.100700][ T31] __mutex_lock+0x7e6/0x1350 [ 618.105383][ T31] ? __mutex_lock+0x5bb/0x1350 [ 618.110183][ T31] ? genl_rcv_msg+0x10d/0x790 [ 618.114931][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 618.119985][ T31] ? __dev_queue_xmit+0x27b/0x3b50 [ 618.125191][ T31] ? radix_tree_lookup+0x240/0x290 [ 618.130360][ T31] genl_rcv_msg+0x10d/0x790 [ 618.134926][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 618.139981][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 618.145085][ T31] ? __asan_memcpy+0x40/0x70 [ 618.149694][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 618.155112][ T31] netlink_rcv_skb+0x205/0x470 [ 618.159886][ T31] ? __lock_acquire+0xab9/0xd20 [ 618.164930][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 618.170001][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 618.175407][ T31] ? down_read+0x1ad/0x2e0 [ 618.179855][ T31] genl_rcv+0x28/0x40 [ 618.183913][ T31] netlink_unicast+0x82f/0x9e0 [ 618.188722][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 618.194118][ T31] ? netlink_sendmsg+0x642/0xb30 [ 618.199084][ T31] ? skb_put+0x11b/0x210 [ 618.203417][ T31] netlink_sendmsg+0x805/0xb30 [ 618.208221][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 618.213564][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 618.218538][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 618.223866][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 618.229267][ T31] __sock_sendmsg+0x21c/0x270 [ 618.234034][ T31] __sys_sendto+0x3bd/0x520 [ 618.238574][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 618.243699][ T31] ? count_memcg_event_mm+0x21/0x260 [ 618.249026][ T31] ? exc_page_fault+0x76/0xf0 [ 618.253784][ T31] ? do_user_addr_fault+0xc8a/0x1390 [ 618.259114][ T31] __x64_sys_sendto+0xde/0x100 [ 618.263961][ T31] do_syscall_64+0xfa/0x3b0 [ 618.268506][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 618.273775][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.279861][ T31] ? clear_bhb_loop+0x60/0xb0 [ 618.284587][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.290501][ T31] RIP: 0033:0x7f1e07990d5c [ 618.294999][ T31] RSP: 002b:00007f1e08877ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 618.303530][ T31] RAX: ffffffffffffffda RBX: 00007f1e08877fc0 RCX: 00007f1e07990d5c [ 618.311544][ T31] RDX: 000000000000001c RSI: 00007f1e08878010 RDI: 0000000000000008 [ 618.319719][ T31] RBP: 0000000000000000 R08: 00007f1e08877f14 R09: 000000000000000c [ 618.327760][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000008 [ 618.335999][ T31] R13: 00007f1e08877f68 R14: 00007f1e08878010 R15: 0000000000000000 [ 618.344059][ T31] [ 618.347101][ T31] INFO: task syz.2.3238:18461 blocked for more than 145 seconds. [ 618.354891][ T31] Not tainted syzkaller #0 [ 618.359828][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 618.368648][ T31] task:syz.2.3238 state:D stack:25864 pid:18461 tgid:18460 ppid:17803 task_flags:0x400140 flags:0x00004004 [ 618.380633][ T31] Call Trace: [ 618.384094][ T31] [ 618.387064][ T31] __schedule+0x1798/0x4cc0 [ 618.391584][ T31] ? __lock_acquire+0xab9/0xd20 [ 618.396478][ T31] ? __lock_acquire+0xab9/0xd20 [ 618.401343][ T31] ? __pfx___schedule+0x10/0x10 [ 618.406329][ T31] ? schedule+0x91/0x360 [ 618.410596][ T31] schedule+0x165/0x360 [ 618.414828][ T31] schedule_preempt_disabled+0x13/0x30 [ 618.420323][ T31] __mutex_lock+0x7e6/0x1350 [ 618.424984][ T31] ? __mutex_lock+0x5bb/0x1350 [ 618.429777][ T31] ? genl_rcv_msg+0x10d/0x790 [ 618.434502][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 618.439535][ T31] ? __dev_queue_xmit+0x27b/0x3b50 [ 618.444788][ T31] ? radix_tree_lookup+0x240/0x290 [ 618.449959][ T31] genl_rcv_msg+0x10d/0x790 [ 618.454522][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 618.459565][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 618.464651][ T31] ? __asan_memcpy+0x40/0x70 [ 618.469248][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 618.474722][ T31] netlink_rcv_skb+0x205/0x470 [ 618.479552][ T31] ? __lock_acquire+0xab9/0xd20 [ 618.484501][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 618.489564][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 618.495207][ T31] ? down_read+0x1ad/0x2e0 [ 618.499669][ T31] genl_rcv+0x28/0x40 [ 618.503747][ T31] netlink_unicast+0x82f/0x9e0 [ 618.508557][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 618.513910][ T31] ? netlink_sendmsg+0x642/0xb30 [ 618.518880][ T31] ? skb_put+0x11b/0x210 [ 618.523251][ T31] netlink_sendmsg+0x805/0xb30 [ 618.528119][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 618.533486][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 618.538468][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 618.543815][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 618.549130][ T31] __sock_sendmsg+0x21c/0x270 [ 618.553881][ T31] __sys_sendto+0x3bd/0x520 [ 618.558414][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 618.563528][ T31] ? count_memcg_event_mm+0x21/0x260 [ 618.568864][ T31] ? exc_page_fault+0x76/0xf0 [ 618.573752][ T31] ? do_user_addr_fault+0xc8a/0x1390 [ 618.579157][ T31] __x64_sys_sendto+0xde/0x100 [ 618.584048][ T31] do_syscall_64+0xfa/0x3b0 [ 618.588603][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 618.593901][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.600000][ T31] ? clear_bhb_loop+0x60/0xb0 [ 618.604761][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.610696][ T31] RIP: 0033:0x7fd8bcb90d5c [ 618.615200][ T31] RSP: 002b:00007fd8badf4ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 618.623693][ T31] RAX: ffffffffffffffda RBX: 00007fd8badf4fc0 RCX: 00007fd8bcb90d5c [ 618.631691][ T31] RDX: 000000000000001c RSI: 00007fd8badf5010 RDI: 0000000000000006 [ 618.639824][ T31] RBP: 0000000000000000 R08: 00007fd8badf4f14 R09: 000000000000000c [ 618.647870][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000006 [ 618.656007][ T31] R13: 00007fd8badf4f68 R14: 00007fd8badf5010 R15: 0000000000000000 [ 618.664076][ T31] [ 618.667148][ T31] [ 618.667148][ T31] Showing all locks held in the system: [ 618.675074][ T31] 1 lock held by khungtaskd/31: [ 618.679941][ T31] #0: ffffffff8e13a0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 618.689882][ T31] 2 locks held by getty/5627: [ 618.694636][ T31] #0: ffff88803351b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 618.704483][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 618.714662][ T31] 4 locks held by kworker/u8:9/9374: [ 618.719981][ T31] #0: ffff88801b2fe948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 618.730994][ T31] #1: ffffc9001add7bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 618.741689][ T31] #2: ffffffff8f52df10 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 618.751131][ T31] #3: ffffffff8f80a828 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 618.761662][ T31] 3 locks held by kworker/0:14/12264: [ 618.767088][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 618.778211][ T31] #1: ffffc9000aca7bc0 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 618.791824][ T31] #2: ffffffff8f80a828 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 [ 618.803282][ T31] 2 locks held by syz-executor/18203: [ 618.808692][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 618.817210][ T31] #1: ffffffff8f80a828 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_open+0x12d/0x820 [ 618.827318][ T31] 2 locks held by syz.3.3221/18377: [ 618.832532][ T31] #0: ffff88805c427100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 [ 618.842344][ T31] #1: ffffffff8f80a828 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 618.852556][ T31] 2 locks held by syz.3.3221/18382: [ 618.857866][ T31] #0: ffffffff8f80a828 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_write+0x191/0x570 [ 618.868054][ T31] #1: ffff88805c427100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 [ 618.877781][ T31] 3 locks held by syz.0.3230/18423: [ 618.882979][ T31] #0: ffffffff8f5a08d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 618.891289][ T31] #1: ffffffff8f5a06e8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 618.900435][ T31] #2: ffffffff8f80a828 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 618.910439][ T31] 2 locks held by syz.1.3234/18445: [ 618.915725][ T31] #0: ffffffff8f5a08d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 618.924001][ T31] #1: ffffffff8f5a06e8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 618.933048][ T31] 2 locks held by syz.2.3238/18461: [ 618.938300][ T31] #0: ffffffff8f5a08d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 618.946569][ T31] #1: ffffffff8f5a06e8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 618.955744][ T31] 1 lock held by syz-executor/18464: [ 618.961056][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 618.969661][ T31] 1 lock held by syz-executor/18467: [ 618.975683][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 618.984479][ T31] 1 lock held by syz-executor/18468: [ 618.989963][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 618.998507][ T31] 1 lock held by syz-executor/18470: [ 619.003872][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.012344][ T31] 1 lock held by syz-executor/18475: [ 619.017717][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.026256][ T31] 1 lock held by syz-executor/18477: [ 619.031556][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.040097][ T31] 1 lock held by syz-executor/18480: [ 619.045578][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.054287][ T31] 1 lock held by syz-executor/18481: [ 619.059600][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.068303][ T31] 1 lock held by syz-executor/18483: [ 619.073627][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.082138][ T31] 1 lock held by syz-executor/18488: [ 619.087513][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.096061][ T31] 1 lock held by syz-executor/18490: [ 619.101391][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.109893][ T31] 1 lock held by syz-executor/18493: [ 619.115262][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.123892][ T31] 1 lock held by syz-executor/18494: [ 619.129189][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.138021][ T31] 1 lock held by syz-executor/18496: [ 619.143390][ T31] #0: ffffffff8e9c2788 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 619.151916][ T31] [ 619.154381][ T31] ============================================= [ 619.154381][ T31] [ 619.162804][ T31] NMI backtrace for cpu 1 [ 619.162819][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 619.162837][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 619.162847][ T31] Call Trace: [ 619.162853][ T31] [ 619.162861][ T31] dump_stack_lvl+0x189/0x250 [ 619.162885][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 619.162903][ T31] ? __pfx__printk+0x10/0x10 [ 619.162933][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 619.162960][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 619.162985][ T31] ? __pfx__printk+0x10/0x10 [ 619.163009][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 619.163034][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 619.163061][ T31] watchdog+0xf93/0xfe0 [ 619.163085][ T31] ? watchdog+0x1de/0xfe0 [ 619.163110][ T31] kthread+0x70e/0x8a0 [ 619.163137][ T31] ? __pfx_watchdog+0x10/0x10 [ 619.163162][ T31] ? __pfx_kthread+0x10/0x10 [ 619.163187][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 619.163207][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 619.163228][ T31] ? __pfx_kthread+0x10/0x10 [ 619.163255][ T31] ret_from_fork+0x439/0x7d0 [ 619.163279][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 619.163317][ T31] ? __switch_to_asm+0x39/0x70 [ 619.163342][ T31] ? __switch_to_asm+0x33/0x70 [ 619.163367][ T31] ? __pfx_kthread+0x10/0x10 [ 619.163394][ T31] ret_from_fork_asm+0x1a/0x30 [ 619.163440][ T31] [ 619.303976][ T31] Sending NMI from CPU 1 to CPUs 0: [ 619.309410][ C0] NMI backtrace for cpu 0 [ 619.309429][ C0] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) [ 619.309450][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 619.309463][ C0] Workqueue: events_unbound toggle_allocation_gate [ 619.309493][ C0] RIP: 0010:lock_release+0x2cd/0x3e0 [ 619.309521][ C0] Code: 56 f7 c3 00 02 00 00 74 01 fb 65 48 8b 05 db fd 00 11 48 3b 44 24 28 0f 85 8b 00 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f <5d> e9 bd 49 d9 09 cc 90 0f 0b 90 e9 5d fd ff ff 90 0f 0b 90 48 c7 [ 619.309543][ C0] RSP: 0018:ffffc900001176b0 EFLAGS: 00000286 [ 619.309559][ C0] RAX: b1b407c765c37500 RBX: 0000000000000001 RCX: b1b407c765c37500 [ 619.309572][ C0] RDX: 0000000000000005 RSI: ffffffff8dba022c RDI: ffffffff8be33f80 [ 619.309584][ C0] RBP: ffff88801ce9e5b8 R08: ffff88801a47b063 R09: 1ffff1100348f60c [ 619.309598][ C0] R10: dffffc0000000000 R11: ffffed100348f60d R12: dffffc0000000000 [ 619.309612][ C0] R13: ffff88801a47c558 R14: 0000000000000200 R15: ffffffff82186fba [ 619.309625][ C0] FS: 0000000000000000(0000) GS:ffff888125c39000(0000) knlGS:0000000000000000 [ 619.309640][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 619.309653][ C0] CR2: 00007fa94e88ed4e CR3: 000000000df36000 CR4: 00000000003526f0 [ 619.309669][ C0] Call Trace: [ 619.309676][ C0] [ 619.309685][ C0] __text_poke+0x83e/0xa10 [ 619.309713][ C0] ? __pfx_text_poke_memcpy+0x10/0x10 [ 619.309736][ C0] ? __kvmalloc_node_noprof+0x17a/0x5f0 [ 619.309762][ C0] ? __pfx___text_poke+0x10/0x10 [ 619.309782][ C0] ? rcu_is_watching+0x15/0xb0 [ 619.309799][ C0] ? trace_contention_end+0x39/0x120 [ 619.309824][ C0] smp_text_poke_batch_finish+0x90a/0x1130 [ 619.309856][ C0] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 619.309883][ C0] ? arch_jump_label_transform_queue+0x97/0x110 [ 619.309918][ C0] arch_jump_label_transform_apply+0x1c/0x30 [ 619.309945][ C0] static_key_disable_cpuslocked+0xc5/0x1b0 [ 619.309974][ C0] static_key_disable+0x1a/0x20 [ 619.309998][ C0] toggle_allocation_gate+0x1a1/0x240 [ 619.310023][ C0] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 619.310048][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 619.310081][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 619.310109][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 619.310137][ C0] process_scheduled_works+0xae1/0x17b0 [ 619.310182][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 619.310221][ C0] worker_thread+0x8a0/0xda0 [ 619.310253][ C0] kthread+0x70e/0x8a0 [ 619.310275][ C0] ? __pfx_worker_thread+0x10/0x10 [ 619.310293][ C0] ? __pfx_kthread+0x10/0x10 [ 619.310315][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 619.310333][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 619.310351][ C0] ? __pfx_kthread+0x10/0x10 [ 619.310372][ C0] ret_from_fork+0x439/0x7d0 [ 619.310391][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 619.310411][ C0] ? __switch_to_asm+0x39/0x70 [ 619.310433][ C0] ? __switch_to_asm+0x33/0x70 [ 619.310454][ C0] ? __pfx_kthread+0x10/0x10 [ 619.310475][ C0] ret_from_fork_asm+0x1a/0x30 [ 619.310507][ C0] [ 619.311432][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 619.619865][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 619.628995][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 619.639156][ T31] Call Trace: [ 619.642456][ T31] [ 619.645415][ T31] dump_stack_lvl+0x99/0x250 [ 619.650027][ T31] ? __asan_memcpy+0x40/0x70 [ 619.654626][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 619.659837][ T31] ? __pfx__printk+0x10/0x10 [ 619.664451][ T31] vpanic+0x281/0x750 [ 619.668460][ T31] ? __pfx_vpanic+0x10/0x10 [ 619.672979][ T31] ? preempt_schedule+0xae/0xc0 [ 619.677942][ T31] ? preempt_schedule_common+0x83/0xd0 [ 619.683440][ T31] panic+0xb9/0xc0 [ 619.687196][ T31] ? __pfx_panic+0x10/0x10 [ 619.691628][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 619.697026][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 619.703299][ T31] watchdog+0xfd2/0xfe0 [ 619.707492][ T31] ? watchdog+0x1de/0xfe0 [ 619.711849][ T31] kthread+0x70e/0x8a0 [ 619.715938][ T31] ? __pfx_watchdog+0x10/0x10 [ 619.720648][ T31] ? __pfx_kthread+0x10/0x10 [ 619.725311][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 619.730539][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 619.735767][ T31] ? __pfx_kthread+0x10/0x10 [ 619.740629][ T31] ret_from_fork+0x439/0x7d0 [ 619.745265][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 619.750426][ T31] ? __switch_to_asm+0x39/0x70 [ 619.755220][ T31] ? __switch_to_asm+0x33/0x70 [ 619.760010][ T31] ? __pfx_kthread+0x10/0x10 [ 619.764641][ T31] ret_from_fork_asm+0x1a/0x30 [ 619.769464][ T31] [ 619.772879][ T31] Kernel Offset: disabled [ 619.777233][ T31] Rebooting in 86400 seconds..