last executing test programs: 4m30.035449505s ago: executing program 3 (id=3264): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000640)=ANY=[@ANYRESDEC], 0x0, 0x52}, 0x28) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$igmp(0x2, 0x3, 0x2) (async, rerun: 32) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18efff00070000000077aff9a40000009500000000000000"], &(0x7f0000000580)='GPL\x00'}, 0x90) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000500)={r2, 0x2000000, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000180)=@nat={'nat\x00', 0x670, 0x5, 0x440, 0x220, 0x2f0, 0xfeffffff, 0xf8, 0x2f0, 0x3c8, 0x3c8, 0xffffffff, 0x3c8, 0x3c8, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'caif0\x00', {}, {}, 0x6}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0x6}}]}, @common=@inet=@TCPMSS={0x28}}, {{@uncond, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@set={{0x40}}, @common=@set={{0x40}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @gre_key=0x6, @port=0x4e24}}}}, {{@ip={@loopback, @rand_addr, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00'}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @gre_key=0x1, @port=0x4e24}}}}, {{@ip={@local, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@private2, @ipv4=@multicast1, @port, @gre_key}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4a0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000007, 0x204031, 0xffffffffffffffff, 0x94c1c000) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03000000040000000400000009"], 0x48) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x18, 0x7, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000218100000", @ANYRES32=r4, @ANYBLOB="000000000000000018100000", @ANYRES32=r5, @ANYBLOB="000000000000000095"], &(0x7f0000000a00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) (async) r7 = socket$can_bcm(0x1d, 0x2, 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001640)={&(0x7f0000000000)=@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4008000}, 0x28008841) (async) connect$can_bcm(r7, &(0x7f0000001ff0)={0x1d, r9}, 0x10) (async) sendmsg$can_raw(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000ff0)={&(0x7f0000000140)=@canfd={{0x1}, 0xf8, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5ee00000000000000004e2f9663a918fa1efd9b0b"}, 0x48}, 0xee, 0x0, 0x0, 0x44041}, 0x84841) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={r6, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000034d, &(0x7f0000001d00), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5400000010000304000000000000000000000420", @ANYRES32=0x0, @ANYBLOB="00030000000000002c0012800b00010062726964676500001c00028008000500010000000500250001000000050029000000000008000a00", @ANYRES32=r10], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8044) (async) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a2, &(0x7f0000000200)='bridge0\x00') (async, rerun: 64) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000680)={0x164, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0x152, 0x0, 0x0, 0x1, [@typed={0x5a, 0x2, 0x0, 0x0, @binary="df320d8d3c008a051312ff94b2f68ad97abe00b6482a739e743c4275d4c7d2fb684e57ac898461c74a04e8aedffbf8b591480b011d9711a6bf770b5f10544f74e407d916c4de7b1f53701eddd30e23e6623aeefb311b"}, @typed={0x14, 0x15d, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f"]}]}, 0x164}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async, rerun: 64) r11 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r11, 0x6, 0x23, &(0x7f0000000040), &(0x7f0000000200)=0x38) (async) syz_emit_ethernet(0x32, &(0x7f0000000040)={@local, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x88, 0x0, @empty}, {0x0, 0x0, 0x8, 0x0, @gue={{0x2}}}}}}}, 0x0) (async, rerun: 64) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001a000000060001001b00200008000a00000000000000"], 0x24}}, 0x0) (async, rerun: 64) socket(0xa, 0x3, 0xff) 4m29.700250522s ago: executing program 3 (id=3265): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/cgroup\x00') ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6(0xa, 0x3, 0x8000000003c) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$kcm(0x2, 0x5, 0x84) socket$kcm(0x10, 0x2, 0x4) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c00000010000304003f0006000000005dcc0300", @ANYRES32=r2, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x60}, 0x0) 4m29.050610726s ago: executing program 3 (id=3270): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000037c00000400c2800c000180060006008847"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000072000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r1, 0xe8, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffad, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0xfffffffffffffe6b, 0x0, 0x0, 0xfffffd3a, 0x10, 0x0, 0x0, 0x0}}, 0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b706000008ffffffcc6400000000000045020400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b50000000000000095000000000000008e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8877a6db61d69f2ffcaa10350e11cb97ce8df1bc9a0c4eeceb9971e43405d621ffbc9b0d8ca56b50f0c010ddb03cf1c62d57c08a90b189d190c341035de53a9a53608c10556e5734eb84049761451ce540c772e069f80cb201b2de17dfdb4b60939d5d6aed4062049b87e03e2cd18a79ada613e0c64497fcc059c5f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8000000000000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b59b0fc46d6cec3c080a882add4e1179bd4a44f231a2d73148be428ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286ccca37db965d9dd366598f5ec993cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100bd5828954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e113e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6fc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3eeec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e01506471e897bced7798509e64df360d95f9a4099f86438ac2bbcbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb469922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c710bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b378ab0d529ea4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03444471c1dd660c73acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90106248f81d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f86f276afb2b8134301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3bd9b1d742e334319c8979c322e92fbc2c400"/1409], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x42) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000037c00000400c2800c000180060006008847"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000072000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r1, 0xe8, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffad, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0xfffffffffffffe6b, 0x0, 0x0, 0xfffffd3a, 0x10, 0x0, 0x0, 0x0}}, 0x7) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b706000008ffffffcc6400000000000045020400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b50000000000000095000000000000008e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8877a6db61d69f2ffcaa10350e11cb97ce8df1bc9a0c4eeceb9971e43405d621ffbc9b0d8ca56b50f0c010ddb03cf1c62d57c08a90b189d190c341035de53a9a53608c10556e5734eb84049761451ce540c772e069f80cb201b2de17dfdb4b60939d5d6aed4062049b87e03e2cd18a79ada613e0c64497fcc059c5f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8000000000000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b59b0fc46d6cec3c080a882add4e1179bd4a44f231a2d73148be428ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286ccca37db965d9dd366598f5ec993cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100bd5828954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e113e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6fc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3eeec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e01506471e897bced7798509e64df360d95f9a4099f86438ac2bbcbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb469922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c710bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b378ab0d529ea4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03444471c1dd660c73acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90106248f81d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f86f276afb2b8134301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3bd9b1d742e334319c8979c322e92fbc2c400"/1409], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x42) (async) 4m28.433434639s ago: executing program 3 (id=3273): r0 = socket(0x10, 0x803, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) unshare(0x26020480) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000080), &(0x7f0000000000)=0x4e) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r4, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000000c0)='%+9llu \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={r5}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r4}, 0x4) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000a80), r1) sendmsg$NFC_CMD_ACTIVATE_TARGET(r2, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000ac0)={0x1c, r6, 0x1, 0x70bd29, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40c0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) r8 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r8, &(0x7f0000000040)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x5c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x6}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_CT_LABELS_MASK={0x14, 0x62, "387b14504f7f87a31d988f9cfbc27600"}, @TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "8564dfb97f55762572ae0f4676265a9b"}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004884}, 0x24040084) r9 = socket$pptp(0x18, 0x1, 0x2) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r11, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x7, 0x0, 0x3, "42b872"}}) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x84, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x40, 0x12, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0xd236}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_BURST={0x8, 0x3, 0x1, 0x0, 0x3}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0xcc}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) write$nci(r9, &(0x7f00000000c0)=@NCI_OP_CORE_CONN_CREDITS_NTF={0x0, 0x1, 0x3, 0x6, 0x4, {0x1, [{0x4, 0x8d}]}}, 0x6) bind$pptp(r9, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61158c000000000061134c0000000000bfa00000000000000705000008004ef02d3501000000000095000000000000006916000000000000bf67000000000000350605000fff07206706000006000000160302000ee60060bf500000000000001f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9d0cc7d3b4814261bdb94a050000a28a404be266df76965947c73c00c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b540dcfc7ad0500c4063b3b8754c0686cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e567238809000000000000000ae2fb494059bba8e3b680324a188090eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb40000000000000000000000000040007abf9c20d89cbc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d2538808"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xae, '\x00', 0x0, @fallback=0x4}, 0x94) r12 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_generic(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000002f00090073cc72e16accbe0a040000002a0011802e"], 0x40}, 0x1, 0x0, 0x0, 0x2004e884}, 0x0) 4m27.531498672s ago: executing program 3 (id=3279): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/cgroup\x00') ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6(0xa, 0x3, 0x8000000003c) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$kcm(0x2, 0x5, 0x84) socket$kcm(0x10, 0x2, 0x4) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000306000000005dcc0300", @ANYRES32=r2, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x60}, 0x0) 4m27.125558982s ago: executing program 3 (id=3281): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x6) syz_emit_ethernet(0x32, &(0x7f00000002c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa080045000024fffd000000119078ac1e0001e0000001000017c100e9cb7801000000d482449a"], 0x0) socket$kcm(0xa, 0x3, 0x87) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) sendmmsg$unix(r0, &(0x7f00000bd000), 0x2d, 0x20040040) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000080)={0x10000005}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x68, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_TX_RATES={0xc, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8, 0x300, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}]}]}]}, 0x68}}, 0x850) close(0x3) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r8, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bind$tipc(r8, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x10000000}}, 0x10) bind$tipc(r8, &(0x7f0000000240)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1}}}, 0x10) r9 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r9, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r10 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r10, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x3, {{0x42, 0x3}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f0000000b00)=@broute={'broute\x00', 0x20, 0x4, 0x630, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000004c0], 0x0, &(0x7f0000000000), &(0x7f00000004c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{0x9, 0x1b, 0x86dd, 'veth1_macvtap\x00', 'veth0_to_batadv\x00', 'geneve0\x00', 'wlan0\x00', @empty, [0x0, 0x0, 0x0, 0xff, 0xff], @random="954d9c4939b2", [0x0, 0xff, 0x0, 0xff, 0xff], 0xa6, 0xd6, 0x106, [@realm={{'realm\x00', 0x0, 0x10}, {{0x0, 0xbe3, 0x1}}}], [@common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x1ff}}}], @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}}, {0x3, 0x2, 0x8914, 'veth0_to_batadv\x00', 'syzkaller0\x00', 'batadv0\x00', 'dvmrp1\x00', @broadcast, [], @empty, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], 0x116, 0x17e, 0x1ce, [@physdev={{'physdev\x00', 0x0, 0x48}, {{'veth0_macvtap\x00', {0xff}, 'macvlan0\x00', {}, 0x13, 0x4}}}, @cluster={{'cluster\x00', 0x0, 0x10}, {{0x9, 0xa50, 0x7fff}}}], [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0xb}}}, @common=@mark={'mark\x00', 0x10, {{0xfffffff0, 0xfffffffffffffffe}}}], @common=@log={'log\x00', 0x28, {{0x1, "1fe90c281c12456eb599015d22b1a94aba260759ea41570d079b2aad9be0"}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x2, [{0x11, 0x74, 0x805, 'ip6tnl0\x00', 'batadv_slave_0\x00', 'pimreg\x00', 'syzkaller0\x00', @random="7a2a4fbd8b6f", [0x0, 0x0, 0x0, 0xff, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], 0xee, 0x16e, 0x1e6, [@nfacct={{'nfacct\x00', 0x0, 0x28}, {{'syz0\x00', 0x80000000}}}, @state={{'state\x00', 0x0, 0x8}, {{0x2}}}], [@common=@dnat={'dnat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x10}}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x1, 0x5, {0x9}}}}], @common=@NFLOG={'NFLOG\x00', 0x50, {{0x34cc, 0x1, 0x7, 0x0, 0x0, "febbdb7cfa75fd035dbe64742b4e989828e41a1309499a052a1aa23de2000abab9da44159ef96a0d35f98a37beaa62ca522341fa3a136b90b8401c708b19d899"}}}}, {0x9, 0x74, 0x88b5, 'veth1_virt_wifi\x00', 'veth1_vlan\x00', 'ip_vti0\x00', 'dvmrp0\x00', @remote, [0xff, 0xff, 0x0, 0xff], @broadcast, [0xff, 0xff, 0x0, 0x0, 0xff], 0x6e, 0x6e, 0xe6, [], [], @common=@nflog={'nflog\x00', 0x50, {{0xf, 0x5, 0x3, 0x0, 0x0, "1d4adb90d1da63c5d8917cd1cfdd2ebb8ae2adbe079b232d3343ec6a78653cff640471e7fad546f6b8251c28a0e3fd86fc7c06c263b380db07d6be56d139dbcf"}}}}]}, {0x0, '\x00', 0x4, 0xfffffffffffffffc}]}, 0x6a8) 4m12.0703266s ago: executing program 32 (id=3281): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x6) syz_emit_ethernet(0x32, &(0x7f00000002c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa080045000024fffd000000119078ac1e0001e0000001000017c100e9cb7801000000d482449a"], 0x0) socket$kcm(0xa, 0x3, 0x87) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) sendmmsg$unix(r0, &(0x7f00000bd000), 0x2d, 0x20040040) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000080)={0x10000005}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x68, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_TX_RATES={0xc, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8, 0x300, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}]}]}]}, 0x68}}, 0x850) close(0x3) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r8, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bind$tipc(r8, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x10000000}}, 0x10) bind$tipc(r8, &(0x7f0000000240)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1}}}, 0x10) r9 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r9, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r10 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r10, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x3, {{0x42, 0x3}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f0000000b00)=@broute={'broute\x00', 0x20, 0x4, 0x630, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000004c0], 0x0, &(0x7f0000000000), &(0x7f00000004c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{0x9, 0x1b, 0x86dd, 'veth1_macvtap\x00', 'veth0_to_batadv\x00', 'geneve0\x00', 'wlan0\x00', @empty, [0x0, 0x0, 0x0, 0xff, 0xff], @random="954d9c4939b2", [0x0, 0xff, 0x0, 0xff, 0xff], 0xa6, 0xd6, 0x106, [@realm={{'realm\x00', 0x0, 0x10}, {{0x0, 0xbe3, 0x1}}}], [@common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x1ff}}}], @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}}, {0x3, 0x2, 0x8914, 'veth0_to_batadv\x00', 'syzkaller0\x00', 'batadv0\x00', 'dvmrp1\x00', @broadcast, [], @empty, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], 0x116, 0x17e, 0x1ce, [@physdev={{'physdev\x00', 0x0, 0x48}, {{'veth0_macvtap\x00', {0xff}, 'macvlan0\x00', {}, 0x13, 0x4}}}, @cluster={{'cluster\x00', 0x0, 0x10}, {{0x9, 0xa50, 0x7fff}}}], [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0xb}}}, @common=@mark={'mark\x00', 0x10, {{0xfffffff0, 0xfffffffffffffffe}}}], @common=@log={'log\x00', 0x28, {{0x1, "1fe90c281c12456eb599015d22b1a94aba260759ea41570d079b2aad9be0"}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x2, [{0x11, 0x74, 0x805, 'ip6tnl0\x00', 'batadv_slave_0\x00', 'pimreg\x00', 'syzkaller0\x00', @random="7a2a4fbd8b6f", [0x0, 0x0, 0x0, 0xff, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], 0xee, 0x16e, 0x1e6, [@nfacct={{'nfacct\x00', 0x0, 0x28}, {{'syz0\x00', 0x80000000}}}, @state={{'state\x00', 0x0, 0x8}, {{0x2}}}], [@common=@dnat={'dnat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x10}}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x1, 0x5, {0x9}}}}], @common=@NFLOG={'NFLOG\x00', 0x50, {{0x34cc, 0x1, 0x7, 0x0, 0x0, "febbdb7cfa75fd035dbe64742b4e989828e41a1309499a052a1aa23de2000abab9da44159ef96a0d35f98a37beaa62ca522341fa3a136b90b8401c708b19d899"}}}}, {0x9, 0x74, 0x88b5, 'veth1_virt_wifi\x00', 'veth1_vlan\x00', 'ip_vti0\x00', 'dvmrp0\x00', @remote, [0xff, 0xff, 0x0, 0xff], @broadcast, [0xff, 0xff, 0x0, 0x0, 0xff], 0x6e, 0x6e, 0xe6, [], [], @common=@nflog={'nflog\x00', 0x50, {{0xf, 0x5, 0x3, 0x0, 0x0, "1d4adb90d1da63c5d8917cd1cfdd2ebb8ae2adbe079b232d3343ec6a78653cff640471e7fad546f6b8251c28a0e3fd86fc7c06c263b380db07d6be56d139dbcf"}}}}]}, {0x0, '\x00', 0x4, 0xfffffffffffffffc}]}, 0x6a8) 5.973093837s ago: executing program 5 (id=5802): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000080)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x19}, 0xfffffffd}, 0x1c, 0x0}, 0xc4) socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000380)='ns/ipc\x00') unshare(0x6a040000) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000f2ffffff0000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r2, 0x4000000, 0xe, 0x0, &(0x7f0000000040)="976d9023d56482cd284a63da5397", 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)="bf049fd184f7b03c21d9bcddc4eef9ebb6a0da3eb91c5645", 0x0, 0x8000}, 0x50) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000040)={r1}) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000074f6967d00000000000000180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000000000600150005000000280016800c0001"], 0x4c}}, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r1, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x2000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x5, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000456d9dee5713be00020000008d261000040000009500000000000000d37fdedd955c81fcbe208cebace322c8d9c834e0455db87d6872de0d39d39d419965d76d83aea66bdfef4ef624f37900827e6c7815ecbd4356f650a0ae43b86962a812a33208dd2ed69584cf44706374479582758930bc60d410c871000000000000000000000016f75f698af74d37ef2826e8edd7874b128a2412688a9420df2e3a37d3861e321b4876150e1582942d31c9868428183b0bd6cf8656191e09b7bd4b0e8dbc44c21c2d1df01b35c4a888f42569e2e6f1673fc2a3616452e25699b5ffd2a506b0c8b4d66eb0bbba42e0456ce2631d9af2b7aafd9450e1d331ae24d0447672095b5db3a9fc5f013a4ec2b205ac2e1f901747429dc42e940b4222334a8560210254a53a44e4c3bc081b6af8"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r5, 0x0) socket$kcm(0x10, 0x2, 0x0) unshare(0x26020480) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xee, 0x4000004) socket$phonet_pipe(0x23, 0x5, 0x2) 4.812241413s ago: executing program 0 (id=5808): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}}], {0x14}}, 0x3c}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) 4.728936593s ago: executing program 0 (id=5811): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x8000010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@newtaction={0x60, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_tunnel_key={0x48, 0x1, 0x0, 0x0, {{0xf}, {0x18, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @local}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}}, 0x80) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xf}, 0xa) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c0009"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000a00)=@newtaction={0x88c, 0x30, 0xffff, 0xfffffffe, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1000, 0xffff, 0xd, 0x81, 0x7, 0x6, 0x7, 0x9, 0x4, 0x4, 0x6, 0x3, 0x5, 0x3, 0x6, 0x6, 0xffff, 0x1, 0x4, 0x6, 0x0, 0x5, 0xb, 0x6b, 0x5, 0x2, 0x62, 0x9, 0xfffffff8, 0x6338, 0x70, 0x7, 0x9, 0x8, 0x9, 0x7, 0x80000000, 0x7, 0xfff, 0x2, 0x9, 0xfffffff9, 0x6, 0xfffffffe, 0x600000, 0x6, 0x1, 0x8, 0x1, 0xbc0, 0x9bf1, 0x5, 0x2, 0x0, 0xe, 0x9, 0x1ff, 0xb9, 0xc741, 0x6, 0x5, 0x1, 0xed, 0x1, 0x8001, 0xb, 0x5b96, 0xffff, 0x2, 0x20000000, 0xff, 0x1, 0x4, 0x9, 0x401, 0x2, 0x1000, 0x101, 0x50, 0x4, 0xffffffff, 0x1, 0x1, 0x5, 0x7, 0x8a6b, 0xfffffbff, 0x4, 0x2, 0x1, 0x5, 0x6, 0x2, 0x5, 0xffffffff, 0x80, 0x10000008, 0x0, 0x8, 0xfffffff4, 0x3b98, 0xfffff800, 0x8, 0x3, 0x2000f, 0xf8b, 0x10001, 0x3, 0x2, 0xa78, 0x3, 0xcb0, 0x6, 0x9, 0x9, 0x0, 0x7, 0x80000001, 0x7, 0x9, 0x0, 0x40, 0x8, 0x8, 0x5, 0x7, 0xaa92, 0x800, 0x3, 0x9, 0x10001, 0x9, 0x1, 0xd12, 0x0, 0x23487474, 0x3cce, 0x0, 0x7, 0x6, 0x5, 0xb1, 0x2, 0x6, 0x9, 0x2, 0xaa83, 0x40, 0xff, 0x9, 0x9, 0x1, 0x5, 0x0, 0x2, 0x1, 0x4, 0x9, 0x4, 0x2, 0x4, 0xffffffff, 0x1, 0xd76a, 0x6, 0xfffffff6, 0x4, 0xfffffffe, 0xfffffffd, 0xfffffffc, 0x50, 0x7359, 0x8, 0x7, 0xb, 0xa, 0x2d5, 0x6, 0xf, 0x1, 0x773a, 0x6b7b, 0x10001, 0x3, 0x4, 0x5, 0x7, 0x4, 0x800, 0x2, 0x5, 0x0, 0x6, 0x3ff, 0x9, 0x5, 0x5, 0xfff, 0x7, 0x8, 0xffff, 0x3, 0x4, 0xa, 0xae2b, 0x1, 0x6, 0x1a71, 0x0, 0x10001000, 0x0, 0x3, 0x7, 0x1, 0x1, 0x3c34, 0x6, 0x10000, 0x5, 0x100, 0x0, 0x8, 0x3, 0x3, 0xc, 0x100, 0x0, 0x2, 0xb, 0x5, 0xc8, 0x557c, 0x9, 0x8, 0x9, 0x3, 0x80, 0x8000, 0x7bc, 0x1, 0x8, 0x6, 0xe, 0x5, 0xfff, 0x9, 0x5, 0x279, 0x8000, 0x8, 0x5, 0x1, 0x80000000, 0x3, 0x9, 0x1ff]}, @TCA_POLICE_RATE={0x404, 0x2, [0x2, 0x9, 0xd, 0x7, 0x9, 0x6, 0x0, 0x10000004, 0x81, 0x1, 0x100, 0x7, 0x3f, 0x3, 0x8, 0xc, 0x2, 0x6, 0x6dbf, 0x8, 0x4, 0x12c, 0x3, 0x5, 0x5, 0x7, 0x100, 0x7, 0x8, 0x9, 0x0, 0x8df3, 0xffffffff, 0x200, 0xfffffffe, 0x328d, 0xfffffe01, 0x9, 0x8, 0x3, 0xffff8000, 0x4f, 0x0, 0xd, 0x3, 0x8000, 0x2, 0x17, 0x88, 0x8, 0xc, 0xffff, 0x0, 0x3, 0x2, 0x42f, 0xffffff2c, 0x5, 0xbd, 0xe0, 0x9, 0xc26, 0x8e, 0x6, 0x3, 0xe, 0x1, 0x800, 0x1bf, 0x4, 0x5, 0x4, 0x8, 0x7ce7c36c, 0x3, 0x1eb, 0x10001, 0x8, 0x5102, 0x6ce, 0x6, 0x8000, 0x2, 0x5, 0xfffffff9, 0x2, 0x4e30, 0x6, 0x6, 0x2, 0x90, 0x2, 0x2, 0xc80e, 0x4, 0x5, 0x450, 0xe0, 0x6, 0x5, 0xd, 0x5, 0x5, 0x9, 0x1045800, 0xfffffffd, 0xffffffde, 0x6a4, 0x5, 0x9, 0x6, 0x1f, 0xb89, 0x6, 0x7, 0x1ff, 0x6, 0xfffff77b, 0x3, 0xffffffff, 0xfffff400, 0x6, 0x6, 0x8, 0x9, 0x2, 0x7, 0x401, 0xa7d, 0x6, 0xfffff9f3, 0x1, 0x9, 0x1, 0xb4, 0x2, 0xc, 0x8, 0x7, 0x0, 0x5891, 0x8, 0x7, 0xb, 0x0, 0x8, 0xb, 0x0, 0xff, 0x4f, 0x8, 0x33f, 0x70fc7f4f, 0x0, 0x4, 0x0, 0xc, 0x9, 0x5, 0x6, 0x3, 0x2, 0x1, 0x0, 0x2c46512a, 0x7, 0x2640, 0x0, 0x10000, 0x0, 0x9, 0x3, 0x6, 0x7fffffff, 0xdc, 0x80000000, 0x26, 0xbb16, 0x2, 0x9, 0xbd1, 0x44, 0xffffff7f, 0xa3, 0x1, 0x4, 0x0, 0x3, 0x2, 0x5, 0x0, 0x9, 0x4, 0x4b, 0x1, 0x8000, 0x2, 0x4, 0x2e4, 0xc7, 0x4, 0x4, 0x2, 0x81, 0xff, 0x6, 0x1, 0x10, 0x6, 0x9, 0x1, 0x4e2, 0x104, 0x7, 0x3ff, 0x10000, 0x4, 0x1, 0x3, 0x800, 0x101, 0x800, 0x6, 0x9, 0x6, 0x101, 0x9, 0x9, 0x6, 0x800, 0x101, 0xf07, 0x0, 0x2, 0x81, 0xfff, 0x80000001, 0x8, 0x5, 0xee8, 0x1ff, 0x81, 0x24000, 0x6, 0x2, 0x2, 0x2, 0x10, 0x8001, 0xa, 0x8, 0x200, 0x6, 0x9, 0x7fff, 0x2]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0x4, 0x4, 0x2, 0x7, {0x3, 0x2, 0x4, 0x40, 0x6, 0x1ff}, {0x2, 0x0, 0x2, 0xcd4, 0x9, 0x8}, 0x0, 0x7ff}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x21, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x4, 0x2, 0x0, 0xe7, {[@timestamp={0x8, 0xa, 0x6, 0x6}]}}}}}}}, 0x0) 4.277466539s ago: executing program 2 (id=5815): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000600000000000000000000090200000004000000000300070000000000002e005f"], 0x0, 0x36, 0x0, 0x1}, 0x28) 4.141898234s ago: executing program 2 (id=5816): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000140)=0x80) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000a40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000a00)={&(0x7f0000000b00)=ANY=[@ANYBLOB="08e4cd2380ffcb77174bff374c8665080000abd090b3f969acca8832ef4549d778e6bfbd8fd90a6a230856a993640b3dc967a204752dd990f8f368e7618ea91db263b6f7392119bdb11d939b0e2214a76f19ac33e283ec12b3c8a87129b93bc4a3f28e85a789cdc3683d2688e765978f9aa086461c7f25610ed09ef4d25e408ab18762714c4c5b66b74333a54487700ece8ecc035fe8c48f1147dd4ea526ca18705bbbb787f871c0117c464c2d1f01cfcc3617a8c3567f2c790017b8a3601a71e8cf3709eeb13875ac7a55e17b1b8ca871bb3d37cfc62ff0a526873cc833bcd4c3c39cb6801b56494ee1e7827852892fab65c7b2c0084c277fdf59c6e5b5833fe4a33216f63916ec79dd99760346327197", @ANYRES16=0x0, @ANYBLOB="00012abd7000ffdbdf25890000000c009900000000007300000040061d80d402008005000700a2000000050009000000000005000900000000000500060000000000050009000100000005000b000100000084020d801c00018005000600010000001000020035193b1a29073c29513d2e2818000080140003000100060020010300090001800400010034000280050006000100000017000100026c1b1b006c916c183002a80b30040b060448000500040000000000080002004411381144000080210002005206184d21524f574716312f42002e311c190302284d3322023111320c00000005000700020000001200010012041236056c03360c48161b180100009c0000801400030092002e0b8100e9c6000101800400f7ab1f0002002c3828170d2f3022074044123f3925202322383a39323b22182a02000500070001000000050006000000000014000500010002000100feff81000000f500ffff0500040000000000050006000000000014000300a96207000800040006000200040000080500060009000000140003000500fdffb208f800f8ffbf970300a2c59c00018038000200031d1b400d0f2d38390d3e34353f4748483f21224aab10101434260e312d28173009260428431e2c212c512a1b553b001f38304f050006000000000014000100303048091b18243660240b0c05b5030b05000700020000003c0002004a22501f023a18412d105449132a0248371c294b4028204e2508554b151f01243c0135423b18270051092f3605252c40245630514e4e15289c00018005000600010000001900010048090306160c182448300c180130480b1236363636000000390002003856394f4350292a26414107483814363d44300d2b19302d080c535331540d2857231d400b1c11061f08140331303045354e371536000000370002002c364b16383f320153562f2f1b113811092a21552a1118322f512c4930032735272a4a3b1736285742313c06313e06205520360006000500c20000000c0003000300000000000000060005003d000000e80200800c00020008000000000000000400040005000a000000000004000400ac020d80180000801400050007006606eae0050002000d0000010900440002801a00020056050a0c16504f27321a384e08513215300e3e320d1a00000500040002000000140005000f000efb1a0c000401800300080003000500060001000000740002801400010048042430060320010612066c360648020500070000000000050006000000000005000700020000001400050025fff7ff0600090009009d000000ff002e000200553c344f4b302d1225143a1c2d38391010553d1e2c4c51261032510e062f502c050b09190d12482210380000280002800500040000000000140003000104ff070400050007000000030002000500060001000000ec0003803a0002001703483a4c072701473b002412202238503f0a33383a0140053c04312c1f06123ef1384c30563a1f4b205657113e143e5724561c09500000300002000134303f014f43170b49003b370816220717fa1a111f090d04033913261102045044573e4f444f27330c192114000500040009000e000700050005007f00020014000500050086070200090027f8ff000500010005000600000000000500060001000000200001000630303616050b6c1b06000c1618090b0b03480b02023016060109181b0002004503230e28021120413349251941094b1019314b41352800050006000200000028000280050004000200000014000300cf85faff010008002a9801000e000d00050006000100000074000180050004000200000038000200494c3708300a38332200303c3304380754421f3a0f33383039391c452b4f3102140f3a1f42229e333d0b1f4d05052e00013d1e111400030008000600780a03000700060004000a000500040000000000140005000000070010000000ffff00000800fbff28000380140005000700040003000e000200ea0a0400080005000600010000000500070000000000050009000000000005000800ee000000060005008100000004000400340000800c00020000040000000000000400040005000c000100000006000500d0000000050007008e00000006000500dd000000240000800600050042000000060005006d0000000500060000000000050006000100000028000080050008001700000005000a000000000006000500e70000000c0002000300000000000000dc001d801400008005000700ab00000005000900010000001400008005000b000000000005000b00000000000c00008006000500a90000004000008005000a000000000005000a00000000000c00030002000000000000000400040005000b000100000004000400060005000900000005000b00000000002000008006000500970000000c000200240f00000000000005000700360000003800008005000800ea00000005000c0000000000050006000000000005000b000000000005000a00010000000c000200ff000000000000000c00008005000a000100000038001d801800008004000400050009000100000005000c00010000001c00008005000900010000000600050071000000060005005500000094001d80200000800c000200000000000000000005000a0001000000050009000100000014000080050006000100000005000b00000000002000008006000500d300000005000600f90000000400040006000500610000001c00008005000800ed00000005000700de00000005000b00000000002000008005000a00010000000c000200050000000000000005000b0000000000"], 0x808}, 0x1, 0x0, 0x0, 0x8014}, 0x2c010) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@gettaction={0x1c, 0x5a, 0xc6b747b6bf1c6b95, 0x0, 0x0, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xffffffff}]}, 0x1c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000440)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01082cbd7000000000000b00000008000300", @ANYRES32=r5, @ANYBLOB="24005080040005000500020005"], 0x40}, 0x1, 0x0, 0x0, 0x44151}, 0x0) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000ac0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000100)={0x1c, r2, 0x20, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4050}, 0x4005) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002540)=ANY=[@ANYBLOB="380000003f0007010787700000000000017c00000400fc800c00018008000600", @ANYRES32=0x0, @ANYBLOB="0c000280050023000000000008000900", @ANYRES32=r1], 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 4.059823601s ago: executing program 2 (id=5817): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="b80000001900010000000000fddbdf25e00000010000000000000000000000002001000000060000000000000000000000000000000000000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0xb8}, 0x1, 0x0, 0x0, 0x37a5fce0bcf595dd}, 0x0) 3.993242235s ago: executing program 4 (id=5818): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000097000000000000000000001818110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000f8ff00007baaf8fe00000000bfa200000000000007020000f8fdffffb703000000000000b704000000000000b5001c008200000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000070000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.945605683s ago: executing program 2 (id=5819): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)={0x1c, 0x1, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x3}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4c000) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="08000000040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x14, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000304000000000000000000007400", @ANYRES32=r3, @ANYBLOB="0000000000000000240012800b000100627269646765000014000280060027000000000005002d"], 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000006c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xac, 0xac, 0x9, [@fwd={0x5}, @struct={0x1, 0x8, 0x0, 0x4, 0x1, 0x7, [{0x3, 0x4, 0x5}, {0x10, 0x1, 0xf52}, {0x6, 0x4, 0x3}, {0x1, 0x0, 0xfffffffe}, {0x3, 0x0, 0x8}, {0xa, 0x1, 0x9}, {0x10, 0x2, 0x4}, {0xc, 0x2, 0x1}]}, @int={0xd, 0x0, 0x0, 0x1, 0x0, 0x37, 0x0, 0x6e, 0x7}, @enum64={0x1, 0x0, 0x0, 0x13, 0x1, 0xc}, @ptr={0xb, 0x0, 0x0, 0x2, 0x5}, @restrict={0xa, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x5f, 0x5f, 0x5f, 0x30, 0x0, 0x61, 0x2e]}}, &(0x7f0000000440)=""/120, 0xcd, 0x78, 0x0, 0x4}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000640)={0x3, 0x4, 0x4, 0xa, 0x0, r1, 0x7, '\x00', r3, r4, 0x2, 0x2, 0x2}, 0x50) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x7, &(0x7f0000000000)=0x7, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="010000000400000008000000070000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="1800"/14, @ANYRESHEX, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r6 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r6, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1ff, 0x4) sendmmsg(r6, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES64=r6], 0x108}}], 0x1, 0xc040) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="1cef2dd49b9916094dcae2e2cc89d25975459efa83", @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32], 0x1c}}, 0x840) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x7c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0x2c, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x28, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x59}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}]}]}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xe4}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xffff, 0x8}, {0x2}}}, 0x24}}, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c800}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000b00000000000500000014000500200100000000000000000100000000001c00090008"], 0x4c}}, 0x40010) 3.915411489s ago: executing program 4 (id=5820): socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 64) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async, rerun: 64) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) (async) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0xac, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0x5, 0x6}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x54, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0xf}, @TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0xffffffff}, @TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x8}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0x1}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x100}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x4}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x1}, @TCA_FQ_CODEL_ECN={0x8}, @TCA_FQ_CODEL_CE_THRESHOLD_SELECTOR={0x5, 0xa, 0x7}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x1d, 0x407, 0x2, 0x0, 0x3, 0x4}}, {0x4}}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x200001d4}, 0x8840) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) (async) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000002c0)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(twofish-generic)\x00'}, 0x58) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x50) (async) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="181000000300000000007b2aa4f80a675d5d000000000000f8bef4b8cd0c1434cac65b85f3df5154589cc0d7d1be07fd1384d1fa05e984cc1a8cfb2939279d81bd6baca87f153c304562cb6501ab163a58b1425f91f2b2537fe53ff5adb9ab4e0a602dfff722dc1b927a4c06ca36d7ddac9f14b973ee0ead479b6a4211556cc078613875d706000000000000b3ccf10944"], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x15, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702", @ANYRES32=r4, @ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f00000021c0)={r5, 0x0, 0x0}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00f3ff00000005fda1bf100004001c000c001b0000000000"], 0x30}}, 0x0) (async, rerun: 64) r7 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) (async) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000980)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@private2, 0x0, 0xecdf, 0x0, 0x3}, {@in=@broadcast, 0x0, 0x32}, @in=@rand_addr=0x640100fe, {0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffffc}, {0x0, 0x1, 0x80000000}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0x2, 0x0, 0x73, 0x4c}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha256)\x00'}, 0x0, 0x80}}, @algo_crypt={0x48, 0x2, {{'cbc(serpent)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x4e24, 0x4e23, @in=@rand_addr=0x64010100}}]}, 0x1a0}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r10, r9, 0x25, 0x0, @void}, 0x10) (async, rerun: 64) r11 = socket$inet_smc(0x2b, 0x1, 0x0) (rerun: 64) ioctl$int_in(r11, 0x5421, &(0x7f0000000100)=0x100000001) 3.849062584s ago: executing program 4 (id=5821): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000100)={@random="ba7e94e9d1ec", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}, @val={@void, {0x8100, 0x4, 0x1, 0xfff}}, {@mpls_uc={0x8847, {[{0xd, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x99c9f}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x1}], @llc={@llc={0x80, 0xfc, "c0", "f168d5b0e5af0c616ad09351f381e439707c3162c9ae20ba6fbf9bbe89b18292affec8aea4d4214e69e0881dcdda45b0b815f516eab0744a455fdb3c201af8f4e7250cec85313ef8dcd4c2ea9c67a669f0"}}}}}}, &(0x7f0000000180)={0x1, 0x3, [0x603, 0x6e4, 0xab7, 0xb64]}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005001d00050000000500010004"], 0x4c}}, 0x0) 3.747541364s ago: executing program 0 (id=5822): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000440), 0x591882, 0x0) (async) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000180)=@file={0x1}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f0000000100)=@abs={0x1}, 0x6e) (async) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)=0xfffffdfd) (async) r3 = socket$inet(0x2, 0xa, 0x400) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r3, 0xc0385868, &(0x7f00000001c0)={r3, &(0x7f0000000080)='\x00', 0x101801, &(0x7f0000000100)={@align=0x8, {0x7, 0x4, 0x7fff, 0x9}}, 0x85, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)}) (async) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000cc0), 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REQ_SET_REG(r6, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001840)={0x1c, r5, 0x1, 0x0, 0x8, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x1f4, 0x5, 0x0, &(0x7f0000000200)="fff4ffff7f83360962a536c801d776bfbf59a2a044237cf4ffffdd196133141957b4e81b438105c6559b6457b786861767658968492e582da3951263b6788b026f222ea652783d91fd5c038e9157e568714b4ecf8015310518cc88f0d189e3326fe13878f969f9438bc03047479e11876c79c2bf68afbb5213b08c9ca588c2b31c0407e860c7999da46892a04aaaa20e6bc2fa5066b7ba19213676398c96269ac9cd96306be5ec550b2650111d89784c2e4d833c0bfe7240e62186edc84a1cf0af226d62c76bd70eeb80f7be21b7d025ef6cb6ad6a4ad8bb3673146439695e7f5bcfd244b1408a0d324dc65267db005f46c4c327bf66936a99757c8b2e1e553c2e513099414d0a820a6fe5f3011782158900faf9119f9e2a09f3293f94c79018e92d99dad7f6950591e52a8483e3a97f7e9a458c5260b86cd1f53befafe2bb9f9ea1f07cc9f3b3bc25d2b2cd2b03886a45d5638756ffdadc327b887c798ce7cbb7dbe74f99b3ffa78fa6874aac9c4b69746edfc2dc8239e45294ab1de338369b501854f35fdf033dfebbf58a236b047de3edfb0fd387c628867f4a70b4b7dcd6557a8aefeb41276f9e4e0d09c814617d8b0741a74c103b8c0d581d61d1b369a6cd1256eb455ee6fdc07ffa10690916c88aaf25af5dc05e87d25b91d5444ce256d3caa69c196de03e0b9cc53dde094e91986011d99e94757a61ac58b7b52b65b10641d2f56c2206a071c5119bda9b5639ff535508662e6d73af5abbfa684a81ef130e489c852fbb109c25295a665a00993ac7b4e23032f2189df83e99", 0x0, 0x304, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x8}, 0x50) 3.497914112s ago: executing program 0 (id=5823): unshare(0x20000400) (async) socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'netpci0\x00', 0x0}) (async, rerun: 32) r2 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x0, 0x1}]}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32=0x0, @ANYBLOB="090001"], 0x38}}, 0x40000) (async) r5 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, 0x0, 0x0) (async) r6 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) (async) write$tun(r3, &(0x7f0000000040)=ANY=[], 0x2a) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) (async, rerun: 64) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) (rerun: 64) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5}, @IFLA_BOND_NUM_PEER_NOTIF={0x5}]}}}]}, 0x44}}, 0x0) 3.237200399s ago: executing program 2 (id=5826): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close(r1) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x1) close(r5) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0xffffffffffffff26, r8, 0x0, 0x70bd2d, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x15, 0x7, @udp='udp:syz0\x00'}}}, ["", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x200000d0) r9 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r9) getsockname$packet(r9, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x437, 0x1, 0x0, {0x0, 0x0, 0x0, r10, 0x50083, 0x2c01}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x40850) sendmmsg$inet(r7, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1=0xe0000306}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) splice(r4, 0x0, r5, 0x0, 0xfffd, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=@can_newroute={0x34, 0x18, 0x2cf59e71e8a15bdb, 0x70bd2c, 0x25dfdbfe, {0x1d, 0x1, 0x3}, [@CGW_MOD_AND={0x15, 0x1, {{{0x1, 0x0, 0x1}, 0x7, 0x0, 0x0, 0x0, "af2c9b0175e0a035"}, 0x6}}, @CGW_CS_XOR={0x8, 0x5, {0xfffffffffffffffa, 0x1, 0xfffffffffffffff8, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_eeprom={0xb, 0x0, 0xffff0000}}) ioctl$sock_ifreq(r3, 0x8923, &(0x7f0000000140)={'veth0_virt_wifi\x00', @ifru_flags=0x8000}) syz_emit_ethernet(0x32, &(0x7f0000000000)={@random="e90c610faca2", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @opaque="24dc6170e1e03185"}}}}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000006340)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) 3.105106669s ago: executing program 0 (id=5827): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000600000000000000000000090200000004000000000600070000000000002e005f"], 0x0, 0x36, 0x0, 0x1}, 0x28) 2.993772627s ago: executing program 4 (id=5828): r0 = socket(0x2b, 0x1, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x2, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x9}, 0x1c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000480), 0xffffffffffffffff) socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0xd}, {0x7}, {0x9, 0xf}}}, 0x24}}, 0x2323f6e0e46747a8) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000940)=@filter={'filter\x00', 0xe, 0x4, 0x3d0, 0xffffffff, 0x0, 0x210, 0x0, 0xffffffff, 0xffffffff, 0x300, 0x390, 0x390, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@remote, @local, [0xffffff00, 0xffffffff, 0xff, 0xffffff00], [0x0, 0xffffffff, 0xffffffff, 0xff], 'ip6gre0\x00', 'veth0_macvtap\x00', {}, {}, 0x0, 0x9, 0x7, 0x29}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@frag={{0x30}, {[0xffff, 0x3], 0xffffffff, 0x21, 0x2}}, @common=@eui64={{0x28}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x128}}, {{@ipv6={@local, @mcast2, [0xff000000, 0xff, 0xffffff00], [0xff000000, 0x0, 0xff, 0xffffff00], 'wg1\x00', 'gretap0\x00', {0xff}, {0xff}, 0x0, 0x4a, 0x5, 0x38}, 0x0, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4, 0x8, "0253176656f9e5c8378ca8c05c224f6b4ee6289a5895a32a6389c1ad0604"}}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0x25}, [0xff, 0xffffff00, 0xffffffff, 0xff], [0xffffffff, 0xff, 0x0, 0xffffff00], 'lo\x00', 'wlan0\x00', {}, {0xff}, 0x0, 0x5, 0x1, 0x8}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x3c}, 'bridge0\x00', {0xa9}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r3, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000f40)=ANY=[@ANYBLOB="5800e3ff0040000080fd89bee55e423bc3d3c8c8a5355e499b11f2dd509719656f6414a0109e08000000f682cfb9c4e1920c1802b91086fe6990d0e9b3fe7965b22bba67fc4b580b905fbae2bb70a856f74f6405d4da8d788ed83ebe6f86876e5712591e38420110cf920d5796cabf3e9dc9334ec324e97ee3823e7e9db0e9f0d8762b46c7abb101037cb132289cc466808226c16b7f348a4093235463c2287308cc1031132de7bc5b9034b4d98ab92a410057ac0000000000000000000000000c1d807fce229fc9bd55988e82cca88c9d7a9f502817b7e7855ab2b81bf35efe3892ea67a69247713188dea2ff9be23cc563f081c313ee76684fbe78391e200adcca4315bd9573f64091632e9084348bea1ff2291fa2a56c84f85ed165a8c64d14083f3e6281daae2e0703c198a8d4d7ca4d8ed718d17e8b64f38c66cd7208f28ea3a2f93646affadc07b9c185e604e1616def200d4da2b033b01f29db7de5481aca5c4fef6412de2fa6dfd6ab42194c875a89908e181f339596b97d838b73e4103ee2a98dd2fa4c74a7eafdf971d8c7c8bf5fff0f74", @ANYRES32=r3, @ANYRES16], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20068899) sendmsg$ETHTOOL_MSG_PAUSE_GET(r1, &(0x7f0000000880)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000001100)=ANY=[@ANYBLOB="04010000", @ANYRES16=0x0, @ANYBLOB="000126bd7000ffdbdf25150000002000018014000200766c616e30000000000000000000000008000300020000002000018014000200776c616e30000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="2000018008000300000000001400020076657468305f6d6163767461700000000c00018008000100", @ANYBLOB="86dc52fd6add675cc35e927b94fa6778db1fcc4b0c99bb62f76f44f0ad29ee75e03446eea0ff1b110bafcb5560ed5f8e1625e067d37b1bc8dc3f834e1ef6df02bebb65de4f8cc378c5100cf7b93658c85992f8befaa234f2f564a0553bd73b6aa9b11e242caf41e6908248ebd06c0fdb287f7b0d3d9717114e0ac8561c18db84d00b131f2030b9cf414dddc8788822a5d06854909334af", @ANYBLOB="5c0001801400020062617461647630000000000000000000080003000300000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="14006f0200007468305f746f13626f6e6400000008000100ac21fa78412f793280b4c736de303ef885a09519fc945c461e5475b87484d32b17af2f241bc8129ebbc6c15045580e75f0829f8711e296fe7fb63876f1c592f34f12d58f76e6bc3bd0945fa2c4615e78365b822df76845557e1579ca880927e44041", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="280001801400020076657468305f766972745f776966690008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB], 0x104}, 0x1, 0x0, 0x0, 0x40805}, 0x4001) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0x1, 0x2000003, 0x2f4, 0x5}, 0x41) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r4, 0x3c2d6000) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x25) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', 0x0, 0x0, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000400)=ANY=[@ANYRES32], 0x42) 2.987182707s ago: executing program 0 (id=5829): socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r0, 0x913e0000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3, 0x12, r1, 0xc3ceb000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r0, 0x0) mmap(&(0x7f0000708000/0x4000)=nil, 0x4000, 0x8fbc0e6f77c18ed3, 0x11, r4, 0x1000) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000180)={0x1100, 0x0, 0x52, 0x11000}) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b04000000000000000002006a000900020073797a32000000000900010073797a3000000000240004802000018007000100637400001400028008000140000000170800024000000002050007401400000014000000"], 0x80}, 0x1, 0x0, 0x0, 0x20000000}, 0x40041) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x9, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, &(0x7f0000000000)=0x80000001, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e24, 0x5, @local, 0x58}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a6e65742c6966616365"], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000005700)=ANY=[@ANYBLOB="580000000906010200000000000000000200fdff300007800c00018008000140e8000001140017006261746164765f736c6176655f3000000c00028008000140640101010900020073797a31000000000500010007"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x40c0080) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r8, 0x89f1, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x1, 0x7, 0x800, 0x5, {{0x5, 0x4, 0x0, 0x2, 0x14, 0x0, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @rand_addr=0x64010101, @local}}}}) 2.985892439s ago: executing program 5 (id=5830): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0xd0, 0x270, 0xd0, 0x340, 0x340, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x44}, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x2f00, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@local, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0xffffffff], 'tunl0\x00', 'bond_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @private1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff000000], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'wg1\x00', 'team_slave_1\x00', {0xff}, {}, 0x2f, 0x6b, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r3, r2, 0x25, 0x10, @void}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000500)=ANY=[], 0x0) 2.73312399s ago: executing program 5 (id=5831): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="e8000000100001002dbd7000fddbdf257874732874776f6669736829000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000008"], 0xe8}, 0x1, 0x0, 0x0, 0x44}, 0x80) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={0xffffffffffffffff, &(0x7f0000002940), &(0x7f0000000500)=""/145}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f00000000c0)=0xf, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES32=r4, @ANYBLOB="2508007a0000000000030700000008000300", @ANYRES32=r4, @ANYBLOB="1400060064756d6d7930000000000000000000001400040076657468315f746f5f626f016400000005005300010000000800050004"], 0x54}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETQUEUE(r6, 0x400454d9, &(0x7f00000000c0)={'veth0_to_batadv\x00', 0x400}) ioctl$TUNSETQUEUE(r6, 0x400454d9, &(0x7f0000000140)={'veth0_macvtap\x00', 0x200}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x200000008}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x1}]}}]}, 0x48}}, 0x0) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$TUNSETLINK(r9, 0x400454cd, 0x338) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="5141765ec8f2d4d23ba7d0c6bda186828fbf5b7f5ddf8377c214e11f05ae3d461a1472b2e08c89678de7f042e1a76e77b715df0609412de7582d8d7aff533f5d6a898ea6922776c266915bf4eb113c10cc3ffa1a95c06b4f847e8ec9bb00000000002150399b9337029d643e0dfaa9f71a90779a19b379def20c41683afbfa576655d47cbba424c64dc5", @ANYRES16=r11, @ANYBLOB="0100000000000000000007000000"], 0x14}}, 0x0) writev(r7, &(0x7f0000001e80)=[{&(0x7f0000000100)="4d107a13565a23133c9f85052f450a3fe71fa0501c112ef5703111f270b55be78bcc488f349e46e2ae05c2968f65012a556cf34064b95d4ddc1567ac118e54ea8d29a9b1d3995506336ae81f61", 0x4d}, {&(0x7f00000001c0)="53fb0dbf02da6fbf6bed326a463c1be775a351efcea6fdc0387a8683", 0x1c}, {&(0x7f0000000200)="cbf6ab39de48af01fba21eb373dcb08fce7e434b2e32c12fa1679cb4e78de9306b89d8e0da96312fcb5793b91af7c9d353677fd414ffc48e750e2fa762cb745fe3f65e2a5a34882e746716c84326e29d128c31a76327800296062477bfbcfeda1523b96c0df6668d88d87e398d8c", 0x6e}, {&(0x7f0000000e80)="d62a029c2f17a2a7a4a33c37d9ae612851fb3e1c9abe1d5809c56001ecd582a02c74eb2998496043619bda0f57e09972011395268152ff7a319421b595b34c36fc2f1399b91f0617ae19775a381a34cc9acd27ef84a80a0528ff2665ab6aa406fa7c154b7fe7a3c1e4ac31d1233b35064fc895c3e4e5009d86b2c21c8812307e7977bcc7489ec52ab4cc12713c689da5dc26ba0e532941dbcd76946bc2bfece81476ebd561ed892b5fd4d062e6dfc55c494df9487ab1f2a9833511439c29bea6f5861bb7432b3ff86f106afa66bb2239e058f8790a74e082053fea6d0d5fca8732e5e2eb6f09a3b1c3d41d64a6d12b95ad3151efe94aa6ad4fdfed8bce8c8a728092de45a83bceffbf5513f6cd720478a6d6969f35e3ee836be6ade91df5e2c67e4091d352e6a7967670f1d06b0e286e41191d2a5e1887a46bba7784bdee7ee6c10c53c55e043d9c7d3ac131ace4f74269b020da29154b873fd67f37e188e70151475f20c3757cdbdb1a779b958e2ba8431a01c77f763c492f4c53f169f7888216cadbec1d08f93c3d0cb8f2619252179e1ac8d8d87694355bc6be83269850297225b6efac9a0befe1900d23d0c3ea415507b7508ebf3a6541c781e1f13aca5286f2fecde2d0b726136c557232fc4512a202451e92b2eaabe6a17ab03681a398dc3247c620073419fc8bc35a677c2bc1326bc32b9b700545d07647f915359faad9f85f84b118eb0e4903c77b75fff7144a606d7576d706269278700bc0a0c66bf87beb9664c458fdb31349795e7dd8d824a89ac55c815a0fac3fb418b30920b5a0e87d44ab60ae8dc9e27934839703a2a02e194a2ceb8c151bb7c74d5096cacd6d6c4c50f2ccbcef2b7c0d58e542b139fc9064fadee0cd85a13c1b6470182f571d2f449910dfb99de50a5caad2026a8a95abf05d3f1d822ad15fc24da5aec84f47b2b482f7df8e424fd320f79d5b64ebf69a143a98b79f33ef07f5b88e75cae4be6a53363732811f117398a41c2640191b1cb6e3b2e36e3ed9d688dd85627bbf8a5eca8ebd57dc9f77f912b619d4267fbf97409aef61e3029091f7861a536540381d402519249c651aa1d92ed9da91e8f7d241da35a4c26f445b4664a434a6ec9a6618b0a0b6d07636fc72d6c6e3d9a6c3f0f4f50a45465d3d9e8057d829040abd079409cfff331de3c9a45beade9fcee6f1d7668f520efd6db76e48c00e0a84357e74c185fbeb4c6b2eae94c0540f70a4030c8233e15028d6d9662b4dc7092f798e64b7e1867744f6930d8672998770703b59a3b1978424585d8f199951e92b96e8714e627db9006492916e329df132ff678cde974267ce19ce0a0180855cb63356bbd7af14937a4d66a38b46b91d0dffbf31d3ac737cb16b6565029ca5a957e4f709d3ecab1fab4a91c9ea6fd87a19d95237a305518d3865367c394e69fe99a47587ed34fa50c4929db5c84a0495ba47f06ecfe4548add2c9b82cb69a32d17dbf6a024abeccad6db9acd7960e94648efe085aa638a61b717b1ada958697bb6d80bb614fc3f5e43e900f9e7d304ea367681332f7ad44504942bc3b990898878c64675897f7b6158013432e348b82255e5a2f4ea998c227ec5db396e3586c007ec909970468cde033b1f52c4a826a02ed71453c0393b952384abacc090934e2758ed80040360254e06d29112b19cf3895ab0329e3aef92d4b82ce0e105fd6b5e9e4cb87eaa5432924a2727f04431be594697519ab87d9a34b768ca13a376103b3c445842b3661162bbc7103704062f3e03d45548f16fd6f00b0cdf6e983827c1cb8ed52f829393dc0b862d1994b354f533b8b01fa5d32e3fcc8855433d14e953259b27a50266739c50c5409ff2aabd483492da5307192aa3ad647753dcdba8d0a7b96e4202402ad9b02a67c67e7fe93a4e19a5a676df42efd5e086143a38442354b7a64d5416395fa56e599c932272804b0821ab2d41eaa5b34798d617eea4bdbbfd5395a16a02587b38b200510f2c84f7e185a4b58de91ba2bb772bedad305e366c1d23c06c5979ec2806969f2f62351930540f56125e9205751b5120bb212808ce71b899253bfd0267c0a036156d1062aaceec5ffa7c086bb05274b84e6037e7aa4f32202fc191c8c4ef3dad2ae6817696e70ada378a69bf4ae1a989ed32c6277523b7c6aa6f3b839c7b120c896a2629586c6d72e961adab1687ad9ff169874bee905f34384e7ca66f139cfd5b22e912576ed4187f17df01b5c7dc459b01a13f3d66c6ff26c57535764fe72b56f58223de5c73938f788f0f2c64b5307c188db0d606daa1c6a4d58c8aa9d118cff38c13c2878ba1def366fb283ac240c03a4e76eb2ccc97f818c63f81c1f8c05e37949e41a8b62002211a0928e20a69cdc6058faef582e413d1d31c9ba24a2fd8e3a7e06a9b97f80671eea4b0e1972027a8287c8fb9d38ab76a5fc73758630a431106cbfcb90b44bca400d83cd5f627f61c5aa0fc1a15783efeb828bd74fb9b587d384b3b6b886eb552463c748580d1fb523f6ef69aeb6aff86913c505d92467c778c765a145da6587f2868647d810f77e80972e1d616c2a47cabd4d206ccde5d4bb01f9d8848ddce6d06e47183b7120d965f2d6b99213a2ae1d3a711edcbe375da057694855735d517d08114e5e7205218c010f80ddf07276c84153d46f96985714b4660f5abaecf06715de2cde6e6022218283a6789f1147b442b3bc82c6dfd096ee0503e33e6c19bc52bb7d59dd4692ede4e0c83aaf64adcd14571ef60895208141e34556c612703a6b4a3afdd8374fb385e86b7f0ae3266175dfe4c75ba93a8f3309d3ae614755d1ea75f0e7052af01cd041e925a7546141f388b3c2705547a143b25a0cfa2625aa0739fe861a8ccb7b4a4695f2bf5c82f3f6e430b24af33306b70c306f1fdc9918b0657a27e4e67a57f5ae812ad83e155828f2804b4967d874ab341cd36113fade85c2647be1b3e95325b6fd0a9779f6035cbd4ae31e1f98e0df514757359c494a01d89ba76b9163b027b994c4c02a5119b6cfd26f1718a7942197d667fc968d4179a9deae5ead30dbd3ad6c02ae4fc4cace0717fca4208eb3570970f800909f47cf9f2180dc76f9f49ab47163d5aab36d13c7a9f00f4c9eb51bcab8017396fdaebfea9271fdda2e0b8eb250ef63206fc8f305d74c8ad76010ffbe61258cfa198613f97c18d36f4e11ede5d6ad1de2d3b9c9f6858cece89439f0eacd4b25d97611e471a95a6f5cb5909c331a785e37435763c16e9183a8c73971f4001573266b6d3ef4fdb2b4c585cadfb2a9690a8682859c35fbbacc15f6e707c13f3576a27e22ebe651f2baab3d72846ce5646740ff7d5a5d022e2179877e16ec6f73e5fc9e59daa5054802c3438fd0490ffe073df56d0f07a1b00f330a2b25c8ff7f2a481cd79ffea7e35695993ec24ef9328234514a8e9a069c94236832c5bc31e9df95103301d642892d8d86819a009b949aaeadc9c8ee7befc82a17415de319e4c13727bb8e52162bf530d8afc4ac98b873ea5f3ef2944a290a44fee2718e1d0bcc639775a72fe445acad08f294a6370046d4ae6c49d07c32e8b3f63c26e1d9050937af3665475062c37fd6792ac9256cbfd3969a690367b1ff9fde0783e189d09ace61ae91aebf36d8d36c5d21ed630af8a987e14d13cc595bef44b8d4a3511ab050586d0b8d1cf0d5bc32c728e0e6e699e7f471ab9fa8d247f25c7124de79ef9a8ceb06b748e32cbaece4c1b4acdf2ed078e0953e0b57504b35da0a8c00a81fda9056b5c2793f86a6899b0fd9b6f3d7bd4fa035da2049e14b2f0a4472ef226a467d02e70cf305f8408d769de9b2b6c963c5987ce05cc950a8b67e65d2d167d120d3e8afa25495d7812bea4f0ae2a7da0f1250de8b50c13d34acd4fa379b14954ef13bd8e8c13298d63b10d28fdd90bb5b912e558cbf1c98663b605ffc059e3790d62c7dfb7b5158b9d2a890e09855beafbca4c2fe1f375fbf6234f243e2ca9903ad725674fb75658c1d9b5cb9d4d0ecf10a8764b478eb4a0e48e45c0b9312fff5122fabdab93c9fb89a0132aeab506f0d841a2263911a09e979f623a1f63c1cb01ff9d8f354fa182efd92f8b43f56c826dde45ec815da76c5822666b5b4c252453be61f8a3bce1c15c100a9bd3579b2965d25e2ebbe33fbac9d6092c118fc7a7a3b729c1c3c12f49c88918ea1684389bb45fa5d341f113761d7fb9d7a4936acb6022f6321e5a4cc23ec465eaed2df7f0f2640f7b74414a51a9b570007fa61d2221bf9f0cd234417c2dddba73930cd96d9a04bba62ff6dd6cc4e6de68ec1c760406bd4303bdf483a15fcbcfa60979a28e63e9fe55c776b2982d12406740a8d16f5c7782315143b3c908801f99edc9b4e8362ec64eabf247faa8b000ceac6e0ad4098703e8498be97f7073b8902329359d4937e797c56fc1543aec6381487a059a6bcba8f79b3f3ed89bfe310fcc762ebe046aa52ec6b06e9a7fd0516da3e1ff196988c75fd875cb34a31df584428bfcafbdd2d2333468519fb6a89d55d0e402a02feca217008bf09b7df649983b7ff86526ead1e2bc50e6af6e909c66d1b47ee06a64ca1a6274bdc144699b03a59780715a6975d7e7935e0020df6d26f56e2ba1f55ec0370e6dabb2ea59b20b70bc21f21c251c41107149f46dd125e866b9b1413dc8748bd78e7be5442dc57a9358b3b35d8d8b48d052fe0f094528fdbc868cb0cdeee4249f24eec456d102ef92bd48c2956a5f383d6416fd965724994b371ea3fbf3bc5362d580abacb5d8fea7b723c4e7eedfceda12124d35767379ea07a2430010179f4ddbfa5f7fc4fb6c07a3650164b7fb89ea113a34fcea22703b760668962ad2f5e51c093073359befbbb2b10fc2dfd30fee8c16afc3e8deaeb6728a4dd2b78f7ec6fd63db3fc9d2870ad7d4dbe2d212db28a12a883ae03168fbfc4afa64c47907325ed3d6899e1be05c3e36ecbeaf504c7709e115e4abd5f650cabbd42fbb611993c955bb112a7a407d90989073538d7c1a4e287489f486c49b3764c4a945e7df0340bb117e86bc3b6d9e5565a0e39cb67dea049865fd056a0efd2413d554c0aaa21c153dd36f30162ab4777f15dc695865e9769879c7d28195afdf6a813477326d7fe044da51cbb7a624a4b9a8b69aeb4a3f4144928b1dc41b1ebc29812af29dc35eb47118051c7df28d96062dff66de15ff732771bf2b3b15d913c278e7e84ccc9eda43b51c841039ef5e3d975d787de82d17b1e07403475dc687ba96c5c81d9bd80b87237b7901d7eb0fd485b94e55ed88529ec7a34b1a0210713fa68ac9ae1b677ac5866cf0fede2abb4f640af23fb7a1f853a6db0cbfc15b58a075860f28c1433e8433d93018824c7978a601ef9682e5680c63ae804a248031c87d166a8d070be9a66bd28dc143949d8aae7b28a430e9f029a11aec8eefeb7fbfca6bfdff2a3aab49020001aa018e6e7e7c4b2ca83e011d351c4095268555556cddd51377c6109c61f12cd3423eb6a1fc8f9e7688a3b6734e16003932715766e1821d42717ac52586715706b01dced219b70d73c2efc26dbeb74102d9037f3e63f41123050304c4c9f874aebdf85d9ca82dd72026b1e39b719bd9b5cf475893593153b0db5369d9c466b973abff808a6ea87694a330ad2541fd97f463097a2f0fe59c589c30e8e7d163c20f53be6811d6f6a113b4bf569c76b0a9dc2c74e59351793600d85cc1d26c8841cac771726b1a804896feb5d7f2016c1187e68a0d9a4c2f367fb694e6c0a8d535368b", 0x1000}], 0x4) 1.699869633s ago: executing program 5 (id=5834): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x138, 0x10, 0x403, 0x0, 0x80000000, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x118, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x108, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x58, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xffffff00, 0xfffff2a3}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x1, 0xfffffeff}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x1, 0x7fffffff}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x8, 0x4}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x9, 0xa}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x7ff, 0x4}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xfffff891, 0x8000}}]}, @IFLA_VLAN_EGRESS_QOS={0x28, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x6, 0x9}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x7, 0x5}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x10, 0xe58}}]}, @IFLA_VLAN_INGRESS_QOS={0x70, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x10000, 0x4}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x1, 0x7}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x9, 0x8c}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xff, 0x9}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x5, 0x80000001}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x6}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x9, 0x87d0}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x7, 0x4b}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x2, 0x3}}]}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x0, 0x2}}, @IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8044}, 0x8000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="18000000560001060200000000000000070000000024e300"], 0x18}], 0x1}, 0x0) ioctl$BTRFS_IOC_FS_INFO(r0, 0x8400941f, &(0x7f00000004c0)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) r3 = socket(0x2b, 0x1, 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000e00)=@raw={'raw\x00', 0x9, 0x3, 0x1c8, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @multicast2, 0xffffff00, 0x0, 'vcan0\x00', 'vlan0\x00', {}, {0xff}, 0x8, 0x2bbe86e5b28b8fc5, 0x30}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x4081}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x15, 0xa1, 0xfff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x228) setsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f00000000c0)={0xf25e, "dd4c20"}, 0x6) syz_genetlink_get_family_id$ethtool(&(0x7f0000000480), r1) 1.696205533s ago: executing program 2 (id=5835): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7060000000000008500000005000000bf0900000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b5090000000000007baaf0ff00000000ae8900000000000007080000f8ffffffbf8400000000000007040000f0ffffffc70200000800000018260000", @ANYRES32=r0, @ANYBLOB="0000000002000000b7050000080000004608f0ff76000000bf980000000000005608f8ffffff00008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r4, r3, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xe, &(0x7f0000000280)={@local, @random="4f78884c305b", @void, {@generic={0x8809}}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200), 0x806000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001740)=@bpf_tracing={0x1a, 0x13, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x316d}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='syzkaller\x00', 0x10, 0x1000, &(0x7f0000000640)=""/4096, 0x40f00, 0x40, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001640)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000001680)={0x1, 0x3, 0xffff8000, 0x3}, 0x10, 0x23f96, r5, 0x7, 0x0, &(0x7f00000016c0)=[{0x1, 0x5, 0xe, 0x4}, {0x5, 0x1, 0xc, 0xc}, {0x4, 0x1, 0x6, 0x7}, {0x4, 0x4, 0x2, 0xc}, {0x1, 0x4, 0xc, 0x7}, {0x4, 0x2, 0x1ff, 0xc}, {0x1, 0x3, 0xf}], 0x10, 0x6}, 0x94) 1.533043113s ago: executing program 5 (id=5837): r0 = socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) bind$inet6(r2, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_emit_ethernet(0x50, &(0x7f0000000180)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "910100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, '\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) 1.475784049s ago: executing program 4 (id=5838): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010000100ed4d3b163591ffd4d02000000000000000000500000adcfa81666e0cbb57abe14b06a648ec3e000000000a030000000000000000000a00000708000240000000020900010073797a3100000000b528940d48d02d511cbcac582c000000030a01010000"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) (async) r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x101880, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000d80)=@o_path={&(0x7f0000000d40)='.\x00', 0x0, 0x4000, r1}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110c230000) (async, rerun: 32) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) (rerun: 32) ioctl$TUNSETOFFLOAD(r3, 0x4004743d, 0x110e22fff6) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) (async) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b704000006000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r7], 0x1c}}, 0x840) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) (async) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x4000, 0x800, 0x0, 0x3}, 0x20) (async) unshare(0x2c020400) (async, rerun: 64) write$nci(0xffffffffffffffff, &(0x7f0000000b80)=ANY=[@ANYBLOB="5f00029e224756d93ae8e936dac0aef0e3c583c17b33756cf08d05000000000000005124657d20957826917cf28c86aff1c443443ba2c9f709ff053c6572d67dd5dbd9a2692a3cadab884f9e7b46fed9814b7c02ce7a86c4650bdccda6463bac"], 0x140) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x2, 0xd, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @printk={@ld={0x18, 0x0}, {}, {0x5, 0x1, 0xb, 0x1, 0x2, 0xffff}, {}, {0x5, 0x0, 0xb, 0x2, 0x0, 0x2}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x85, 0x0, 0x0, 0xae}}]}, &(0x7f0000000080)='syzkaller\x00', 0x9}, 0x94) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a80000000060a01040000d594000000000a0000040900010073797a310000000054000480340001800c0001007061796c6f616400240002800800014000000009080003400000204f08000440000000370800024000021c000180090001006d617371000000000c000280080002400000000b091e0883073c00020073797a32000000001400000011000100"/168], 0xa8}, 0x1, 0x0, 0x0, 0x40}, 0x24000840) 1.365588442s ago: executing program 1 (id=5839): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000600000000000000000000090200000004000000001e00070000000000002e005f"], 0x0, 0x36, 0x0, 0x1}, 0x28) 1.312680206s ago: executing program 5 (id=5840): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xd, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000010000000000000000000000850000007a0000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000008f00000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x9, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000005000)=[{{0x0, 0x2a, 0x0, 0x0, &(0x7f00000000c0)=""/19, 0x13}, 0x3}], 0x4000169, 0x60, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) setsockopt$sock_int(r1, 0x1, 0x28, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000540), 0x2}, 0x3}], 0x4000048, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000400)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x0, &(0x7f0000000200), &(0x7f0000000280)=0x4) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6051}, 0x4000) 1.090058871s ago: executing program 1 (id=5841): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x80000009, 0x3}, 0x10) bind$tipc(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042, 0x3}, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)={0x30, r3, 0x1, 0x70bd25, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x8000a6ff, 0x8, 0xffffffff, 0x4}}}}, 0x30}, 0x1, 0x0, 0x0, 0x200048c3}, 0x20000000) 909.095626ms ago: executing program 1 (id=5842): socket$nl_route(0x10, 0x3, 0x0) socket(0x26, 0x803, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x23, 0x80000, 0x8) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x1c, 0x27, 0x301, 0x2270bd24, 0x25dfdbff, {0xd}, [@typed={0x8, 0x23, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008}, 0x4044810) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r2}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000400)={'gre0\x00', &(0x7f0000000380)={'sit0\x00', r2, 0x700, 0x7800, 0x101, 0x6, {{0xa, 0x4, 0x2, 0x9, 0x28, 0x68, 0x0, 0x55, 0x4, 0x0, @loopback, @dev={0xac, 0x14, 0x14, 0x43}, {[@timestamp_addr={0x44, 0x14, 0xa6, 0x1, 0x7, [{@multicast2, 0xb48}, {@broadcast, 0x9}]}]}}}}}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 468.851372ms ago: executing program 4 (id=5843): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f00000001c0)={0xfffffffffffffffc, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x78, r2, 0x2, 0x70bd2d, 0x8001, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x400}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x45}, 0x20000000) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22, 0x100, @loopback={0xff00000000000002}}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r5) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$MRT_DEL_VIF(r7, 0x0, 0xcb, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r0, r7, 0x0, 0x20000000002) 317.118933ms ago: executing program 1 (id=5844): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa000000}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x6, 0x21, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2239}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x3fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 223.292169ms ago: executing program 1 (id=5845): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x54fd5c54b8064d6d, 0x70bd2d, 0x25dfdbfc, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8}, 0x4008810) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000600)=ANY=[@ANYBLOB="38000000180001002dbd700000fff40002100000fe00ff0900200000060015000400000014001680100008800c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20040004}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0x9}, {}, {0xc, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x60000080}, 0x20000000) (async) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 0s ago: executing program 1 (id=5846): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r3, &(0x7f0000001940)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000002540)="955232d6c924037daed352087a08237337131faef13945bfaaa58d01e5f858e96271cde18577054eb145e62abd8150646072c75137606c9eca87c894182ee54fa975990ac5f7b8f2ced1bc37588f08efcfba84054e1bf5de3ae4fe95d64222f92b12be73478c249144accca8d10df2f204b2905167cb97972c40265e6b4af404adc8f6cf85253346cfeb6eb585e3f0692ab9d35d7850e3d62a948b5c9b", 0x9d}, {&(0x7f00000001c0)="96607e121729ff5ba084661b14fc7202e7b510092e7dbe48014c2be7983a4e4e11a8906105f36f652d7135bda20b8a9abb9b959973ca1f755aa9e545c8fb8876d07fa49e24824ff971", 0x49}, {&(0x7f0000000500)="648a6282c6e91b973836904a4a88affa0c371dd1b9c133c5e594714579d6bb3addfd43e78272aef64427ce5467d6994320cf139092452c7944ddab49e459f7e0c73f890e9e2463bd3390e20b1e472bd2aedb47094547a767a098a94a402e6aba65c0ef07eaa87f8663c763d9bb491243eb129eec434e5603956c8333a6ecdf4d3a601b9c8d3d63e3a4a57b38033e2b004f6c3e45f1645c3b7ca0d5ba5eea059b5aa4f0f80ac66904076cc60e47e1afc7d81ad937dee5efc0580e38d96cf0f53808f37d5a8811b07165e8b9aabceac06e4fa7f7668b8832877783a727a1fa8b972bfaeb232cf3e9b500965820f4adf64f1e5eddd65f5734fb43644347e98af7eb6abe95dcb6ed1acc22c8abdd5ea116242d5b7b2ecff3d9c635bce6a377112b4adbd75b71fcc8a6e3693c82ed7fd11ad63683cc89f0a35b", 0x137}, {&(0x7f00000007c0)="a96a428426d96522dbf395b96cda5289bbfe3d97be8f413c48ec17c91194c66443ac9ed513c32242f54abb9a8ad671c6786dd7161962a8cf0dc4c7c0a1f86f7d1b17cc1660980f64e0b66a61b77eed3c8497ff551a20db0aa749c5ed3d49c05b1f787665fc8ed059d872289988b78549f8e5f01c2dab0e462f618669d1ca60666c010a55e46421284abe14fdfa39da550161c5410c37fbd11866c3e2f710e557408f5c4a5d494e87bcacc70ecbc69322da9f6a2388ffece43aeee909aa68d00e2137407fbcf0e749eb6ef98960c1ed54e532722c05c0038e8a9c25a560b3569cc7928a66d41c3dcf80263869467cd8a905d56a7b327d0354d81554f98b1e85ae5d86502a1b3ed1e250f71cb5c5b7aa755326d9d6ab836db15f6107023fe99229e48a9008bd8ed0141577f1f1ea58b10e6ceeacfe98ff142e57f0dd1c88ae37752e200657282cda4177730d24a77a941e21675fa53da47992cce0a954ae826fff35039dc74bd9d0e5973ee99b00200cff625fb828ebc36189f3013291fe121a0810e1008854633b5890b810817609e8311f2e34cf3b78d666a1207a4fdbf77cc2d87410bb8533054f39eeff0602c72476ea86bbd68e3bf4976c16a3a8d60b4fa1c1ff02275718e1f7028119bcb785b0d95369dea71f559a32891ad8b3ef21b0f43f8db1f88fc0984c24ea1a38bc89b3b23c4cf9a67ad08f3fb635736350dfb726f8177efadd377073ba05878ab62d2a18481922e6c48f09f057aba001fb8eb233eb23a67e74d006bdaad1fa9a8a622c17947f34b89d0fc0a6dd3a7b6fa0beabb98875112036ab1ec22090369dc72d3c385b2679f0b99af9bcc6ef785c0b51473d8864ec867ea3c754856199152f000b2afe739b5c568c1619d2af08fb2fc6844fac0035cceb0d0656d3af9bbd686fd99275e7f81aeafd33481c5778b279e5870348ec4495684bdcb71c0c8131cdc8330159d8c92adb613dac99fedb3c50c22243ee61ebb8645f94cd0994b02c5f5b544887b11b2fd3655e115889ebeb8617eb1cdb5dbec30c407ee4f09d17d2ecca77b25604cfbd308a91b0b2e8cd1249a2e1f441989657efc8584ceb7e443f2ae30191c5623b06fac91bab61a40f31f2863b4b508998ded6abd8f55e503401c2e9e298655d50ab3f775f9159d0765b4ee1fef3aa1fe608d5dade41cd16a3c1ec7868b18ff3f1449d3900f7d77489c1bb4cdb99beac51942f8a7c4ab3e3a43e13b6c69b63623a970aec5426b58c63d9ffc229efb58e7b58eb27a12b91c4a0f253e1d5f13e59ffcecb003c5e46b1cc236b9fe508b37c3f2046c53eabbc2a7b1f2c0d04a86ba8918239e1dda997c5612fb43dc86905f79f1503ac47d5ea8399dc5d5cc284a3a789d77cc5e887ce3c25ae3f7a636429873970930ebdeec9690b62f46f480a4a102cfa3ce2a61f056bedf3ca698c4f2666bf55f035daca9fb2efcfd96d18cb7afd6e2592e460c4638f261a4a7a85c290c78a921edbc01e2d7a60c6b6a2608fb52f31b73471dd610f3703242273de21261656df6cd8c3847c730819e402933a40a4c560d9651a95764179f4a1a39e60c80deece7b0eacbafd5efe40eee56424b3e0921524397bd4f554e4a0ccc6e9b2be09e0ae6810a9fef7b027ee3cff9b5e674f793579eac25cee7c4e9351a8d7412e2c6cf9ba4082059a35878771744b8d0c572e10250035630b30db9030bf67c6dca054f6a219c51984f37ec9a2e2ac6e85d97475e5821bbb376af98e1e180cd94c22a2246dc757da46421b85487b7291f68fa595451999c32c869cbabcfe6be628f0909bb62ee174c97bef3f92fbb1072d66b5d28427b1695913bb86759fc20c74acf75df87ded19a81966e7dda1be3cec73f23df8b255ceff270af0ee99253426f5d4866afd89766c498652d5c5f6d4d3d6fbb52931b10613ba80a3d8a23464c30414e89897b90d5e0c90f0c72931b5ad4cbf69c0fc2eda242a56a789af5f4f0f0fb51f26c7a102ce6e0b76cf3a1f84de55f21df446ec9b9409cd1fb919b02a515994166e7ae29ad0783e0adf2c4296ed7fc19c84378a35e83f739a3e370faef047ef39fc7926ebf06f09db535aae1d5558f83f1e434556de25e6d2aa78d4eac784a7407521e1626d038d652d0320c0558c42e9e9ac731404c26248934d23dd3a8812de7622c230888db650f7846770ddc8059447fd03ccf862574d9b548054afb63e32986caf80a57fc2fa01d904ec94ad1c8b6cb56cb782b47b5a5626ab094c196e2e1f9fd25a39ec1ad45a7ae94c9ae64ac4bb45c828295c195fbfed9171d142fb8ece8af614953ad5ca1e5d65c52c4d9633c458b5e788bfd3469328b9e6e4df03f3da9e5d3d11284e791a67d0856666ee21f8ea4b1d76d7a1f07863756029a4b5cb820edb63dc0efe6fc2577a79383f280f241b35dff9cfb92cf04451f5767f95e5d5ff0c808acddf406127e9ceb8d1f55749a5781e9b185e45072d181d069c715febebc1ab63126697d145d63b3a41ba202a387dcfdfbb96de0d05454fecc28637dfac86ce61641ee7105f4b441031bea7ae0d1787bf772cfa2f48c3062d232b23b5b328e6ea9e0de0130db2500e37d28a52c490b2fa9d39c3d5c9b8a298f2aeb348b962fee1d6a7d6d2c661113c2b8101f39dba91a3199bab5b70f5bed7871580b54bf34f2851c14b69e16ad97223ab8eb0b2725e00efa7b1e75264a65ad61cfca62f6d5d651c193c123f9bf77b3aed591e8161b767fc2977b56f3849362559dffd3414ef1e5cb2d611f7bb3d7d4c28c0a6de2993eb89c0805622f9fe4136e856e103d931aae07469efc077f9dd6df11c1eeba7468ca78e2e8027b2f672f9b965a6d88756b531321fb181702794ce58299b0cd34e481dc6760b4f9b32cfae5e0a35b4a19a4dbd26870bcb8ccb7724a294b10697763d6b3f7141bf7ca09d0871dceaf364f5aca649d77203328b8ad463a144961595e978043be434cd08dd5120bc36c5d895745ce5cc10f9a7f22baad125d60beaeb8c98279f5b3a363eda42bfc9fef669b2f4fb663700dcc5a47515b9adec65cc99cfea4cc2246dcdff878eae17441c69f4127c49fdd7935bb0c0c8053c9b788aa74a7ff174b7fc8b36ddc5ffa89fe7a98a14805ce96447e00a8b32b3f46af448aa29f326d03477bde78b147fec195cc5b253becf53a80f08ddde4529c2f53f40eb59f8598ed0c045dd60cb8ee90669091d1e2e970791f687db9b28c43c74813b6364b3a0f5762bfaa867bcdd7d44d0eccc1e0149b6ba5c4412b16493330a41352c682dfd88aff599459c6d7beb392925338e9bb1469f59dc833d0e685dc8ac9fc708123d1a1d483e6ccd45f58edac266f5517f5711402a83bacb634e4a28e8d32121be30a2aaeb2adc5cc3e2b0d15cd94b4fab7f37ffa77e477099ea6dd6167e292921f5957fc4e2f3c7a1396e60154bb638dccb5fd0d7bedc36591901dbd5cf63914c401fc79036f4a26f7b4df5fd776b7ef156c33a180ec8615ec6f24659794da3af2cb75a5905b891a0b269405d4471fbeb3e90b19f502f0b36a32f9f8bbac6a1fa6fb7a50cb563b4fa41d0f2639da50773356cce00000000000000016721701a47a54d76c93fbd00f408c270897159bf168ab2ec326978f48f7d845b6e64d856de829fd8b45b86489abb7537e372df0ddc96ed4826ee76b28d8999d7e170b1db1dc9316d51504f7cf7740f354f0255f83a31ef9c8e70d33a256e909bad11ae1217f66260dc5c52682a6e84fec98221de47463b6d37b6a100fe5893b668d316b78f1cc0f67c481c50e275d4613a0b2acf73f86898b2506dc72b427e0476ab342f3c18b0949ee09c2d56154fc7b36a44c0771851186e83619f73945258dfe80304a591b2fe7057e80a2127c5e8b00c6d4809e72d931ffd7bce4b4d9fce0cf6135c47ad63fd7f9ed8beba4de84c087fcd42eaf8474a01bd752bba36dd487c0ae725f8e7ec695aa2958616f6c59413f235f176300a9457d3caf0b4e972b6b9339b4de6e7bf29aa1af48de7a834700a9c999c0198b3f6234aee737c96e02120b79725322aafe19139cc725db0b578cfccd8666b66ae8e034e4240768f03e0ff8ee072245b28f42ceb784133e99071b36709992fa81a9736d89018a2b361877a2fb05bceb0bfa5ee0eb7fc5d78c534f6ea4edcd0f530067c530f7bea92bddc9c61b268d5bc1ad3ff852ab93f3e810002133d0d8e16b1d71e1db2bdb91d416a6bfcb4864d58da1758abff7ca03d379bd48b03f019c33c434bdf25822465ae322b38ae83dd90597db8c781f48efedb66da368f3d9f67f27612c51c07b9aeb419c32ff028a77e3abc5bd531d7bb29bd1c6c1119820abfd881f660e5a7072cdbc0e888d97cbc2105782204f34d093c1e0e6195e51e2e8b639a0f656aa21e29d0fa2a2f868b77995e7ada252a30a31b219be7c1b107ddd737654546340e424f13521ed73f0ed33ad3664f1b9b68ee60f7255119d585c09a2467b22de08104a37202cb737e934b1bdb83102b680d9cfd21c55fd00e33fba7651b2c36a87272945c371303c7e4ca181c1f7d2fe09815c1732d8d777e7b9a430d6b237c7c9fc8758e8456fb4e6ffc2aa421ab5942204e54cb52197e14aae9ae34376ac1d56d009f07babcb3d3492c87faf3e44bdd7d16dbce8148e2c7cb44d30ca29908aaf7c9ef39e791a9a988a5381942e3daf05f85be245f4ef26b08d83b1c1b58892b462783dc27602d8931d3232e5be295d479f9600cc4c3ed2e6a2fbb925c602d251b13f2ec2b7ca99fcd4bc2aa6115ddb0b842ed35c70d867734ee7518fd5299e07818f024a1682aacaa4e28d9f5db71006beb8bcc1e3a43cf27fb3d9475fbd632912d83f4e95b4390068f55f2f832a2e2c9f4ba5ca59d185a655375c6f5779d9fe5a47d1f417cf6f6405eab89f755f9a90623270c2b2a444b6b79662964199f7bedd2a2939e03ec6a334b78a6166ebf70562819a273bb6de9a3d7c2383a569cbeb08859e742ec5f947d1817c2dbfa3b72e5d3afdc45", 0xde5}], 0x4}}, {{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000000640)="fb24592d", 0x4}], 0x1}}], 0x2, 0x4044805) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) splice(r0, 0x0, r3, 0x0, 0x8000000000025a5, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001980)=@newqdisc={0x43c, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0xfff3}, {0x0, 0x7}, {0x2, 0x8}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x80000001, 0x8001, 0x3, 0x0, 0x6, 0x4, 0x8, 0x9, 0x401, 0xfffffffc, 0x6, 0xfffffff7, 0x3, 0x3, 0x4, 0x3, 0x100, 0x8, 0xff, 0x80, 0x9, 0x8001, 0x80, 0x7, 0x101, 0xa46, 0xeb, 0x7ff, 0x7, 0x10001, 0x9, 0x6, 0x9c01, 0x7, 0x4, 0x0, 0xfaa, 0xc88, 0x6, 0x8d1, 0x1ff, 0x2, 0x1, 0x80000000, 0x6a, 0xffffffff, 0x7, 0x4, 0x3, 0x6, 0x0, 0x100, 0x4, 0x9, 0x8, 0x144, 0xd, 0x14574, 0x0, 0x7f, 0x7, 0x1, 0x314, 0x7, 0xe, 0xfccf, 0x2, 0x45, 0xa, 0x4, 0x2, 0x8, 0x5, 0x3, 0x1, 0x4, 0x1, 0x40, 0xb, 0x3ff, 0xfffffff9, 0x6, 0x9, 0x8, 0x80, 0x59b, 0x1, 0x2, 0x6, 0xc, 0x0, 0xfffffffa, 0x4, 0xba65, 0x4, 0x0, 0x70e, 0x9, 0xd, 0x1, 0x0, 0x7fffffff, 0x7fff, 0xfff, 0x4, 0x4, 0xac1, 0x5, 0x4, 0x9, 0x5, 0x9, 0x7, 0x5371, 0x709d7f5b, 0xa09a, 0xfffffffe, 0x4b8a, 0x9, 0x7, 0x4, 0x3, 0x8a9, 0x6, 0x4, 0x10001, 0xc0000000, 0x4, 0x7, 0xf, 0x86, 0x7, 0x3, 0x9, 0x9, 0x663, 0xfffffffd, 0xe2, 0x0, 0x4, 0x4, 0x6, 0xfc, 0x1, 0x9, 0x8, 0x4000007, 0x8001, 0x0, 0x4, 0x5, 0xfd, 0x90, 0xffff, 0x5, 0xfffeffff, 0x7, 0x9, 0x8e0e, 0x1, 0xe, 0x8, 0xd, 0x2, 0x5, 0x0, 0xb, 0x6, 0x4, 0x9, 0x9, 0x0, 0xc, 0xaa8, 0xcb1a, 0x7, 0xffffffff, 0x9, 0x2, 0x81, 0x9, 0x280, 0x0, 0x8, 0x9, 0x8, 0xfffffff9, 0x800, 0x18e, 0x5, 0x5, 0x1, 0x32, 0x6, 0x4f, 0x8, 0xfffffff9, 0x1, 0x0, 0x6, 0x1, 0x7, 0x8001, 0x7, 0x53f, 0x4, 0xd13b, 0xb, 0x6, 0xb, 0x100, 0x7, 0x5, 0x6, 0x1, 0x10001, 0x6, 0x4, 0x7, 0x82, 0xf0, 0x4, 0x3, 0x6, 0x4, 0x5, 0x400, 0x0, 0x0, 0x1000, 0x6, 0xc, 0x2, 0x1, 0x3, 0xc, 0x8, 0x80000001, 0x8, 0xa4eb, 0x5c33, 0x4, 0xffffffff, 0x1ff, 0x3ff, 0x3, 0x80, 0x7, 0x8001, 0x1, 0x8, 0xe1, 0xc, 0x5, 0x3, 0x95]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x11}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x38, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}, @IFLA_AF_SPEC={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r7, 0x84, 0x12, &(0x7f0000000040), &(0x7f00000000c0)=0x4) kernel console output (not intermixed with test programs): _list+0x31a/0x4e0 [ 596.172419][T20937] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 596.172447][T20937] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 596.172476][T20937] ? sctp_v6_is_any+0x64/0x80 [ 596.172506][T20937] ? sctp_copy_one_addr+0x93/0x360 [ 596.172537][T20937] sctp_bind_addr_copy+0xb3/0x3c0 [ 596.172566][T20937] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 596.172594][T20937] sctp_connect_new_asoc+0x2ff/0x6b0 [ 596.172629][T20937] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 596.172667][T20937] ? __local_bh_enable_ip+0xd0/0x130 [ 596.172692][T20937] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 596.172718][T20937] ? security_sctp_bind_connect+0x7e/0x2c0 [ 596.172754][T20937] sctp_sendmsg+0x159b/0x2d00 [ 596.172803][T20937] ? __pfx_sctp_sendmsg+0x10/0x10 [ 596.172845][T20937] ? aa_sk_perm+0x6d5/0x900 [ 596.172876][T20937] ? __might_fault+0xaf/0x130 [ 596.172907][T20937] ? sock_rps_record_flow+0x19/0x350 [ 596.172937][T20937] ? inet_sendmsg+0x298/0x320 [ 596.172965][T20937] ? __pfx_inet_sendmsg+0x10/0x10 [ 596.172989][T20937] sock_sendmsg_nosec+0x10e/0x180 [ 596.173048][T20937] ____sys_sendmsg+0x54e/0x850 [ 596.173083][T20937] ? __pfx_____sys_sendmsg+0x10/0x10 [ 596.173129][T20937] ? import_iovec+0x73/0xa0 [ 596.173156][T20937] ___sys_sendmsg+0x2a5/0x360 [ 596.173181][T20937] ? __lock_acquire+0x683/0x2cf0 [ 596.173219][T20937] ? __pfx____sys_sendmsg+0x10/0x10 [ 596.173289][T20937] ? __fget_files+0x2a/0x420 [ 596.173318][T20937] ? __fget_files+0x3a2/0x420 [ 596.173359][T20937] __x64_sys_sendmsg+0x1b1/0x290 [ 596.173390][T20937] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 596.173433][T20937] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.173457][T20937] do_syscall_64+0x174/0x580 [ 596.173485][T20937] ? trace_irq_disable+0x3b/0x140 [ 596.173552][T20937] ? clear_bhb_loop+0x40/0x90 [ 596.173578][T20937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.173600][T20937] RIP: 0033:0x7f0f07d9e019 [ 596.173620][T20937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.173640][T20937] RSP: 002b:00007f0f08c1f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 596.173663][T20937] RAX: ffffffffffffffda RBX: 00007f0f08025fa0 RCX: 00007f0f07d9e019 [ 596.173680][T20937] RDX: 0000000024000052 RSI: 00002000000000c0 RDI: 0000000000000003 [ 596.173693][T20937] RBP: 00007f0f08c1f090 R08: 0000000000000000 R09: 0000000000000000 [ 596.173707][T20937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 596.173720][T20937] R13: 00007f0f08026038 R14: 00007f0f08025fa0 R15: 00007fff88fd0368 [ 596.173756][T20937] [ 596.580966][T20934] macvtap5: entered promiscuous mode [ 596.586884][T20934] macvtap5: entered allmulticast mode [ 596.704166][T20935] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4404'. [ 597.100681][T20944] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4410'. [ 597.549214][T20963] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4416'. [ 597.574018][T20963] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 597.760357][ T6681] udevd[6681]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 597.955080][T20984] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4422'. [ 597.980332][T20984] macvtap6: entered promiscuous mode [ 597.985950][T20984] macvtap6: entered allmulticast mode [ 598.293793][T20994] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4426'. [ 598.363019][T20989] bond4: Removing last ns target with arp_interval on [ 598.556474][T20974] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4419'. [ 598.610888][T21005] netlink: 'syz.4.4430': attribute type 1 has an invalid length. [ 598.649792][T21005] bond5: entered promiscuous mode [ 598.655425][T21005] 8021q: adding VLAN 0 to HW filter on device bond5 [ 598.778635][T21005] bond5: (slave veth7): making interface the new active one [ 598.786011][T21005] veth7: entered promiscuous mode [ 598.808047][T21005] bond5: (slave veth7): Enslaving as an active interface with an up link [ 598.982363][T21017] netlink: 'syz.5.4434': attribute type 1 has an invalid length. [ 599.095100][T21015] macvtap4: entered promiscuous mode [ 599.100793][T21015] macvtap4: entered allmulticast mode [ 599.228541][T21017] 8021q: adding VLAN 0 to HW filter on device bond5 [ 599.286294][T21020] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 599.321511][T21020] bond5: (slave batadv0): Enslaving as a backup interface with an up link [ 599.389505][T21022] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 599.392252][T21033] netlink: 'syz.0.4438': attribute type 11 has an invalid length. [ 599.436573][ T6901] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 599.593261][ T6901] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 599.651082][T21048] FAULT_INJECTION: forcing a failure. [ 599.651082][T21048] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 599.664186][T21048] CPU: 1 UID: 0 PID: 21048 Comm: syz.4.4445 Not tainted syzkaller #0 PREEMPT(full) [ 599.664216][T21048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 599.664231][T21048] Call Trace: [ 599.664240][T21048] [ 599.664250][T21048] dump_stack_lvl+0xe8/0x150 [ 599.664292][T21048] should_fail_ex+0x40c/0x560 [ 599.664335][T21048] _copy_from_iter+0x1d3/0x1660 [ 599.664366][T21048] ? sctp_chunkify+0x5a/0x260 [ 599.664393][T21048] ? sctp_chunkify+0x5a/0x260 [ 599.664424][T21048] ? sctp_addto_chunk+0xf8/0x220 [ 599.664452][T21048] ? __asan_memcpy+0x40/0x70 [ 599.664481][T21048] ? __pfx__copy_from_iter+0x10/0x10 [ 599.664513][T21048] ? __asan_memcpy+0x40/0x70 [ 599.664541][T21048] ? sctp_make_datafrag_empty+0x184/0x240 [ 599.664567][T21048] ? __kasan_kmalloc+0x93/0xb0 [ 599.664601][T21048] ? __pfx_sctp_make_datafrag_empty+0x10/0x10 [ 599.664627][T21048] ? skb_put+0x112/0x210 [ 599.664658][T21048] sctp_user_addto_chunk+0x7c/0x230 [ 599.664693][T21048] sctp_datamsg_from_user+0x754/0xef0 [ 599.664742][T21048] sctp_sendmsg_to_asoc+0x13cf/0x1880 [ 599.664783][T21048] ? sctp_assoc_add_peer+0xd57/0x1430 [ 599.664835][T21048] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 599.664868][T21048] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 599.664902][T21048] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 599.664935][T21048] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 599.664966][T21048] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 599.665000][T21048] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 599.665027][T21048] ? security_sctp_bind_connect+0x7e/0x2c0 [ 599.665064][T21048] sctp_sendmsg+0x1bb5/0x2d00 [ 599.665114][T21048] ? __pfx_sctp_sendmsg+0x10/0x10 [ 599.665154][T21048] ? aa_sk_perm+0x6d5/0x900 [ 599.665184][T21048] ? __might_fault+0xaf/0x130 [ 599.665216][T21048] ? sock_rps_record_flow+0x19/0x350 [ 599.665246][T21048] ? inet_sendmsg+0x298/0x320 [ 599.665275][T21048] ? __pfx_inet_sendmsg+0x10/0x10 [ 599.665306][T21048] sock_sendmsg_nosec+0x10e/0x180 [ 599.665345][T21048] ____sys_sendmsg+0x54e/0x850 [ 599.665381][T21048] ? __pfx_____sys_sendmsg+0x10/0x10 [ 599.665421][T21048] ? import_iovec+0x73/0xa0 [ 599.665447][T21048] ___sys_sendmsg+0x2a5/0x360 [ 599.665475][T21048] ? __lock_acquire+0x683/0x2cf0 [ 599.665512][T21048] ? __pfx____sys_sendmsg+0x10/0x10 [ 599.665582][T21048] ? __fget_files+0x2a/0x420 [ 599.665613][T21048] ? __fget_files+0x3a2/0x420 [ 599.665654][T21048] __x64_sys_sendmsg+0x1b1/0x290 [ 599.665687][T21048] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 599.665737][T21048] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.665761][T21048] do_syscall_64+0x174/0x580 [ 599.665792][T21048] ? trace_irq_disable+0x3b/0x140 [ 599.665822][T21048] ? clear_bhb_loop+0x40/0x90 [ 599.665850][T21048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.665872][T21048] RIP: 0033:0x7f196dd9e019 [ 599.665894][T21048] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 599.665914][T21048] RSP: 002b:00007f196eb89028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 599.665939][T21048] RAX: ffffffffffffffda RBX: 00007f196e025fa0 RCX: 00007f196dd9e019 [ 599.665955][T21048] RDX: 0000000024000052 RSI: 00002000000000c0 RDI: 0000000000000003 [ 599.665970][T21048] RBP: 00007f196eb89090 R08: 0000000000000000 R09: 0000000000000000 [ 599.665985][T21048] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 599.665999][T21048] R13: 00007f196e026038 R14: 00007f196e025fa0 R15: 00007ffee1ca47b8 [ 599.666047][T21048] [ 600.167874][T21055] mac80211_hwsim hwsim35 syzkaller0: left promiscuous mode [ 600.189191][T21055] mac80211_hwsim hwsim35 syzkaller0: left allmulticast mode [ 600.273310][T21057] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 600.355142][T21063] xt_hashlimit: max too large, truncated to 1048576 [ 600.371115][T21060] geneve0: entered promiscuous mode [ 600.385039][T21060] macvlan3: entered promiscuous mode [ 600.449557][T21062] __nla_validate_parse: 3 callbacks suppressed [ 600.449581][T21062] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4447'. [ 600.615638][T21062] 8021q: adding VLAN 0 to HW filter on device bond6 [ 600.659399][T21062] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 600.787944][T21072] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 600.812008][T21072] batman_adv: batadv0: Adding interface: gretap1 [ 600.833590][T21072] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.893037][T21072] batman_adv: batadv0: Interface activated: gretap1 [ 600.952747][T21082] FAULT_INJECTION: forcing a failure. [ 600.952747][T21082] name failslab, interval 1, probability 0, space 0, times 0 [ 600.965432][T21082] CPU: 1 UID: 0 PID: 21082 Comm: syz.5.4456 Not tainted syzkaller #0 PREEMPT(full) [ 600.965460][T21082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 600.965473][T21082] Call Trace: [ 600.965483][T21082] [ 600.965493][T21082] dump_stack_lvl+0xe8/0x150 [ 600.965532][T21082] should_fail_ex+0x40c/0x560 [ 600.965567][T21082] should_failslab+0xa8/0x100 [ 600.965603][T21082] __kmalloc_cache_noprof+0xa8/0x660 [ 600.965635][T21082] ? sctp_association_new+0x89/0x25d0 [ 600.965667][T21082] ? sctp_association_new+0x89/0x25d0 [ 600.965707][T21082] sctp_association_new+0x89/0x25d0 [ 600.965742][T21082] ? __ipv6_addr_type+0x23d/0x2f0 [ 600.965775][T21082] sctp_make_temp_asoc+0x89/0x160 [ 600.965807][T21082] sctp_sf_do_unexpected_init+0x91b/0x1340 [ 600.965909][T21082] ? __pfx_sctp_sf_do_unexpected_init+0x10/0x10 [ 600.965937][T21082] ? sctp_do_sm+0x55d4/0x5d50 [ 600.965971][T21082] sctp_do_sm+0x239/0x5d50 [ 600.965995][T21082] ? __pfx_sctp_cname+0x10/0x10 [ 600.966017][T21082] ? do_raw_spin_lock+0x12b/0x2f0 [ 600.966058][T21082] ? __pfx_sctp_do_sm+0x10/0x10 [ 600.966124][T21082] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 600.966163][T21082] ? lockdep_hardirqs_on+0x7a/0x110 [ 600.966194][T21082] ? seqcount_lockdep_reader_access+0xea/0x100 [ 600.966229][T21082] sctp_assoc_bh_rcv+0x401/0x6f0 [ 600.966268][T21082] sctp_backlog_rcv+0x15c/0x370 [ 600.966307][T21082] ? __pfx_sctp_backlog_rcv+0x10/0x10 [ 600.966338][T21082] __release_sock+0x28b/0x390 [ 600.966381][T21082] release_sock+0x190/0x260 [ 600.966408][T21082] sctp_sendmsg+0x1c09/0x2d00 [ 600.966457][T21082] ? __pfx_sctp_sendmsg+0x10/0x10 [ 600.966495][T21082] ? aa_sk_perm+0x6d5/0x900 [ 600.966526][T21082] ? __might_fault+0xaf/0x130 [ 600.966557][T21082] ? sock_rps_record_flow+0x19/0x350 [ 600.966587][T21082] ? inet_sendmsg+0x298/0x320 [ 600.966615][T21082] ? __pfx_inet_sendmsg+0x10/0x10 [ 600.966639][T21082] sock_sendmsg_nosec+0x10e/0x180 [ 600.966676][T21082] ____sys_sendmsg+0x54e/0x850 [ 600.966712][T21082] ? __pfx_____sys_sendmsg+0x10/0x10 [ 600.966751][T21082] ? import_iovec+0x73/0xa0 [ 600.966778][T21082] ___sys_sendmsg+0x2a5/0x360 [ 600.966806][T21082] ? __lock_acquire+0x683/0x2cf0 [ 600.966843][T21082] ? __pfx____sys_sendmsg+0x10/0x10 [ 600.966910][T21082] ? __fget_files+0x2a/0x420 [ 600.966941][T21082] ? __fget_files+0x3a2/0x420 [ 600.966981][T21082] __x64_sys_sendmsg+0x1b1/0x290 [ 600.967013][T21082] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 600.967060][T21082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.967086][T21082] do_syscall_64+0x174/0x580 [ 600.967117][T21082] ? trace_irq_disable+0x3b/0x140 [ 600.967155][T21082] ? clear_bhb_loop+0x40/0x90 [ 600.967184][T21082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.967207][T21082] RIP: 0033:0x7f035799e019 [ 600.967228][T21082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 600.967248][T21082] RSP: 002b:00007f0358786028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 600.967273][T21082] RAX: ffffffffffffffda RBX: 00007f0357c25fa0 RCX: 00007f035799e019 [ 600.967289][T21082] RDX: 0000000024000052 RSI: 00002000000000c0 RDI: 0000000000000003 [ 600.967305][T21082] RBP: 00007f0358786090 R08: 0000000000000000 R09: 0000000000000000 [ 600.967319][T21082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 600.967333][T21082] R13: 00007f0357c26038 R14: 00007f0357c25fa0 R15: 00007fff21b31df8 [ 600.967370][T21082] [ 601.775174][T21102] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4457'. [ 601.836426][T21095] netlink: 'syz.5.4458': attribute type 9 has an invalid length. [ 601.863619][T21105] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4462'. [ 601.877879][T21108] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4464'. [ 601.887036][T21095] netlink: 'syz.5.4458': attribute type 6 has an invalid length. [ 601.902146][T21095] netlink: 'syz.5.4458': attribute type 7 has an invalid length. [ 601.912409][T21108] netlink: 'syz.2.4464': attribute type 30 has an invalid length. [ 601.945206][T21095] netlink: 'syz.5.4458': attribute type 8 has an invalid length. [ 601.958015][T21111] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4464'. [ 601.966958][T21111] netlink: 'syz.2.4464': attribute type 30 has an invalid length. [ 601.986180][T21105] macvtap7: entered promiscuous mode [ 601.994666][T21105] macvtap7: entered allmulticast mode [ 602.188965][ T80] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.202232][ T80] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.213355][T21120] FAULT_INJECTION: forcing a failure. [ 602.213355][T21120] name failslab, interval 1, probability 0, space 0, times 0 [ 602.240739][ T47] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.255678][ T47] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.266063][T21120] CPU: 1 UID: 0 PID: 21120 Comm: syz.2.4468 Not tainted syzkaller #0 PREEMPT(full) [ 602.266093][T21120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 602.266107][T21120] Call Trace: [ 602.266117][T21120] [ 602.266127][T21120] dump_stack_lvl+0xe8/0x150 [ 602.266166][T21120] should_fail_ex+0x40c/0x560 [ 602.266201][T21120] should_failslab+0xa8/0x100 [ 602.266235][T21120] __kmalloc_cache_noprof+0xa8/0x660 [ 602.266263][T21120] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 602.266289][T21120] ? __kmalloc_cache_noprof+0x150/0x660 [ 602.266315][T21120] ? sctp_add_bind_addr+0x8c/0x370 [ 602.266338][T21120] ? sctp_add_bind_addr+0x8c/0x370 [ 602.266369][T21120] sctp_add_bind_addr+0x8c/0x370 [ 602.266399][T21120] sctp_copy_local_addr_list+0x31a/0x4e0 [ 602.266428][T21120] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 602.266455][T21120] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 602.266483][T21120] ? sctp_v6_is_any+0x64/0x80 [ 602.266512][T21120] ? sctp_copy_one_addr+0x93/0x360 [ 602.266541][T21120] sctp_bind_addr_copy+0xb3/0x3c0 [ 602.266578][T21120] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 602.266604][T21120] sctp_connect_new_asoc+0x2ff/0x6b0 [ 602.266639][T21120] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 602.266677][T21120] ? __local_bh_enable_ip+0xd0/0x130 [ 602.266702][T21120] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 602.266727][T21120] ? security_sctp_bind_connect+0x7e/0x2c0 [ 602.266764][T21120] sctp_sendmsg+0x159b/0x2d00 [ 602.266811][T21120] ? __pfx_sctp_sendmsg+0x10/0x10 [ 602.266849][T21120] ? aa_sk_perm+0x6d5/0x900 [ 602.266879][T21120] ? __might_fault+0xaf/0x130 [ 602.266909][T21120] ? sock_rps_record_flow+0x19/0x350 [ 602.266939][T21120] ? inet_sendmsg+0x298/0x320 [ 602.266965][T21120] ? __pfx_inet_sendmsg+0x10/0x10 [ 602.266988][T21120] sock_sendmsg_nosec+0x10e/0x180 [ 602.267024][T21120] ____sys_sendmsg+0x54e/0x850 [ 602.267058][T21120] ? __pfx_____sys_sendmsg+0x10/0x10 [ 602.267095][T21120] ? import_iovec+0x73/0xa0 [ 602.267120][T21120] ___sys_sendmsg+0x2a5/0x360 [ 602.267146][T21120] ? __lock_acquire+0x683/0x2cf0 [ 602.267182][T21120] ? __pfx____sys_sendmsg+0x10/0x10 [ 602.267248][T21120] ? __fget_files+0x2a/0x420 [ 602.267277][T21120] ? __fget_files+0x3a2/0x420 [ 602.267318][T21120] __x64_sys_sendmsg+0x1b1/0x290 [ 602.267348][T21120] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 602.267393][T21120] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.267417][T21120] do_syscall_64+0x174/0x580 [ 602.267447][T21120] ? trace_irq_disable+0x3b/0x140 [ 602.267475][T21120] ? clear_bhb_loop+0x40/0x90 [ 602.267502][T21120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.267524][T21120] RIP: 0033:0x7f546179e019 [ 602.267545][T21120] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 602.267583][T21120] RSP: 002b:00007f54626c0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 602.267605][T21120] RAX: ffffffffffffffda RBX: 00007f5461a25fa0 RCX: 00007f546179e019 [ 602.267620][T21120] RDX: 0000000024000052 RSI: 00002000000000c0 RDI: 0000000000000003 [ 602.267633][T21120] RBP: 00007f54626c0090 R08: 0000000000000000 R09: 0000000000000000 [ 602.267645][T21120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 602.267658][T21120] R13: 00007f5461a26038 R14: 00007f5461a25fa0 R15: 00007ffd8a576788 [ 602.267691][T21120] [ 603.087185][T21138] netlink: 'syz.4.4475': attribute type 1 has an invalid length. [ 603.164260][T21138] 8021q: adding VLAN 0 to HW filter on device bond6 [ 603.177285][T21145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4476'. [ 603.196323][T21146] 8021q: adding VLAN 0 to HW filter on device team0 [ 603.209838][T21146] bond6: (slave team0): Enslaving as an active interface with a down link [ 603.234360][T21145] macvtap9: entered promiscuous mode [ 603.240165][T21145] macvtap9: entered allmulticast mode [ 603.247634][T21138] bond6: entered promiscuous mode [ 603.252840][T21138] bond6: entered allmulticast mode [ 603.312509][T21149] netlink: zone id is out of range [ 603.358238][T21152] netlink: 596 bytes leftover after parsing attributes in process `syz.4.4478'. [ 603.543323][T21158] Bluetooth: MGMT ver 1.23 [ 603.552767][T21158] syzkaller0: entered promiscuous mode [ 603.558397][T21158] syzkaller0: entered allmulticast mode [ 604.332785][T21189] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4492'. [ 604.342588][T21189] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4492'. [ 604.351491][T21189] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 604.742720][T21206] syzkaller0: entered promiscuous mode [ 604.748271][T21206] syzkaller0: entered allmulticast mode [ 604.821037][T21214] batman_adv: batadv0: Adding interface: ip6gretap1 [ 604.827907][T21214] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.889769][T21214] batman_adv: batadv0: Not using interface ip6gretap1 (retrying later): interface not active [ 605.395518][T21248] syz_tun: entered allmulticast mode [ 605.466106][T21248] dvmrp8: entered allmulticast mode [ 605.545700][T21253] tun0: tun_chr_ioctl cmd 1074812117 [ 605.610154][T21257] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 605.677177][T21251] syz_tun: left allmulticast mode [ 605.951423][T21277] netlink: 'syz.1.4521': attribute type 1 has an invalid length. [ 606.467294][T21306] xt_hashlimit: max too large, truncated to 1048576 [ 606.914555][T21314] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4531'. [ 607.317860][T21332] syzkaller0: refused to change device tx_queue_len [ 607.425493][T21341] xt_hashlimit: max too large, truncated to 1048576 [ 607.481593][T21347] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4541'. [ 607.549962][T21338] bond2: option min_links: invalid value (18446744073709551612) [ 607.557880][T21338] bond2: option min_links: allowed values 0 - 2147483647 [ 607.703584][T21355] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 607.759841][T21338] bond2 (unregistering): Released all slaves [ 608.012880][T21359] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4545'. [ 608.182173][T21367] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4549'. [ 608.227048][T21369] ip6tnl1: entered allmulticast mode [ 608.269764][ T6896] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 608.277704][ T6896] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 608.380268][T17689] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 608.488192][T21380] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4551'. [ 608.595320][T21385] netlink: 'syz.0.4553': attribute type 1 has an invalid length. [ 608.635810][T21391] netlink: 'syz.5.4555': attribute type 1 has an invalid length. [ 608.666201][T21385] 8021q: adding VLAN 0 to HW filter on device bond7 [ 608.674489][T21391] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 608.722019][T21394] 8021q: adding VLAN 0 to HW filter on device bond7 [ 608.743179][T21394] bond7: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 608.755140][T21394] bond7: (slave ip6gre0): Error -95 calling set_mac_address [ 608.885004][T21401] netlink: 'syz.1.4557': attribute type 1 has an invalid length. [ 608.957667][T21401] 8021q: adding VLAN 0 to HW filter on device bond2 [ 609.034040][T17689] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 609.071247][T21401] macvlan4: entered promiscuous mode [ 609.079670][T21401] macvlan4: entered allmulticast mode [ 609.085571][T21401] bond2: entered allmulticast mode [ 609.090811][T21401] bond2: entered promiscuous mode [ 609.096686][T21401] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 609.105357][T21401] team0: Port device macvlan4 added [ 609.176500][T17689] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 609.208425][T21401] bond2: (slave ip6gretap1): making interface the new active one [ 609.216239][T21401] ip6gretap1: entered promiscuous mode [ 609.268001][T21401] ip6gretap1: entered allmulticast mode [ 609.275558][T21401] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 609.397941][T21413] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4561'. [ 609.454674][T21417] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4563'. [ 609.480188][T21413] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 609.949203][T21435] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4567'. [ 610.044535][T21435] bond3 (unregistering): Released all slaves [ 610.421369][T21442] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4568'. [ 610.446988][T21442] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4568'. [ 611.096523][T21471] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 611.196123][T21476] netlink: 'syz.4.4581': attribute type 2 has an invalid length. [ 611.234033][T21476] netlink: 'syz.4.4581': attribute type 2 has an invalid length. [ 611.846819][T21499] hsr0: entered promiscuous mode [ 611.921489][T21499] hsr_slave_0: left promiscuous mode [ 612.004263][T21499] hsr_slave_1: left promiscuous mode [ 612.080536][T21499] hsr0 (unregistering): left promiscuous mode [ 612.212448][T21516] __nla_validate_parse: 7 callbacks suppressed [ 612.212468][T21516] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4593'. [ 612.387408][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 612.593225][T21545] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4597'. [ 612.696967][T21540] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 613.029835][T21561] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4606'. [ 613.039432][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.052802][T21567] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4605'. [ 613.063262][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.071530][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.082819][T21561] netlink: 4096 bytes leftover after parsing attributes in process `syz.1.4606'. [ 613.087110][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.108455][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.129123][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.148493][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.169403][T21563] netlink: 'syz.5.4607': attribute type 2 has an invalid length. [ 613.209683][T21570] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4609'. [ 613.490067][T21575] bridge0: port 2(bridge_slave_1) entered disabled state [ 613.679145][T21592] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 613.836605][T21598] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4620'. [ 613.885613][T21595] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4615'. [ 614.123891][T21605] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4622'. [ 614.195947][T21605] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 614.241585][T21610] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4623'. [ 615.035775][T21627] syzkaller0: entered promiscuous mode [ 615.041316][T21627] syzkaller0: entered allmulticast mode [ 615.129860][T21636] bond1: (slave syz_tun): Releasing active interface [ 615.154346][T21636] bond6: (slave team0): Releasing active interface [ 615.183500][T21636] veth0: left allmulticast mode [ 615.188628][T21636] veth0: left promiscuous mode [ 615.193982][T21636] bridge0: port 4(veth0) entered disabled state [ 615.222543][T21636] bridge_slave_0: left allmulticast mode [ 615.228347][T21636] bridge_slave_0: left promiscuous mode [ 615.234180][T21636] bridge0: port 1(bridge_slave_0) entered disabled state [ 615.250314][T21636] bridge_slave_1: left promiscuous mode [ 615.256229][T21636] bridge0: port 2(bridge_slave_1) entered disabled state [ 615.272057][T21636] bond0: (slave bond_slave_0): Releasing backup interface [ 615.282740][T21636] bond0: (slave bond_slave_1): Releasing backup interface [ 615.294220][T21636] team0: Port device team_slave_0 removed [ 615.302034][T21636] team0: Port device team_slave_1 removed [ 615.308106][T21636] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 615.329782][T21636] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 615.340617][T21636] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 615.530068][T21657] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20002 [ 617.714559][T21660] macvtap5: left promiscuous mode [ 617.720790][T21660] macvtap5: left allmulticast mode [ 617.775542][T21665] __nla_validate_parse: 1 callbacks suppressed [ 617.775565][T21665] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4635'. [ 617.800276][T21660] macvtap6: left promiscuous mode [ 617.805372][T21660] macvtap6: left allmulticast mode [ 617.813720][T21660] geneve0: left promiscuous mode [ 617.828701][T21660] macvlan3: left promiscuous mode [ 617.843687][T21660] batman_adv: batadv0: Interface deactivated: gretap1 [ 617.872591][T21660] dummy0: left allmulticast mode [ 617.906299][T21667] validate_nla: 57 callbacks suppressed [ 617.906320][T21667] netlink: 'syz.4.4636': attribute type 2 has an invalid length. [ 617.922208][T21660] macvtap7: left promiscuous mode [ 617.927329][T21660] macvtap7: left allmulticast mode [ 617.974882][T21660] bond2: left allmulticast mode [ 617.979821][T21660] ip6gretap1: left allmulticast mode [ 617.985148][T21660] bond2: left promiscuous mode [ 617.989950][T21660] ip6gretap1: left promiscuous mode [ 618.035453][T21672] netlink: 'syz.4.4637': attribute type 10 has an invalid length. [ 618.044248][T21660] macvlan4: left promiscuous mode [ 618.049329][T21660] macvlan4: left allmulticast mode [ 618.161629][T21672] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 618.238700][T21677] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4638'. [ 618.271267][T21677] netlink: 'syz.2.4638': attribute type 1 has an invalid length. [ 618.352978][T21684] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4640'. [ 618.365267][T21685] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4638'. [ 618.387245][T21677] 8021q: adding VLAN 0 to HW filter on device bond3 [ 618.394724][T21680] bridge0: entered allmulticast mode [ 618.415677][T21680] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4639'. [ 618.487310][T21677] bond3: (slave geneve3): making interface the new active one [ 618.496890][T21684] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 618.506994][T21677] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 618.516057][T21680] bridge_slave_1: left promiscuous mode [ 618.525633][T21680] bridge0: port 2(bridge_slave_1) entered disabled state [ 618.534696][T21689] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4639'. [ 618.539351][T21680] bridge_slave_0: left allmulticast mode [ 618.549353][T21680] bridge_slave_0: left promiscuous mode [ 618.555252][T21680] bridge0: port 1(bridge_slave_0) entered disabled state [ 618.583486][T21680] bridge0 (unregistering): left allmulticast mode [ 618.605837][T21690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4639'. [ 618.616790][T21690] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4639'. [ 618.713026][T21694] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4643'. [ 618.845518][T21701] netlink: 'syz.5.4645': attribute type 13 has an invalid length. [ 618.858133][T21701] netlink: 'syz.5.4645': attribute type 17 has an invalid length. [ 619.191184][T21709] IPVS: length: 24 != 55320 [ 619.299467][T21714] netlink: 'syz.1.4649': attribute type 1 has an invalid length. [ 619.475708][T21719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4649'. [ 619.590503][T21698] dummy0: left allmulticast mode [ 619.664445][T21701] 8021q: adding VLAN 0 to HW filter on device bond0 [ 619.673324][T21701] 8021q: adding VLAN 0 to HW filter on device team0 [ 619.712480][T21701] dummy0: left promiscuous mode [ 619.720489][T21701] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 619.779871][T21701] bridge_slave_1: left allmulticast mode [ 619.828999][T21722] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 619.857778][T21701] 0·: left allmulticast mode [ 619.862504][T21701] hsr_slave_0: left allmulticast mode [ 619.867920][T21701] hsr_slave_1: left allmulticast mode [ 619.878611][T21701] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 619.899733][T21703] vlan2: entered promiscuous mode [ 619.905638][T21703] bridge0: entered promiscuous mode [ 620.167105][T21705] bridge0: port 1(bridge_slave_0) entered disabled state [ 620.447826][T21705] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 620.596384][T21705] macvtap1: left promiscuous mode [ 620.601560][T21705] macvtap1: left allmulticast mode [ 620.611626][T21705] macvtap2: left promiscuous mode [ 620.616798][T21705] macvtap2: left allmulticast mode [ 620.625118][T21705] xfrm1: left promiscuous mode [ 620.630033][T21705] xfrm1: left allmulticast mode [ 620.639150][T21705] macvtap3: left promiscuous mode [ 620.644242][T21705] macvtap3: left allmulticast mode [ 620.670867][T21705] macvtap4: left promiscuous mode [ 620.676074][T21705] macvtap4: left allmulticast mode [ 620.707807][T21705] macvtap5: left promiscuous mode [ 620.712955][T21705] macvtap5: left allmulticast mode [ 620.727824][T21705] macvtap6: left promiscuous mode [ 620.732965][T21705] macvtap6: left allmulticast mode [ 620.772242][T21705] macvtap7: left promiscuous mode [ 620.777342][T21705] macvtap7: left allmulticast mode [ 620.821539][T21705] macvtap8: left promiscuous mode [ 620.826608][T21705] macvtap8: left allmulticast mode [ 620.850152][T21705] bond1: left promiscuous mode [ 620.932721][T21705] dummy0: left allmulticast mode [ 620.938077][T21705] macvtap9: left promiscuous mode [ 620.943143][T21705] macvtap9: left allmulticast mode [ 620.959859][T21705] vlan2: left promiscuous mode [ 620.964687][T21705] bridge0: left promiscuous mode [ 621.005768][T21714] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 621.104490][T21739] netlink: 'syz.2.4654': attribute type 62 has an invalid length. [ 621.150095][T21527] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.170245][T21527] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.180304][T21527] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.208442][T21527] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.257586][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 621.292123][ T36] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.301065][ T36] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.309967][ T36] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 621.387505][ T36] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.396982][ T36] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.411052][ T36] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 621.458697][T21749] bridge0: entered allmulticast mode [ 621.557388][T21749] bond0: (slave bridge0): Releasing backup interface [ 621.640194][T21753] tc_dump_action: action bad kind [ 621.682367][T21764] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 621.704792][T21751] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 621.721537][ T6896] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.730457][ T6896] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.739368][ T6896] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 621.748378][ T6896] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.757306][ T6896] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.766611][ T6896] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 622.887548][ T5621] block nbd5: Receive control failed (result -32) [ 623.091442][T21797] __nla_validate_parse: 5 callbacks suppressed [ 623.091463][T21797] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4672'. [ 623.556370][T21814] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 623.748962][T21801] vlan2: entered allmulticast mode [ 623.754235][T21801] bond0: entered allmulticast mode [ 624.003695][T21828] syzkaller0: entered promiscuous mode [ 624.009264][T21828] syzkaller0: entered allmulticast mode [ 624.072345][T21832] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4681'. [ 624.393056][T21843] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4687'. [ 624.410178][T21845] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4688'. [ 624.594708][T21852] FAULT_INJECTION: forcing a failure. [ 624.594708][T21852] name failslab, interval 1, probability 0, space 0, times 0 [ 624.623026][T21852] CPU: 0 UID: 0 PID: 21852 Comm: syz.4.4691 Not tainted syzkaller #0 PREEMPT(full) [ 624.623056][T21852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 624.623070][T21852] Call Trace: [ 624.623079][T21852] [ 624.623089][T21852] dump_stack_lvl+0xe8/0x150 [ 624.623128][T21852] should_fail_ex+0x40c/0x560 [ 624.623161][T21852] should_failslab+0xa8/0x100 [ 624.623195][T21852] __kmalloc_cache_noprof+0xa8/0x660 [ 624.623224][T21852] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 624.623250][T21852] ? __kmalloc_cache_noprof+0x150/0x660 [ 624.623277][T21852] ? sctp_add_bind_addr+0x8c/0x370 [ 624.623300][T21852] ? sctp_add_bind_addr+0x8c/0x370 [ 624.623332][T21852] sctp_add_bind_addr+0x8c/0x370 [ 624.623362][T21852] sctp_copy_local_addr_list+0x31a/0x4e0 [ 624.623390][T21852] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 624.623417][T21852] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 624.623446][T21852] ? sctp_v6_is_any+0x64/0x80 [ 624.623475][T21852] ? sctp_copy_one_addr+0x93/0x360 [ 624.623504][T21852] sctp_bind_addr_copy+0xb3/0x3c0 [ 624.623532][T21852] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 624.623559][T21852] sctp_connect_new_asoc+0x2ff/0x6b0 [ 624.623595][T21852] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 624.623634][T21852] ? __local_bh_enable_ip+0xd0/0x130 [ 624.623660][T21852] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 624.623697][T21852] ? security_sctp_bind_connect+0x7e/0x2c0 [ 624.623752][T21852] sctp_sendmsg+0x159b/0x2d00 [ 624.623801][T21852] ? __pfx_sctp_sendmsg+0x10/0x10 [ 624.623841][T21852] ? aa_sk_perm+0x6d5/0x900 [ 624.623872][T21852] ? __might_fault+0xaf/0x130 [ 624.623904][T21852] ? sock_rps_record_flow+0x19/0x350 [ 624.623934][T21852] ? inet_sendmsg+0x298/0x320 [ 624.623962][T21852] ? __pfx_inet_sendmsg+0x10/0x10 [ 624.623986][T21852] sock_sendmsg_nosec+0x10e/0x180 [ 624.624024][T21852] ____sys_sendmsg+0x54e/0x850 [ 624.624059][T21852] ? __pfx_____sys_sendmsg+0x10/0x10 [ 624.624099][T21852] ? import_iovec+0x73/0xa0 [ 624.624125][T21852] ___sys_sendmsg+0x2a5/0x360 [ 624.624153][T21852] ? __lock_acquire+0x683/0x2cf0 [ 624.624190][T21852] ? __pfx____sys_sendmsg+0x10/0x10 [ 624.624255][T21852] ? __fget_files+0x2a/0x420 [ 624.624284][T21852] ? __fget_files+0x3a2/0x420 [ 624.624327][T21852] __x64_sys_sendmsg+0x1b1/0x290 [ 624.624361][T21852] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 624.624414][T21852] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.624440][T21852] do_syscall_64+0x174/0x580 [ 624.624471][T21852] ? trace_irq_disable+0x3b/0x140 [ 624.624500][T21852] ? clear_bhb_loop+0x40/0x90 [ 624.624529][T21852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.624552][T21852] RIP: 0033:0x7f196dd9e019 [ 624.624573][T21852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 624.624593][T21852] RSP: 002b:00007f196eb89028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 624.624618][T21852] RAX: ffffffffffffffda RBX: 00007f196e025fa0 RCX: 00007f196dd9e019 [ 624.624634][T21852] RDX: 0000000024000052 RSI: 00002000000000c0 RDI: 0000000000000003 [ 624.624649][T21852] RBP: 00007f196eb89090 R08: 0000000000000000 R09: 0000000000000000 [ 624.624663][T21852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 624.624677][T21852] R13: 00007f196e026038 R14: 00007f196e025fa0 R15: 00007ffee1ca47b8 [ 624.624721][T21852] [ 625.304538][T21868] netlink: 'syz.4.4695': attribute type 1 has an invalid length. [ 627.202067][T21850] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 627.306130][T21868] 8021q: adding VLAN 0 to HW filter on device bond7 [ 627.368993][T21869] bond7: (slave veth9): Enslaving as an active interface with a down link [ 627.427601][T21871] bond7: (slave veth11): Enslaving as an active interface with a down link [ 627.569882][T21887] xt_hashlimit: max too large, truncated to 1048576 [ 627.668779][T21889] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4702'. [ 627.816723][T21894] netlink: 'syz.4.4701': attribute type 2 has an invalid length. [ 627.998202][T21904] IPVS: set_ctl: invalid protocol: 47 172.30.1.3:21 [ 628.193523][T21912] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4710'. [ 628.350203][T21918] xt_hashlimit: max too large, truncated to 1048576 [ 628.431275][T21920] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4714'. [ 628.438271][T21922] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4715'. [ 628.481832][T21920] netlink: 'syz.5.4714': attribute type 1 has an invalid length. [ 628.496359][T21920] netlink: 'syz.5.4714': attribute type 1 has an invalid length. [ 628.691838][T21933] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 628.716829][T21933] bridge1: entered allmulticast mode [ 628.812884][T21937] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4720'. [ 629.056819][T21957] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4727'. [ 629.060251][T21959] xt_hashlimit: max too large, truncated to 1048576 [ 629.336556][T21970] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4732'. [ 629.727559][T21992] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4739'. [ 629.752535][T21994] xt_hashlimit: max too large, truncated to 1048576 [ 629.903363][T22002] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4743'. [ 629.984363][T22003] netlink: 5 bytes leftover after parsing attributes in process `syz.1.4743'. [ 630.354537][T22017] xt_SECMARK: invalid mode: 9 [ 630.559279][T22028] Cannot find set identified by id 65535 to match [ 630.637629][T22033] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4753'. [ 630.672753][T22033] macvtap10: entered promiscuous mode [ 630.678656][T22037] xt_hashlimit: max too large, truncated to 1048576 [ 630.687890][T22033] macvtap10: entered allmulticast mode [ 630.702171][T22033] dummy0: entered allmulticast mode [ 632.165107][T22077] xt_hashlimit: max too large, truncated to 1048576 [ 632.698995][T22106] xt_hashlimit: max too large, truncated to 1048576 [ 632.765540][T22108] xt_hashlimit: size too large, truncated to 1048576 [ 633.771167][T22143] __nla_validate_parse: 2 callbacks suppressed [ 633.771188][T22143] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4791'. [ 633.816841][T22143] netlink: 'syz.0.4791': attribute type 2 has an invalid length. [ 633.829875][T22147] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4791'. [ 633.848460][T22143] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4791'. [ 633.970535][T22160] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4795'. [ 634.259009][T22176] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4801'. [ 634.338683][T22179] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4802'. [ 634.484144][T22189] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 634.541134][T22193] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4807'. [ 635.050018][T22222] sch_tbf: burst 32855 is lower than device lo mtu (11337746) ! [ 635.155128][T22227] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4821'. [ 635.528132][T22247] xt_hashlimit: max too large, truncated to 1048576 [ 635.766493][T22259] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4833'. [ 635.868964][T22256] macvtap11: entered promiscuous mode [ 635.878139][T22256] batadv0: entered promiscuous mode [ 635.887063][T22256] macvtap11: entered allmulticast mode [ 635.893375][T22256] batadv0: entered allmulticast mode [ 635.906017][T22256] 8021q: adding VLAN 0 to HW filter on device macvtap11 [ 635.944125][T22256] batadv0: left allmulticast mode [ 635.956626][T22256] batadv0: left promiscuous mode [ 636.160856][T22272] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4838'. [ 636.765202][T22294] xt_hashlimit: max too large, truncated to 1048576 [ 637.709436][T22321] vlan3: entered allmulticast mode [ 637.719220][T22321] bridge1: entered allmulticast mode [ 637.743363][T22321] bridge1: port 1(erspan0) entered blocking state [ 637.756270][T22321] bridge1: port 1(erspan0) entered disabled state [ 637.771007][T22321] erspan0: entered allmulticast mode [ 637.787096][T22321] erspan0: entered promiscuous mode [ 637.816287][T22321] bridge1: port 1(erspan0) entered blocking state [ 637.822978][T22321] bridge1: port 1(erspan0) entered forwarding state [ 637.914056][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 638.081090][T22333] tipc: Enabling of bearer rejected, failed to enable media [ 638.913596][T22356] syzkaller0: entered promiscuous mode [ 638.919946][T22356] syzkaller0: entered allmulticast mode [ 638.942186][T22359] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 638.967081][T22360] netlink: Unknown conntrack attr (0) [ 638.985209][T22360] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 639.594977][T22385] netlink: 'syz.2.4878': attribute type 13 has an invalid length. [ 639.607093][T22385] __nla_validate_parse: 4 callbacks suppressed [ 639.607202][T22385] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4878'. [ 640.113394][T22400] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4884'. [ 640.153145][T22400] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4884'. [ 640.367817][T22396] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4881'. [ 640.401898][T22405] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 640.457779][T22405] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 640.814383][T22419] netlink: 'syz.1.4887': attribute type 11 has an invalid length. [ 641.078510][T22425] netlink: 180 bytes leftover after parsing attributes in process `syz.4.4888'. [ 641.082834][T22432] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4892'. [ 641.354733][T22445] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4896'. [ 641.369193][T22445] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4896'. [ 641.694408][T22457] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4903'. [ 641.703516][T22457] netlink: 'syz.0.4903': attribute type 2 has an invalid length. [ 641.711275][T22457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4903'. [ 641.992469][T22467] syzkaller0: left promiscuous mode [ 642.038156][T22467] syzkaller0: left allmulticast mode [ 642.371257][T22477] tipc: Enabling of bearer rejected, already enabled [ 643.343023][T22503] xt_hashlimit: max too large, truncated to 1048576 [ 643.395309][T22501] netlink: 'syz.0.4918': attribute type 1 has an invalid length. [ 643.574347][T22501] 8021q: adding VLAN 0 to HW filter on device bond8 [ 643.660696][T22501] syzkaller0: entered promiscuous mode [ 643.670680][T22501] syzkaller0: entered allmulticast mode [ 643.707081][T22520] openvswitch: netlink: Duplicate or invalid key (type 0). [ 643.898843][T22527] netlink: 'syz.0.4926': attribute type 1 has an invalid length. [ 644.244328][T22551] bond8 (unregistering): Released all slaves [ 644.283494][T22554] tipc: New replicast peer: 172.20.20.170 [ 644.290135][T22554] tipc: Enabled bearer , priority 10 [ 644.346328][T22554] tipc: New replicast peer: 0.0.0.0 [ 644.745988][T22571] netlink: 'syz.4.4942': attribute type 1 has an invalid length. [ 644.941845][T22571] 8021q: adding VLAN 0 to HW filter on device bond8 [ 644.958389][T22578] 8021q: adding VLAN 0 to HW filter on device bond8 [ 644.967276][T22578] bond8: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 644.978520][T22578] bond8: (slave ip6gre0): Error -95 calling set_mac_address [ 645.124368][T22584] __nla_validate_parse: 11 callbacks suppressed [ 645.124390][T22584] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4947'. [ 645.180836][T22584] vlan5: entered promiscuous mode [ 645.185936][T22584] gretap0: entered promiscuous mode [ 645.284277][ T5740] tipc: Node number set to 59 [ 645.395271][T22600] v: renamed from dummy0 [ 645.417645][T22602] netlink: 'syz.2.4951': attribute type 1 has an invalid length. [ 645.431662][T22601] netlink: 'syz.2.4951': attribute type 1 has an invalid length. [ 645.483358][T22602] 8021q: adding VLAN 0 to HW filter on device bond5 [ 645.504697][T22600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 645.517089][T22600] bond5: (slave batadv0): making interface the new active one [ 645.526261][T22600] bond5: (slave batadv0): Enslaving as an active interface with an up link [ 645.751151][T22619] bridge_slave_1: invalid flags given to default FDB implementation [ 645.765383][T22621] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4954'. [ 645.778583][T22619] bridge_slave_1: invalid flags given to default FDB implementation [ 645.937397][T22624] netlink: 'syz.2.4959': attribute type 1 has an invalid length. [ 645.982406][T22624] 8021q: adding VLAN 0 to HW filter on device bond6 [ 646.068676][T22624] bond6: (slave geneve4): making interface the new active one [ 646.078450][T22624] bond6: (slave geneve4): Enslaving as an active interface with an up link [ 646.087924][T21534] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 646.108689][T21534] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 646.140157][T22632] netlink: 'syz.1.4960': attribute type 1 has an invalid length. [ 646.189030][T22634] xt_hashlimit: max too large, truncated to 1048576 [ 646.260086][T22632] 8021q: adding VLAN 0 to HW filter on device bond3 [ 646.325523][T22631] 8021q: adding VLAN 0 to HW filter on device bond3 [ 646.367397][T22631] bond3: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 646.383381][T22631] bond3: (slave ip6gre0): Error -95 calling set_mac_address [ 646.404259][T22624] syzkaller0: entered promiscuous mode [ 646.412758][T22624] syzkaller0: entered allmulticast mode [ 646.682867][T22654] C: renamed from veth1_to_team [ 646.703960][T22654] netlink: 164 bytes leftover after parsing attributes in process `syz.1.4965'. [ 646.957214][T22670] netlink: 'syz.0.4974': attribute type 1 has an invalid length. [ 646.990620][T22670] 8021q: adding VLAN 0 to HW filter on device bond10 [ 647.016636][T22670] 8021q: adding VLAN 0 to HW filter on device bond10 [ 647.062372][T22670] bond10: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 647.073880][T22670] bond10: (slave ip6gre0): Error -95 calling set_mac_address [ 647.139844][ T6896] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.161774][ T6896] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.649908][T22706] netlink: 'syz.0.4986': attribute type 1 has an invalid length. [ 647.803839][T22706] 8021q: adding VLAN 0 to HW filter on device bond11 [ 647.860705][T22710] 8021q: adding VLAN 0 to HW filter on device bond11 [ 647.867924][T22710] bond11: (slave ip6tnl0): The slave device specified does not support setting the MAC address [ 647.887491][T22710] bond11: (slave ip6tnl0): Error -95 calling set_mac_address [ 648.094726][T22724] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4989'. [ 648.205801][T22725] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4992'. [ 648.239392][T22727] netlink: 'syz.1.4991': attribute type 2 has an invalid length. [ 648.256164][T22727] netlink: 'syz.1.4991': attribute type 2 has an invalid length. [ 648.309856][T22734] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4990'. [ 648.324556][T22725] macvtap6: entered promiscuous mode [ 648.350114][T22725] dummy0: entered promiscuous mode [ 648.355562][T22725] macvtap6: entered allmulticast mode [ 648.360981][T22725] dummy0: entered allmulticast mode [ 648.655380][T22755] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4999'. [ 648.681949][T22755] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 648.757432][T22762] netlink: 'syz.1.5000': attribute type 1 has an invalid length. [ 648.807896][T22767] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5003'. [ 648.872741][T22762] 8021q: adding VLAN 0 to HW filter on device bond4 [ 648.905106][T22768] 8021q: adding VLAN 0 to HW filter on device bond4 [ 648.925261][T22768] bond4: (slave ip6tnl0): The slave device specified does not support setting the MAC address [ 648.936442][T22768] bond4: (slave ip6tnl0): Error -95 calling set_mac_address [ 649.329734][T22793] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5010'. [ 649.338933][T22793] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5010'. [ 649.562635][T22801] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 650.139226][T22845] __nla_validate_parse: 5 callbacks suppressed [ 650.139247][T22845] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5030'. [ 650.164303][T22849] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5032'. [ 650.179327][T22845] macvtap5: entered promiscuous mode [ 650.184931][T22845] macvtap5: entered allmulticast mode [ 650.514486][T22853] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.549035][T22869] netlink: 5 bytes leftover after parsing attributes in process `syz.1.5038'. [ 650.802225][T22879] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5045'. [ 650.824250][T22878] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5046'. [ 650.840669][T22881] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5047'. [ 650.849586][T22881] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5047'. [ 650.919874][T22881] validate_nla: 1 callbacks suppressed [ 650.919905][T22881] netlink: 'syz.5.5047': attribute type 12 has an invalid length. [ 650.933255][T22881] netlink: 'syz.5.5047': attribute type 11 has an invalid length. [ 650.984314][T22878] macvtap3: entered promiscuous mode [ 650.992119][T22878] macvtap3: entered allmulticast mode [ 650.997696][T22878] dummy0: entered allmulticast mode [ 651.042855][T22853] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.068525][T22889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5050'. [ 651.163170][T22892] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5052'. [ 651.174582][T22889] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 651.359370][T22902] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5054'. [ 651.374219][T22853] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.600298][T22853] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.834786][T22924] xt_hashlimit: max too large, truncated to 1048576 [ 652.309164][ T6896] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.338959][ T6896] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.376101][T22939] netlink: 'syz.4.5066': attribute type 1 has an invalid length. [ 652.388164][ T6896] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.408400][ T6896] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 652.528575][T22942] geneve0: left promiscuous mode [ 652.915316][T22942] dummy0: left allmulticast mode [ 652.988816][T21527] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.010126][T21527] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.029039][T21527] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.045130][T21527] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.301753][T22955] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 653.347112][T22967] xt_hashlimit: max too large, truncated to 1048576 [ 654.779237][T23017] syzkaller1: entered promiscuous mode [ 654.785003][T23017] syzkaller1: entered allmulticast mode [ 655.277869][T23030] __nla_validate_parse: 8 callbacks suppressed [ 655.277891][T23030] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 655.344924][T23030] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.812657][T23062] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 656.340765][T23083] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5108'. [ 656.622749][T23100] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5114'. [ 656.859262][T23108] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5117'. [ 656.908902][T23108] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 657.516990][T23132] netlink: 'syz.4.5126': attribute type 1 has an invalid length. [ 657.563995][T23134] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5128'. [ 657.580430][T23131] netlink: 'syz.4.5126': attribute type 1 has an invalid length. [ 657.594273][T23134] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5128'. [ 657.629088][T23139] netlink: 'syz.0.5127': attribute type 1 has an invalid length. [ 657.723965][T23139] 8021q: adding VLAN 0 to HW filter on device bond12 [ 657.742619][T23141] bond12: (slave erspan0): making interface the new active one [ 657.751987][T23141] bond12: (slave erspan0): Enslaving as an active interface with an up link [ 657.993311][T23159] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5136'. [ 658.328851][T23167] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5140'. [ 658.345983][T23172] syzkaller1: entered allmulticast mode [ 658.532167][T23183] x_tables: ip_tables: hashlimit.1 match: invalid size 56 (kernel) != (user) 616 [ 658.850432][T23191] macsec1: entered promiscuous mode [ 659.080318][T23210] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5158'. [ 659.089378][T23210] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5158'. [ 659.106465][T23210] macvlan10: entered allmulticast mode [ 659.112404][T23210] erspan0: entered allmulticast mode [ 659.129586][T23210] macvlan11: entered allmulticast mode [ 659.139670][T23213] xt_hashlimit: max too large, truncated to 1048576 [ 659.146723][T23213] xt_hashlimit: Unknown mode mask 300, kernel too old? [ 659.146999][T23210] macvlan12: entered allmulticast mode [ 659.188823][T23210] macvlan13: entered allmulticast mode [ 659.212298][T23210] macvlan14: entered allmulticast mode [ 659.226305][T23210] macvlan15: entered allmulticast mode [ 659.240090][T23210] macvlan16: entered allmulticast mode [ 659.253532][T23210] macvlan17: entered allmulticast mode [ 659.265899][T23210] macvlan18: entered allmulticast mode [ 659.411369][T23210] macvlan19: entered allmulticast mode [ 659.428030][T23210] macvlan20: entered allmulticast mode [ 659.442057][T23210] macvlan21: entered allmulticast mode [ 659.477934][T23210] macvlan22: entered allmulticast mode [ 659.527086][T23210] macvlan23: entered allmulticast mode [ 659.540718][T23210] macvlan24: entered allmulticast mode [ 659.553856][T23210] macvlan25: entered allmulticast mode [ 659.586585][T23210] macvlan26: entered allmulticast mode [ 659.625044][T23210] macvlan27: entered allmulticast mode [ 659.659456][T23210] macvlan28: entered allmulticast mode [ 659.674484][T23210] macvlan29: entered allmulticast mode [ 659.777750][T23210] macvlan30: entered allmulticast mode [ 659.819089][T23210] macvlan31: entered allmulticast mode [ 659.933246][T23210] macvlan32: entered allmulticast mode [ 659.995993][T23240] netlink: 'syz.5.5170': attribute type 4 has an invalid length. [ 659.997484][T23243] netlink: 'syz.2.5171': attribute type 29 has an invalid length. [ 660.080755][T23243] netlink: 'syz.2.5171': attribute type 29 has an invalid length. [ 660.106142][T23246] dummy0 (unregistering): left allmulticast mode [ 660.171077][T23252] netlink: 'syz.2.5174': attribute type 12 has an invalid length. [ 660.183679][T23252] netlink: 'syz.2.5174': attribute type 11 has an invalid length. [ 660.423992][T23250] __nla_validate_parse: 50 callbacks suppressed [ 660.424013][T23250] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5172'. [ 660.690151][T23269] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5179'. [ 660.905811][T23277] IPv6: NLM_F_CREATE should be specified when creating new route [ 660.987603][T23281] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 661.513405][T23300] netlink: 'syz.0.5189': attribute type 1 has an invalid length. [ 661.559711][T23300] 8021q: adding VLAN 0 to HW filter on device bond13 [ 661.581746][T23300] 8021q: adding VLAN 0 to HW filter on device bond13 [ 661.588902][T23300] bond13: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 661.607600][T23300] bond13: (slave ip6gre0): Error -95 calling set_mac_address [ 661.830257][T23306] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5190'. [ 662.460200][T23321] netlink: 208 bytes leftover after parsing attributes in process `syz.2.5196'. [ 662.469303][T23321] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5196'. [ 662.498810][T23322] netlink: 'syz.4.5197': attribute type 2 has an invalid length. [ 662.583824][T23322] : entered promiscuous mode [ 662.691723][T23332] netlink: 'syz.0.5201': attribute type 1 has an invalid length. [ 662.722984][T23332] 8021q: adding VLAN 0 to HW filter on device bond14 [ 662.790640][T23332] 8021q: adding VLAN 0 to HW filter on device bond14 [ 662.815007][T23332] bond14: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 662.852379][T23332] bond14: (slave ip6gre0): Error -95 calling set_mac_address [ 663.131854][T23343] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5205'. [ 663.159799][T23343] macvtap11: entered promiscuous mode [ 663.165502][T23343] macvtap11: entered allmulticast mode [ 663.479905][T23350] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 663.643775][T23356] veth0_to_bond: entered allmulticast mode [ 664.043379][T23367] netlink: 'syz.0.5214': attribute type 1 has an invalid length. [ 664.117137][T23367] 8021q: adding VLAN 0 to HW filter on device bond15 [ 664.130888][T23367] 8021q: adding VLAN 0 to HW filter on device bond15 [ 664.146584][T23367] bond15: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 664.157864][T23367] bond15: (slave ip6gre0): Error -95 calling set_mac_address [ 664.491294][T23386] xt_hashlimit: max too large, truncated to 1048576 [ 664.532274][T23386] xt_hashlimit: Unknown mode mask 4000, kernel too old? [ 664.962329][T23408] netlink: 'syz.4.5229': attribute type 1 has an invalid length. [ 665.083793][T23408] 8021q: adding VLAN 0 to HW filter on device bond9 [ 665.146890][T23416] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5225'. [ 665.170967][T23418] 8021q: adding VLAN 0 to HW filter on device bond9 [ 665.186718][T23418] bond9: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 665.198886][T23418] bond9: (slave ip6gre0): Error -95 calling set_mac_address [ 665.512275][T23431] xt_hashlimit: max too large, truncated to 1048576 [ 665.523803][T23431] xt_hashlimit: Unknown mode mask 4003, kernel too old? [ 665.809302][T23440] FAULT_INJECTION: forcing a failure. [ 665.809302][T23440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 665.822519][T23440] CPU: 1 UID: 0 PID: 23440 Comm: syz.2.5239 Not tainted syzkaller #0 PREEMPT(full) [ 665.822549][T23440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 665.822564][T23440] Call Trace: [ 665.822574][T23440] [ 665.822583][T23440] dump_stack_lvl+0xe8/0x150 [ 665.822633][T23440] should_fail_ex+0x40c/0x560 [ 665.822674][T23440] _copy_from_iter+0x1d3/0x1660 [ 665.822705][T23440] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 665.822736][T23440] ? rcu_is_watching+0x15/0xb0 [ 665.822759][T23440] ? trace_kmem_cache_alloc+0x29/0xe0 [ 665.822790][T23440] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 665.822818][T23440] ? __pfx__copy_from_iter+0x10/0x10 [ 665.822849][T23440] ? __alloc_skb+0x276/0x7a0 [ 665.822872][T23440] ? __alloc_skb+0x276/0x7a0 [ 665.822903][T23440] ? netlink_sendmsg+0x650/0xb40 [ 665.822934][T23440] ? skb_put+0x112/0x210 [ 665.822963][T23440] netlink_sendmsg+0x6c0/0xb40 [ 665.823002][T23440] ? __pfx_netlink_sendmsg+0x10/0x10 [ 665.823037][T23440] ? aa_sock_msg_perm+0xf1/0x1b0 [ 665.823070][T23440] ? __pfx_netlink_sendmsg+0x10/0x10 [ 665.823099][T23440] sock_sendmsg_nosec+0x13a/0x180 [ 665.823138][T23440] ____sys_sendmsg+0x54e/0x850 [ 665.823173][T23440] ? __pfx_____sys_sendmsg+0x10/0x10 [ 665.823211][T23440] ? import_iovec+0x73/0xa0 [ 665.823236][T23440] ___sys_sendmsg+0x2a5/0x360 [ 665.823264][T23440] ? __lock_acquire+0x683/0x2cf0 [ 665.823300][T23440] ? __pfx____sys_sendmsg+0x10/0x10 [ 665.823386][T23440] ? __fget_files+0x2a/0x420 [ 665.823473][T23440] ? __fget_files+0x3a2/0x420 [ 665.823513][T23440] __x64_sys_sendmsg+0x1b1/0x290 [ 665.823544][T23440] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 665.823599][T23440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 665.823624][T23440] do_syscall_64+0x174/0x580 [ 665.823655][T23440] ? trace_irq_disable+0x3b/0x140 [ 665.823683][T23440] ? clear_bhb_loop+0x40/0x90 [ 665.823709][T23440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 665.823731][T23440] RIP: 0033:0x7f546179e019 [ 665.823753][T23440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 665.823772][T23440] RSP: 002b:00007f54626c0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 665.823796][T23440] RAX: ffffffffffffffda RBX: 00007f5461a25fa0 RCX: 00007f546179e019 [ 665.823813][T23440] RDX: 00000000200088c2 RSI: 0000200000000340 RDI: 0000000000000003 [ 665.823828][T23440] RBP: 00007f54626c0090 R08: 0000000000000000 R09: 0000000000000000 [ 665.823843][T23440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 665.823857][T23440] R13: 00007f5461a26038 R14: 00007f5461a25fa0 R15: 00007ffd8a576788 [ 665.823892][T23440] [ 666.513863][T23450] netlink: 'syz.4.5244': attribute type 1 has an invalid length. [ 666.701789][T23450] 8021q: adding VLAN 0 to HW filter on device bond10 [ 666.797900][T23456] 8021q: adding VLAN 0 to HW filter on device bond10 [ 666.805140][T23456] bond10: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 666.823086][T23456] bond10: (slave ip6gre0): Error -95 calling set_mac_address [ 667.443018][T23486] xt_hashlimit: max too large, truncated to 1048576 [ 667.449695][T23486] xt_hashlimit: Unknown mode mask 40000, kernel too old? [ 667.575021][T23491] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20002 [ 667.723579][T23491] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5255'. [ 667.732818][T23494] netlink: 'syz.4.5261': attribute type 1 has an invalid length. [ 667.849584][T23494] 8021q: adding VLAN 0 to HW filter on device bond11 [ 667.995285][T23494] 8021q: adding VLAN 0 to HW filter on device bond11 [ 668.017836][T23494] bond11: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 668.055829][T23494] bond11: (slave ip6gre0): Error -95 calling set_mac_address [ 668.495577][T23512] netlink: 'syz.0.5267': attribute type 1 has an invalid length. [ 668.563904][T23512] 8021q: adding VLAN 0 to HW filter on device bond16 [ 668.594726][T23511] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5267'. [ 668.689123][T23525] xt_hashlimit: max too large, truncated to 1048576 [ 668.728698][T23525] xt_hashlimit: Unknown mode mask 100000, kernel too old? [ 668.852988][T23534] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5273'. [ 668.942978][T23543] netlink: 'syz.1.5276': attribute type 1 has an invalid length. [ 668.973128][T23543] 8021q: adding VLAN 0 to HW filter on device bond5 [ 669.035155][T23543] 8021q: adding VLAN 0 to HW filter on device bond5 [ 669.075672][T23543] bond5: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 669.139118][T23543] bond5: (slave ip6gre0): Error -95 calling set_mac_address [ 669.726560][T23586] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5288'. [ 669.752891][T23592] netlink: 'syz.5.5291': attribute type 1 has an invalid length. [ 669.819696][T23592] 8021q: adding VLAN 0 to HW filter on device bond6 [ 669.851414][T23592] 8021q: adding VLAN 0 to HW filter on device bond6 [ 669.858630][T23592] bond6: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 669.870646][T23592] bond6: (slave ip6gre0): Error -95 calling set_mac_address [ 670.055274][T23583] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5287'. [ 670.067696][T23606] netlink: 'syz.5.5294': attribute type 1 has an invalid length. [ 670.110228][T23606] 8021q: adding VLAN 0 to HW filter on device bond7 [ 670.132675][T23606] bond7: (slave geneve2): making interface the new active one [ 670.141889][T23606] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 670.159779][T21525] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 670.209319][T21525] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 670.218415][T21525] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 670.227423][T21525] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 670.250529][T23590] block nbd6: server does not support multiple connections per device. [ 670.261224][T23590] block nbd6: shutting down sockets [ 670.577072][T23617] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5297'. [ 670.680049][T23624] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5297'. [ 670.700816][T23623] sctp: [Deprecated]: syz.1.5299 (pid 23623) Use of struct sctp_assoc_value in delayed_ack socket option. [ 670.700816][T23623] Use struct sctp_sack_info instead [ 671.125424][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 671.146464][T23640] netlink: 'syz.0.5304': attribute type 1 has an invalid length. [ 671.184294][T23640] 8021q: adding VLAN 0 to HW filter on device bond17 [ 671.204833][T23640] 8021q: adding VLAN 0 to HW filter on device bond17 [ 671.214857][T23640] bond17: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 671.227918][T23640] bond17: (slave ip6gre0): Error -95 calling set_mac_address [ 671.593288][T23657] FAULT_INJECTION: forcing a failure. [ 671.593288][T23657] name failslab, interval 1, probability 0, space 0, times 0 [ 671.606347][T23657] CPU: 0 UID: 0 PID: 23657 Comm: syz.1.5310 Not tainted syzkaller #0 PREEMPT(full) [ 671.606375][T23657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 671.606389][T23657] Call Trace: [ 671.606398][T23657] [ 671.606407][T23657] dump_stack_lvl+0xe8/0x150 [ 671.606446][T23657] should_fail_ex+0x40c/0x560 [ 671.606479][T23657] should_failslab+0xa8/0x100 [ 671.606515][T23657] __kmalloc_node_track_caller_noprof+0x100/0x730 [ 671.606612][T23657] ? __kasan_kmalloc+0x93/0xb0 [ 671.606645][T23657] ? __request_module+0x2ec/0x630 [ 671.606666][T23657] ? __request_module+0x2ec/0x630 [ 671.606695][T23657] kstrdup+0x42/0x100 [ 671.606729][T23657] __request_module+0x2ec/0x630 [ 671.606755][T23657] ? rtnl_link_ops_get+0x23/0x250 [ 671.606785][T23657] ? __pfx___request_module+0x10/0x10 [ 671.606821][T23657] ? rtnl_link_ops_get+0x23/0x250 [ 671.606846][T23657] ? rtnl_link_ops_get+0x23/0x250 [ 671.606875][T23657] ? rtnl_link_ops_get+0x215/0x250 [ 671.606905][T23657] rtnl_newlink+0x662/0x1c30 [ 671.606940][T23657] ? __pfx_rtnl_newlink+0x10/0x10 [ 671.606966][T23657] ? __lock_acquire+0x683/0x2cf0 [ 671.607003][T23657] ? __lock_acquire+0x683/0x2cf0 [ 671.607048][T23657] ? unwind_next_frame+0x8f/0x2550 [ 671.607083][T23657] ? is_bpf_text_address+0x26/0x2b0 [ 671.607127][T23657] ? is_bpf_text_address+0x26/0x2b0 [ 671.607165][T23657] ? __lock_acquire+0x683/0x2cf0 [ 671.607199][T23657] ? kernel_text_address+0xa5/0xe0 [ 671.607222][T23657] ? __kernel_text_address+0xd/0x30 [ 671.607242][T23657] ? unwind_get_return_address+0x4d/0x90 [ 671.607265][T23657] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 671.607294][T23657] ? arch_stack_walk+0xfb/0x150 [ 671.607330][T23657] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 671.607372][T23657] ? __pfx_rtnl_newlink+0x10/0x10 [ 671.607396][T23657] rtnetlink_rcv_msg+0x802/0xc00 [ 671.607420][T23657] ? netlink_sendmsg+0x5d4/0xb40 [ 671.607454][T23657] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 671.607479][T23657] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 671.607506][T23657] ? __lock_acquire+0x683/0x2cf0 [ 671.607554][T23657] netlink_rcv_skb+0x226/0x4a0 [ 671.607592][T23657] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 671.607621][T23657] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 671.607664][T23657] ? netlink_deliver_tap+0x2e/0x1b0 [ 671.607692][T23657] ? netlink_deliver_tap+0x2e/0x1b0 [ 671.607727][T23657] netlink_unicast+0x7bb/0x940 [ 671.607777][T23657] netlink_sendmsg+0x813/0xb40 [ 671.607816][T23657] ? __pfx_netlink_sendmsg+0x10/0x10 [ 671.607849][T23657] ? aa_sock_msg_perm+0xf1/0x1b0 [ 671.607880][T23657] ? __pfx_netlink_sendmsg+0x10/0x10 [ 671.607907][T23657] sock_sendmsg_nosec+0x13a/0x180 [ 671.607943][T23657] ____sys_sendmsg+0x54e/0x850 [ 671.607976][T23657] ? __pfx_____sys_sendmsg+0x10/0x10 [ 671.608024][T23657] ? import_iovec+0x73/0xa0 [ 671.608048][T23657] ___sys_sendmsg+0x2a5/0x360 [ 671.608072][T23657] ? __lock_acquire+0x683/0x2cf0 [ 671.608104][T23657] ? __pfx____sys_sendmsg+0x10/0x10 [ 671.608165][T23657] ? __fget_files+0x2a/0x420 [ 671.608191][T23657] ? __fget_files+0x3a2/0x420 [ 671.608230][T23657] __x64_sys_sendmsg+0x1b1/0x290 [ 671.608257][T23657] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 671.608301][T23657] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 671.608323][T23657] do_syscall_64+0x174/0x580 [ 671.608351][T23657] ? trace_irq_disable+0x3b/0x140 [ 671.608376][T23657] ? clear_bhb_loop+0x40/0x90 [ 671.608402][T23657] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 671.608422][T23657] RIP: 0033:0x7f0f07d9e019 [ 671.608441][T23657] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 671.608459][T23657] RSP: 002b:00007f0f08c1f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 671.608480][T23657] RAX: ffffffffffffffda RBX: 00007f0f08025fa0 RCX: 00007f0f07d9e019 [ 671.608496][T23657] RDX: 00000000200088c2 RSI: 0000200000000340 RDI: 0000000000000003 [ 671.608510][T23657] RBP: 00007f0f08c1f090 R08: 0000000000000000 R09: 0000000000000000 [ 671.608523][T23657] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 671.608535][T23657] R13: 00007f0f08026038 R14: 00007f0f08025fa0 R15: 00007fff88fd0368 [ 671.608575][T23657] [ 672.260735][T23671] netlink: 'syz.1.5316': attribute type 1 has an invalid length. [ 672.310107][T23671] 8021q: adding VLAN 0 to HW filter on device bond6 [ 672.421597][T23675] team0: Mode changed to "loadbalance" [ 672.487553][T23671] 8021q: adding VLAN 0 to HW filter on device bond6 [ 672.494763][T23671] bond6: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 672.585430][T23671] bond6: (slave ip6gre0): Error -95 calling set_mac_address [ 672.640496][T23690] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5320'. [ 672.656446][T23682] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5313'. [ 689.807353][T23698] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5326'. [ 689.825468][T23702] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5327'. [ 689.865818][T23704] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5324'. [ 690.007416][T23704] macvtap8: entered allmulticast mode [ 690.289854][T23724] openvswitch: netlink: nsh attr 251 is out of range max 3 [ 690.324424][T23724] netlink: 'syz.5.5332': attribute type 1 has an invalid length. [ 690.401534][T23724] bond8: option mode: invalid value (8) [ 690.409067][T23724] bond8 (unregistering): Released all slaves [ 690.445274][T23725] netlink: 540 bytes leftover after parsing attributes in process `syz.4.5334'. [ 690.458218][T23728] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5331'. [ 690.710843][T23739] netlink: 80 bytes leftover after parsing attributes in process `syz.2.5335'. [ 690.730118][T23739] lo speed is unknown, defaulting to 1000 [ 690.736079][T23739] lo speed is unknown, defaulting to 1000 [ 690.745560][T23739] lo speed is unknown, defaulting to 1000 [ 690.752716][T23729] netlink: 'syz.5.5332': attribute type 10 has an invalid length. [ 690.761889][T23739] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 690.776965][T23729] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5332'. [ 690.801873][T23739] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 690.870140][T23739] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 690.971071][T23744] lo speed is unknown, defaulting to 1000 [ 691.044316][T23739] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 691.461401][T23757] openvswitch: netlink: Flow key attr not present in new flow. [ 691.505162][T23748] 8021q: adding VLAN 0 to HW filter on device bond19 [ 691.536509][T23748] bond18: (slave bond19): Enslaving as an active interface with an up link [ 691.637499][T23752] bond18: (slave gretap1): Enslaving as an active interface with an up link [ 691.665999][T23751] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5337'. [ 691.845265][T23753] workqueue: Failed to create a rescuer kthread for wq "bond20": -EINTR [ 691.850907][T23739] lo speed is unknown, defaulting to 1000 [ 691.969157][T23739] lo speed is unknown, defaulting to 1000 [ 692.218178][T23739] lo speed is unknown, defaulting to 1000 [ 692.243431][T23739] lo speed is unknown, defaulting to 1000 [ 692.340324][T23775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 692.385116][T23739] lo speed is unknown, defaulting to 1000 [ 692.407509][T23739] lo speed is unknown, defaulting to 1000 [ 692.423632][T23739] lo speed is unknown, defaulting to 1000 [ 692.431351][T23739] lo speed is unknown, defaulting to 1000 [ 692.455559][T23781] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 692.479406][T23781] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 693.177188][T23803] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 693.224742][T23813] netlink: 180 bytes leftover after parsing attributes in process `syz.4.5362'. [ 693.237535][T23813] tipc: Enabling of bearer rejected, failed to enable media [ 693.286770][T23811] netlink: 'syz.5.5361': attribute type 83 has an invalid length. [ 693.493826][T23822] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 693.630920][T23828] lo speed is unknown, defaulting to 1000 [ 694.291425][T23851] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5376'. [ 694.632249][T23862] xt_hashlimit: max too large, truncated to 1048576 [ 694.778647][T23864] netlink: 'syz.1.5380': attribute type 1 has an invalid length. [ 694.814377][T23864] 8021q: adding VLAN 0 to HW filter on device bond7 [ 695.235119][T23880] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 695.259127][T23888] syzkaller0: left promiscuous mode [ 695.270740][T23888] syzkaller0: left allmulticast mode [ 695.369405][T23897] xt_hashlimit: max too large, truncated to 1048576 [ 695.770279][T23917] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 695.779762][T23917] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 696.120175][T23937] xt_hashlimit: max too large, truncated to 1048576 [ 696.173557][T23934] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5404'. [ 696.183245][T23938] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5404'. [ 696.312268][T23943] netlink: 284 bytes leftover after parsing attributes in process `syz.0.5407'. [ 696.439718][T23947] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5409'. [ 696.451493][T23947] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5409'. [ 696.464851][T23947] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5409'. [ 696.474226][T23947] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5409'. [ 696.485691][T23946] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5408'. [ 696.495232][T23946] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5408'. [ 696.610191][T23949] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.767360][T23959] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 696.795081][T23959] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 696.828044][T23961] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5414'. [ 696.904193][T23965] xt_hashlimit: max too large, truncated to 1048576 [ 696.915565][T23958] lo speed is unknown, defaulting to 1000 [ 697.168392][T23972] sctp: [Deprecated]: syz.5.5419 (pid 23972) Use of int in max_burst socket option. [ 697.168392][T23972] Use struct sctp_assoc_value instead [ 697.879967][T24000] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 697.889909][T24000] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 698.256632][T24006] FAULT_INJECTION: forcing a failure. [ 698.256632][T24006] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 698.326600][T24006] CPU: 1 UID: 0 PID: 24006 Comm: syz.5.5429 Not tainted syzkaller #0 PREEMPT(full) [ 698.326630][T24006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 698.326644][T24006] Call Trace: [ 698.326653][T24006] [ 698.326663][T24006] dump_stack_lvl+0xe8/0x150 [ 698.326701][T24006] should_fail_ex+0x40c/0x560 [ 698.326735][T24006] _copy_from_iter+0x1d3/0x1660 [ 698.326764][T24006] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 698.326795][T24006] ? rcu_is_watching+0x15/0xb0 [ 698.326817][T24006] ? trace_kmem_cache_alloc+0x29/0xe0 [ 698.326847][T24006] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 698.326874][T24006] ? __pfx__copy_from_iter+0x10/0x10 [ 698.326904][T24006] ? __alloc_skb+0x276/0x7a0 [ 698.326927][T24006] ? __alloc_skb+0x276/0x7a0 [ 698.326957][T24006] ? netlink_sendmsg+0x650/0xb40 [ 698.326985][T24006] ? skb_put+0x112/0x210 [ 698.327013][T24006] netlink_sendmsg+0x6c0/0xb40 [ 698.327053][T24006] ? __pfx_netlink_sendmsg+0x10/0x10 [ 698.327087][T24006] ? aa_sock_msg_perm+0xf1/0x1b0 [ 698.327118][T24006] ? __pfx_netlink_sendmsg+0x10/0x10 [ 698.327147][T24006] sock_sendmsg_nosec+0x13a/0x180 [ 698.327183][T24006] ____sys_sendmsg+0x54e/0x850 [ 698.327217][T24006] ? __pfx_____sys_sendmsg+0x10/0x10 [ 698.327254][T24006] ? import_iovec+0x73/0xa0 [ 698.327288][T24006] ___sys_sendmsg+0x2a5/0x360 [ 698.327315][T24006] ? __lock_acquire+0x683/0x2cf0 [ 698.327349][T24006] ? __pfx____sys_sendmsg+0x10/0x10 [ 698.327414][T24006] ? __fget_files+0x2a/0x420 [ 698.327443][T24006] ? __fget_files+0x3a2/0x420 [ 698.327483][T24006] __x64_sys_sendmsg+0x1b1/0x290 [ 698.327513][T24006] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 698.327561][T24006] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.327584][T24006] do_syscall_64+0x174/0x580 [ 698.327613][T24006] ? trace_irq_disable+0x3b/0x140 [ 698.327641][T24006] ? clear_bhb_loop+0x40/0x90 [ 698.327668][T24006] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.327690][T24006] RIP: 0033:0x7f035799e019 [ 698.327710][T24006] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.327729][T24006] RSP: 002b:00007f0358786028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 698.327753][T24006] RAX: ffffffffffffffda RBX: 00007f0357c25fa0 RCX: 00007f035799e019 [ 698.327769][T24006] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 698.327782][T24006] RBP: 00007f0358786090 R08: 0000000000000000 R09: 0000000000000000 [ 698.327796][T24006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 698.327808][T24006] R13: 00007f0357c26038 R14: 00007f0357c25fa0 R15: 00007fff21b31df8 [ 698.327842][T24006] [ 698.349530][T24011] netlink: 'syz.1.5430': attribute type 1 has an invalid length. [ 698.707269][T24009] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.801217][T24011] 8021q: adding VLAN 0 to HW filter on device bond8 [ 699.051445][T24031] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 699.060931][T24031] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 699.164601][T24034] xt_hashlimit: max too large, truncated to 1048576 [ 699.510170][T24050] netlink: 'syz.2.5445': attribute type 1 has an invalid length. [ 699.569999][T24050] 8021q: adding VLAN 0 to HW filter on device bond7 [ 699.645091][T24050] 8021q: adding VLAN 0 to HW filter on device bond7 [ 699.703597][T24050] bond7: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 699.717163][T24050] bond7: (slave ip6gre0): Error -95 calling set_mac_address [ 699.826525][T24062] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 699.870112][T24062] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 700.212013][T24070] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 700.403286][T24083] IPVS: set_ctl: invalid protocol: 59 224.0.0.1:20002 [ 700.653096][T24097] netlink: 'syz.0.5462': attribute type 1 has an invalid length. [ 700.720233][T24097] 8021q: adding VLAN 0 to HW filter on device bond20 [ 700.744671][T24103] 8021q: adding VLAN 0 to HW filter on device bond20 [ 700.771753][T24103] bond20: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 700.860956][T24103] bond20: (slave ip6gre0): Error -95 calling set_mac_address [ 701.267274][T24126] bond5: (slave batadv0): Releasing active interface [ 701.313101][T24126] bridge_slave_0: left allmulticast mode [ 701.326555][T24126] bridge_slave_0: left promiscuous mode [ 701.340876][T24126] bridge0: port 1(bridge_slave_0) entered disabled state [ 701.381277][T24126] bridge_slave_1: left allmulticast mode [ 701.389297][T24126] bridge_slave_1: left promiscuous mode [ 701.403442][T24126] bridge0: port 2(bridge_slave_1) entered disabled state [ 701.429570][T24126] bond0: (slave bond_slave_0): Releasing backup interface [ 701.452746][T24126] bond0: (slave bond_slave_1): Releasing backup interface [ 701.490137][T24126] team0: Port device team_slave_0 removed [ 701.512624][T24126] team0: Port device team_slave_1 removed [ 701.525850][T24126] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 701.547753][T24126] net_ratelimit: 2 callbacks suppressed [ 701.547775][T24126] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 701.621207][T24132] team0: Mode changed to "loadbalance" [ 701.956754][T24143] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 701.960647][T24145] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 701.977213][T24145] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 702.050920][T24147] netlink: 'syz.4.5478': attribute type 1 has an invalid length. [ 702.082528][T24147] 8021q: adding VLAN 0 to HW filter on device bond12 [ 702.124761][T24147] 8021q: adding VLAN 0 to HW filter on device bond12 [ 702.137269][T24150] __nla_validate_parse: 5 callbacks suppressed [ 702.137290][T24150] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5479'. [ 702.157620][T24147] bond12: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 702.169303][T24147] bond12: (slave ip6gre0): Error -95 calling set_mac_address [ 702.215633][T24150] 8021q: adding VLAN 0 to HW filter on device bond21 [ 702.500995][T24150] 8021q: adding VLAN 0 to HW filter on device bond22 [ 702.509876][T24150] bond21: (slave bond22): Enslaving as an active interface with an up link [ 702.740502][T24167] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5486'. [ 702.749526][T24167] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5486'. [ 702.770285][T24166] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5484'. [ 702.826054][ T7899] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 702.843433][T24170] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5484'. [ 702.895788][T24169] tipc: Started in network mode [ 702.900746][T24169] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 702.908051][T24169] tipc: Enabled bearer , priority 10 [ 702.977469][T24172] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 702.999206][T24172] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 703.310219][T15709] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 703.357915][T24185] netlink: 'syz.4.5492': attribute type 1 has an invalid length. [ 703.438734][T24185] 8021q: adding VLAN 0 to HW filter on device bond13 [ 703.554724][T24185] 8021q: adding VLAN 0 to HW filter on device bond13 [ 703.561950][T24185] bond13: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 703.573243][T24185] bond13: (slave ip6gre0): Error -95 calling set_mac_address [ 703.602814][T24200] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 703.630167][T15709] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 703.792400][T24212] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 703.802465][T24212] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 703.937904][ T7899] tipc: Node number set to 8432298 [ 703.970076][T24213] xt_hashlimit: size too large, truncated to 1048576 [ 704.176405][T24225] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5504'. [ 704.226562][T24225] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 704.278855][T24231] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5507'. [ 704.367639][T24236] netlink: 'syz.4.5510': attribute type 1 has an invalid length. [ 704.428743][T24236] 8021q: adding VLAN 0 to HW filter on device bond14 [ 704.469094][T24236] 8021q: adding VLAN 0 to HW filter on device bond14 [ 704.476298][T24236] bond14: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 704.587972][T24246] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 704.598759][T24246] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 704.610336][T24236] bond14: (slave ip6gre0): Error -95 calling set_mac_address [ 704.839581][T24263] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 704.945100][T24271] netlink: 124 bytes leftover after parsing attributes in process `syz.1.5520'. [ 704.954852][T24271] netlink: 124 bytes leftover after parsing attributes in process `syz.1.5520'. [ 705.009720][T24270] 8021q: adding VLAN 0 to HW filter on device bond9 [ 705.017088][T24270] bridge0: port 1(bond9) entered blocking state [ 705.023575][T24270] bridge0: port 1(bond9) entered disabled state [ 705.030003][T24270] bond9: entered allmulticast mode [ 705.040893][T24270] bond9: entered promiscuous mode [ 705.220874][T24280] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5524'. [ 705.371184][T24288] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 705.594547][T24291] netlink: 'syz.0.5528': attribute type 1 has an invalid length. [ 705.671250][T24297] Cannot find del_set index 4 as target [ 705.692429][T24291] 8021q: adding VLAN 0 to HW filter on device bond23 [ 705.761722][T24291] 8021q: adding VLAN 0 to HW filter on device bond23 [ 705.792250][T24291] bond23: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 705.803549][T24291] bond23: (slave ip6gre0): Error -95 calling set_mac_address [ 706.236798][T24315] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 706.502588][T24305] syzkaller1: entered promiscuous mode [ 706.508098][T24305] syzkaller1: entered allmulticast mode [ 706.624710][T24335] netlink: 'syz.4.5544': attribute type 1 has an invalid length. [ 706.665034][T24335] 8021q: adding VLAN 0 to HW filter on device bond15 [ 706.695330][T24335] 8021q: adding VLAN 0 to HW filter on device bond15 [ 706.703116][T24335] bond15: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 706.714961][T24335] bond15: (slave ip6gre0): Error -95 calling set_mac_address [ 707.077291][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 707.096373][ T5621] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 707.117630][ T5621] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 707.132909][ T5621] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 707.140886][ T5621] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 707.190544][ T5630] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 707.221937][ T5630] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 707.241479][ T5630] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 707.256086][ T5630] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 707.266892][ T5630] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 707.451484][ T5621] block nbd6: Receive control failed (result -32) [ 707.465756][ T5621] block nbd6: Receive control failed (result -32) [ 707.490723][T24359] macsec1: entered allmulticast mode [ 707.496088][T24359] syz_tun: entered allmulticast mode [ 707.523083][T24359] syz_tun: left allmulticast mode [ 707.562874][T14759] bond0: (slave syz_tun): Releasing backup interface [ 707.822926][T24374] __nla_validate_parse: 2 callbacks suppressed [ 707.822949][T24374] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5550'. [ 707.846202][T24374] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5550'. [ 707.967846][T24386] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5554'. [ 708.169454][T24351] lo speed is unknown, defaulting to 1000 [ 708.186834][T24394] netlink: 'syz.5.5555': attribute type 1 has an invalid length. [ 708.297392][T24394] 8021q: adding VLAN 0 to HW filter on device bond8 [ 708.354473][T24401] 8021q: adding VLAN 0 to HW filter on device bond8 [ 708.378074][T24401] bond8: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 708.415300][T24401] bond8: (slave ip6gre0): Error -95 calling set_mac_address [ 708.511816][T24411] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5561'. [ 708.557452][T24411] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5561'. [ 708.572732][T24405] netlink: 240 bytes leftover after parsing attributes in process `syz.1.5559'. [ 708.609737][T24405] netlink: 'syz.1.5559': attribute type 9 has an invalid length. [ 708.686852][T24419] net_ratelimit: 3 callbacks suppressed [ 708.686874][T24419] netlink: zone id is out of range [ 708.708080][T24419] netlink: zone id is out of range [ 708.716502][T24413] batman_adv: batadv0: Adding interface: gretap2 [ 708.731716][T24413] batman_adv: batadv0: Interface activated: gretap2 [ 708.739138][T24419] netlink: zone id is out of range [ 708.744297][T24419] netlink: zone id is out of range [ 708.749434][T24419] netlink: zone id is out of range [ 708.754572][T24419] netlink: zone id is out of range [ 708.798710][T24419] netlink: zone id is out of range [ 708.803935][T24419] netlink: zone id is out of range [ 708.811080][T24419] netlink: zone id is out of range [ 708.838238][T24419] netlink: zone id is out of range [ 709.195898][T24433] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5567'. [ 709.371520][T24436] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5568'. [ 709.394689][T24444] xt_hashlimit: max too large, truncated to 1048576 [ 709.446089][ T5621] Bluetooth: hci2: command tx timeout [ 709.563150][T24351] bridge0: port 1(bridge_slave_0) entered blocking state [ 709.573442][T24351] bridge0: port 1(bridge_slave_0) entered disabled state [ 709.581213][T24351] bridge_slave_0: entered allmulticast mode [ 709.590655][T24351] bridge_slave_0: entered promiscuous mode [ 709.599019][T24449] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5573'. [ 709.608672][T24351] bridge0: port 2(bridge_slave_1) entered blocking state [ 709.618415][T24351] bridge0: port 2(bridge_slave_1) entered disabled state [ 709.625780][T24351] bridge_slave_1: entered allmulticast mode [ 709.633898][T24351] bridge_slave_1: entered promiscuous mode [ 709.682308][T24351] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 709.695216][T24351] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 709.744287][T24351] team0: Port device team_slave_0 added [ 709.753599][T24351] team0: Port device team_slave_1 added [ 709.813920][T24351] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 709.829689][T24351] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 709.880769][T24351] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 709.894481][T24351] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 709.901950][T24351] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 709.938155][T24351] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 710.014839][T24351] hsr_slave_0: entered promiscuous mode [ 710.027659][T24351] hsr_slave_1: entered promiscuous mode [ 710.040326][T24351] debugfs: 'hsr0' already exists in 'hsr' [ 710.046819][T24351] Cannot create hsr debugfs directory [ 711.114351][T24498] netlink: 'syz.4.5591': attribute type 1 has an invalid length. [ 711.169810][T24503] xt_hashlimit: max too large, truncated to 1048576 [ 711.508648][ T5630] Bluetooth: hci2: command tx timeout [ 713.611863][ T5630] Bluetooth: hci2: command tx timeout [ 714.457100][T24521] netlink: 'syz.5.5597': attribute type 1 has an invalid length. [ 714.536684][T24521] 8021q: adding VLAN 0 to HW filter on device bond9 [ 714.555169][T24530] 8021q: adding VLAN 0 to HW filter on device bond9 [ 714.562957][T24530] bond9: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 714.576892][T24530] bond9: (slave ip6gre0): Error -95 calling set_mac_address [ 714.591589][T24351] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 714.615748][T24351] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 714.623591][T24516] tipc: Enabling of bearer rejected, failed to enable media [ 714.644852][T24351] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 714.658673][T24351] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 714.667568][T24351] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 714.680572][T24351] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 714.691255][T24529] netdevsim netdevsim1: Direct firmware load for  failed with error -2 [ 714.700752][T24351] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 714.700816][T24529] netdevsim netdevsim1: Falling back to sysfs fallback for:  [ 714.752454][T24351] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 714.875589][T24546] xt_hashlimit: max too large, truncated to 1048576 [ 714.959871][T24351] 8021q: adding VLAN 0 to HW filter on device bond0 [ 715.026251][T24351] 8021q: adding VLAN 0 to HW filter on device team0 [ 715.091184][T24351] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 715.139049][T24351] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 715.156171][T21527] bridge0: port 1(bridge_slave_0) entered blocking state [ 715.163466][T21527] bridge0: port 1(bridge_slave_0) entered forwarding state [ 715.191107][T21527] bridge0: port 2(bridge_slave_1) entered blocking state [ 715.198301][T21527] bridge0: port 2(bridge_slave_1) entered forwarding state [ 715.526953][T24567] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5605'. [ 715.535978][T24567] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5605'. [ 715.625588][T24572] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5607'. [ 715.744005][ T5630] Bluetooth: hci2: command tx timeout [ 715.871540][T24584] netlink: 'syz.1.5610': attribute type 1 has an invalid length. [ 716.017473][T24584] 8021q: adding VLAN 0 to HW filter on device bond10 [ 716.041252][T24594] xt_hashlimit: max too large, truncated to 1048576 [ 716.090977][T24589] 8021q: adding VLAN 0 to HW filter on device bond10 [ 716.098202][T24589] bond10: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 716.109460][T24589] bond10: (slave ip6gre0): Error -95 calling set_mac_address [ 716.264601][T24600] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5615'. [ 716.373066][T24351] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 716.486260][T24351] veth0_vlan: entered promiscuous mode [ 716.508384][T24351] veth1_vlan: entered promiscuous mode [ 716.623407][T24351] veth0_macvtap: entered promiscuous mode [ 716.673012][T24351] veth1_macvtap: entered promiscuous mode [ 716.736608][T24351] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 716.771218][T24351] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 716.849551][T24622] xt_hashlimit: max too large, truncated to 1048576 [ 716.878540][T20086] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 716.944871][T24624] netlink: 'syz.4.5625': attribute type 1 has an invalid length. [ 716.986051][T24615] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5619'. [ 717.002834][T24615] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5619'. [ 717.025878][T24624] 8021q: adding VLAN 0 to HW filter on device bond17 [ 717.048930][T24624] 8021q: adding VLAN 0 to HW filter on device bond17 [ 717.056106][T24624] bond17: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 717.067530][T24624] bond17: (slave ip6gre0): Error -95 calling set_mac_address [ 717.112825][T20086] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 717.256016][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 717.263913][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 717.273592][T20086] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 717.282696][T20086] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 717.433906][T24637] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5627'. [ 717.442921][T24637] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5627'. [ 717.457081][T24637] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5627'. [ 717.467280][T24637] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5627'. [ 717.504069][T20086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 717.512437][T20086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 717.792813][T24646] sctp: [Deprecated]: syz.4.5631 (pid 24646) Use of struct sctp_assoc_value in delayed_ack socket option. [ 717.792813][T24646] Use struct sctp_sack_info instead [ 718.382637][T24667] netlink: 'syz.5.5637': attribute type 1 has an invalid length. [ 718.507999][T24667] 8021q: adding VLAN 0 to HW filter on device bond10 [ 718.531850][T24672] 8021q: adding VLAN 0 to HW filter on device bond10 [ 718.539071][T24672] bond10: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 718.636905][T24672] bond10: (slave ip6gre0): Error -95 calling set_mac_address [ 719.366493][T20086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 719.375360][T20086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 719.622963][T24709] RDS: rds_bind could not find a transport for ::ffff:100.1.1.1, load rds_tcp or rds_rdma? [ 719.696863][T24711] netlink: 'syz.5.5653': attribute type 1 has an invalid length. [ 719.854014][T24711] 8021q: adding VLAN 0 to HW filter on device bond11 [ 719.930428][T24718] 8021q: adding VLAN 0 to HW filter on device bond11 [ 719.960037][T24718] bond11: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 719.972767][T24718] bond11: (slave ip6gre0): Error -95 calling set_mac_address [ 720.167327][T24726] xt_hashlimit: max too large, truncated to 1048576 [ 720.538183][T24741] __nla_validate_parse: 11 callbacks suppressed [ 720.538204][T24741] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5666'. [ 720.852000][T24758] netlink: 'syz.0.5670': attribute type 40 has an invalid length. [ 720.869278][T24761] netlink: 'syz.2.5669': attribute type 1 has an invalid length. [ 720.926764][T24767] netlink: 128 bytes leftover after parsing attributes in process `syz.1.5671'. [ 720.971631][T24761] 8021q: adding VLAN 0 to HW filter on device bond8 [ 721.094409][T24776] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5673'. [ 721.555130][T24788] lo speed is unknown, defaulting to 1000 [ 721.712459][T24810] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5677'. [ 721.912295][T21525] wlan1: Trigger new scan to find an IBSS to join [ 721.969660][T24814] netlink: 'syz.2.5685': attribute type 1 has an invalid length. [ 721.995169][T24815] net_ratelimit: 13 callbacks suppressed [ 721.995191][T24815] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 722.078106][T24814] 8021q: adding VLAN 0 to HW filter on device bond9 [ 722.202972][T24816] 8021q: adding VLAN 0 to HW filter on device bond9 [ 722.218255][T24816] bond9: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 722.229516][T24816] bond9: (slave ip6gre0): Error -95 calling set_mac_address [ 722.306327][T24827] netlink: 'syz.5.5688': attribute type 2 has an invalid length. [ 722.319882][T24827] netlink: 'syz.5.5688': attribute type 2 has an invalid length. [ 722.783216][T24842] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5693'. [ 722.821857][T24845] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5695'. [ 723.397553][T24863] sctp: [Deprecated]: syz.2.5701 (pid 24863) Use of struct sctp_assoc_value in delayed_ack socket option. [ 723.397553][T24863] Use struct sctp_sack_info instead [ 723.471753][T24866] sctp: [Deprecated]: syz.2.5701 (pid 24866) Use of struct sctp_assoc_value in delayed_ack socket option. [ 723.471753][T24866] Use struct sctp_sack_info instead [ 723.812080][ T5621] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 723.832611][ T5621] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 723.857102][ T5621] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 723.873898][ T5621] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 723.891869][ T5621] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 724.008581][T24875] sctp: [Deprecated]: syz.0.5705 (pid 24875) Use of int in max_burst socket option. [ 724.008581][T24875] Use struct sctp_assoc_value instead [ 724.097389][T24880] xt_hashlimit: size too large, truncated to 1048576 [ 724.374071][T24890] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5707'. [ 724.533633][T24894] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5708'. [ 724.548664][T24894] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5708'. [ 724.659398][T24897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5709'. [ 724.818304][T24867] lo speed is unknown, defaulting to 1000 [ 724.833738][T24902] xt_hashlimit: max too large, truncated to 1048576 [ 725.092992][T24908] lo speed is unknown, defaulting to 1000 [ 725.840281][T24867] bridge0: port 1(bridge_slave_0) entered blocking state [ 725.950822][T24867] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.958247][T24867] bridge_slave_0: entered allmulticast mode [ 725.977378][T21534] wlan1: Trigger new scan to find an IBSS to join [ 726.010424][ T5630] Bluetooth: hci5: command tx timeout [ 726.012655][T24867] bridge_slave_0: entered promiscuous mode [ 726.026117][T24867] bridge0: port 2(bridge_slave_1) entered blocking state [ 726.033362][T24867] bridge0: port 2(bridge_slave_1) entered disabled state [ 726.041005][T24867] bridge_slave_1: entered allmulticast mode [ 726.049633][T24867] bridge_slave_1: entered promiscuous mode [ 726.331549][T24934] 8021q: adding VLAN 0 to HW filter on device bond10 [ 726.339627][T24934] bridge0: port 1(bond10) entered blocking state [ 726.346289][T24934] bridge0: port 1(bond10) entered disabled state [ 726.353045][T24934] bond10: entered allmulticast mode [ 726.361862][T24934] bond10: entered promiscuous mode [ 726.389210][T24867] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 726.488250][T24867] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 726.613061][T24867] team0: Port device team_slave_0 added [ 726.622299][T24867] team0: Port device team_slave_1 added [ 726.633169][T24947] xt_hashlimit: max too large, truncated to 1048576 [ 726.702155][T24867] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 726.726176][T24867] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 726.752128][T24867] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 726.861302][T24867] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 726.869980][T24867] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 726.929106][T24867] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 726.984427][T24958] syzkaller0: entered promiscuous mode [ 726.990015][T24958] syzkaller0: entered allmulticast mode [ 727.097227][T21534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 727.338521][T24867] hsr_slave_0: entered promiscuous mode [ 727.405659][T24867] hsr_slave_1: entered promiscuous mode [ 727.412134][T24867] debugfs: 'hsr0' already exists in 'hsr' [ 727.417931][T24867] Cannot create hsr debugfs directory [ 727.868367][T24992] __nla_validate_parse: 2 callbacks suppressed [ 727.868388][T24992] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5735'. [ 728.045813][T24993] sctp: [Deprecated]: syz.1.5734 (pid 24993) Use of int in max_burst socket option deprecated. [ 728.045813][T24993] Use struct sctp_assoc_value instead [ 728.072964][ T5630] Bluetooth: hci5: command tx timeout [ 728.848533][T25031] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5747'. [ 728.941314][T25035] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 728.971734][T25035] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 729.393872][T25054] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5750'. [ 729.403651][T25054] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5750'. [ 729.412557][T25054] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5750'. [ 729.520420][T25053] netlink: 'syz.0.5752': attribute type 1 has an invalid length. [ 729.620402][T20086] erspan0 (unregistering): left allmulticast mode [ 730.153726][ T5621] Bluetooth: hci5: command tx timeout [ 730.309290][T20086] bond4 (unregistering): (slave geneve2): Releasing active interface [ 730.364417][T20086] bond0 (unregistering): Released all slaves [ 730.414495][T20086] bond1 (unregistering): Released all slaves [ 730.433908][T20086] bond2 (unregistering): Released all slaves [ 730.450267][T20086] bond3 (unregistering): Released all slaves [ 730.466194][T20086] bond4 (unregistering): Released all slaves [ 730.502814][T20086] bond5 (unregistering): (slave veth7): Releasing backup interface [ 730.510823][T20086] veth7: left promiscuous mode [ 730.517190][T20086] bond5 (unregistering): Released all slaves [ 730.533503][T20086] bond6 (unregistering): Released all slaves [ 730.559861][T20086] bond7 (unregistering): (slave veth9): Releasing active interface [ 730.570409][T20086] bond7 (unregistering): (slave veth11): Releasing active interface [ 730.579598][T20086] bond7 (unregistering): Released all slaves [ 730.595595][T20086] bond8 (unregistering): Released all slaves [ 730.617274][T20086] bond9 (unregistering): Released all slaves [ 730.641453][T20086] bond10 (unregistering): Released all slaves [ 730.662858][T20086] bond11 (unregistering): Released all slaves [ 730.680917][T20086] bond12 (unregistering): Released all slaves [ 730.696876][T20086] bond13 (unregistering): Released all slaves [ 730.717879][T20086] bond14 (unregistering): Released all slaves [ 730.745039][T20086] bond15 (unregistering): Released all slaves [ 730.766504][T20086] bond16 (unregistering): Released all slaves [ 730.783993][T20086] bond17 (unregistering): Released all slaves [ 730.870416][ T5283] 8021q: adding VLAN 0 to HW filter on device eth5 [ 731.643533][T20086] : left promiscuous mode [ 731.687599][T25124] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5765'. [ 731.813549][T25121] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5761'. [ 731.925570][T25116] lo speed is unknown, defaulting to 1000 [ 732.019322][T25137] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5767'. [ 732.166419][T25144] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5768'. [ 732.175666][T25144] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5768'. [ 732.229028][ T5621] Bluetooth: hci5: command 0x0419 tx timeout [ 732.474368][T20086] tipc: Left network mode [ 733.091747][T25190] __nla_validate_parse: 3 callbacks suppressed [ 733.091768][T25190] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5778'. [ 733.822460][T25206] x_tables: duplicate underflow at hook 2 [ 733.917277][T25207] tipc: Invalid UDP bearer configuration [ 733.917332][T25207] tipc: Enabling of bearer rejected, failed to enable media [ 734.308488][ T5630] Bluetooth: hci5: command 0x0419 tx timeout [ 734.483817][T25220] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5786'. [ 734.522577][T25232] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5787'. [ 734.681852][T25244] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 734.965644][T20086] hsr_slave_0: left promiscuous mode [ 734.972750][T20086] hsr_slave_1: left promiscuous mode [ 736.114505][T25227] lo speed is unknown, defaulting to 1000 [ 736.238586][T24867] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 736.287508][T24867] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 736.321199][T24867] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 736.334144][T24867] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 736.377003][T25270] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5792'. [ 736.387885][T24867] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 736.411525][T24867] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 736.419489][T24867] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 736.442768][T24867] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 736.578503][T25278] lo speed is unknown, defaulting to 1000 [ 736.726778][T24867] 8021q: adding VLAN 0 to HW filter on device bond0 [ 736.752959][T24867] 8021q: adding VLAN 0 to HW filter on device team0 [ 736.769601][T21525] bridge0: port 1(bridge_slave_0) entered blocking state [ 736.776809][T21525] bridge0: port 1(bridge_slave_0) entered forwarding state [ 736.792838][T21535] bridge0: port 2(bridge_slave_1) entered blocking state [ 736.800215][T21535] bridge0: port 2(bridge_slave_1) entered forwarding state [ 736.853468][T25290] netlink: 7 bytes leftover after parsing attributes in process `syz.1.5795'. [ 737.050803][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 737.480332][T24867] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 737.788653][T25315] xt_hashlimit: max too large, truncated to 1048576 [ 737.807180][T25311] lo speed is unknown, defaulting to 1000 [ 738.300875][T25330] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5802'. [ 738.318905][T24867] veth0_vlan: entered promiscuous mode [ 738.332759][T24867] veth1_vlan: entered promiscuous mode [ 738.373569][T24867] veth0_macvtap: entered promiscuous mode [ 738.408618][T24867] veth1_macvtap: entered promiscuous mode [ 738.432823][T24867] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 738.453676][T24867] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 738.463396][T25328] lo speed is unknown, defaulting to 1000 [ 738.478306][T21535] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.585695][T25333] IPVS: Error connecting to the multicast addr [ 738.602851][T25338] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5805'. [ 738.623263][T21533] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.623346][T21533] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.623388][T21533] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 739.231389][T25353] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5810'. [ 739.274285][T21527] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 739.294837][T25354] netlink: Conntrack attr type has unexpected length (type=0, length=5, expected=0) [ 739.304300][T25354] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 739.313779][T21527] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 739.381349][T21525] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 739.391287][T21525] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 740.067170][T25386] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5821'. [ 740.151667][T25386] bond1: option lacp_active: invalid value (5) [ 740.170956][T25386] bond1 (unregistering): Released all slaves [ 740.683614][T25404] netlink: 'syz.1.5825': attribute type 16 has an invalid length. [ 740.691588][T25404] netlink: 'syz.1.5825': attribute type 17 has an invalid length. [ 740.724304][T25404] 8021q: adding VLAN 0 to HW filter on device bond0 [ 740.732354][T25404] 8021q: adding VLAN 0 to HW filter on device team0 [ 740.784959][T25404] dummy0: left promiscuous mode [ 740.793977][T25404] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 740.916235][T25404] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 740.933976][T25404] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 740.993012][T25404] veth1_vlan: left promiscuous mode [ 741.002806][T25404] veth0_vlan: left promiscuous mode [ 741.017339][T25404] veth0_vlan: entered promiscuous mode [ 741.030893][T25404] veth1_vlan: entered promiscuous mode [ 741.036419][T25404] veth1_vlan: entered allmulticast mode [ 741.047319][T25404] veth0_macvtap: left promiscuous mode [ 741.054052][T25404] veth0_macvtap: entered promiscuous mode [ 741.067909][T25416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 741.162432][T25404] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 741.173244][T25404] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 741.182762][T25404] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 741.192713][T25404] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 741.205149][T25404] mac80211_hwsim hwsim36 wlan0: left promiscuous mode [ 741.234509][T25404] mac80211_hwsim hwsim36 wlan0: entered promiscuous mode [ 741.241943][T25419] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5831'. [ 741.256379][T25404] hsr1: Slave A (netdevsim0) is not up; please bring it up to get a fully working HSR network [ 741.293011][T25404] 8021q: adding VLAN 0 to HW filter on device bond1 [ 741.306484][T25404] geneve0: entered promiscuous mode [ 741.336847][T25404] batman_adv: batadv0: Interface activated: gretap1 [ 741.357349][T25404] 8021q: adding VLAN 0 to HW filter on device bond2 [ 741.398916][T25404] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 741.426289][T25404] bridge1: left allmulticast mode [ 741.495866][T25404] 8021q: adding VLAN 0 to HW filter on device bond3 [ 741.509758][T25404] 8021q: adding VLAN 0 to HW filter on device bond4 [ 741.520120][T25404] macsec1: left promiscuous mode [ 741.530515][T25404] 8021q: adding VLAN 0 to HW filter on device bond5 [ 741.547586][T25404] 8021q: adding VLAN 0 to HW filter on device bond6 [ 741.565900][T25404] dummy0: entered allmulticast mode [ 741.572129][T25404] dummy0: entered promiscuous mode [ 741.577799][T25404] macvtap8: left allmulticast mode [ 741.583854][T25404] dummy0: left allmulticast mode [ 741.606479][T25404] 8021q: adding VLAN 0 to HW filter on device bond10 [ 741.681250][ T7899] ip6gretap1: entered promiscuous mode [ 741.698185][T21525] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.854102][T21527] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 741.863127][T21527] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 741.879170][ T8702] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 741.894247][T21527] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.108968][ T6896] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.131518][ T6896] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.408967][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 742.470525][T25441] netlink: 'syz.1.5836': attribute type 3 has an invalid length. [ 742.549431][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 743.233866][T25466] netlink: 'syz.1.5842': attribute type 1 has an invalid length. [ 743.276021][T25466] netlink: 'syz.1.5842': attribute type 10 has an invalid length. [ 743.304653][T25466] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5842'. [ 743.553442][T25469] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5843'. [ 743.812140][T25479] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5845'. [ 743.934986][ T5630] block nbd7: Receive control failed (result -1) [ 743.942616][ T5630] [ 743.945028][ T5630] ====================================================== [ 743.952089][ T5630] WARNING: possible circular locking dependency detected [ 743.959192][ T5630] syzkaller #0 Not tainted [ 743.963629][ T5630] ------------------------------------------------------ [ 743.970721][ T5630] kworker/u9:3/5630 is trying to acquire lock: [ 743.976895][ T5630] ffff88807c2eb860 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}, at: inet_shutdown+0x6a/0x390 [ 743.986442][ T5630] [ 743.986442][ T5630] but task is already holding lock: [ 743.993841][ T5630] ffff88803d1fd068 (&nsock->tx_lock){+.+.}-{4:4}, at: recv_work+0x1cd9/0x1e10 [ 744.002911][ T5630] [ 744.002911][ T5630] which lock already depends on the new lock. [ 744.002911][ T5630] [ 744.013333][ T5630] [ 744.013333][ T5630] the existing dependency chain (in reverse order) is: [ 744.022362][ T5630] [ 744.022362][ T5630] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 744.030111][ T5630] __mutex_lock+0x19d/0x1550 [ 744.035279][ T5630] nbd_queue_rq+0x373/0x1150 [ 744.040503][ T5630] blk_mq_dispatch_rq_list+0x499/0x1990 [ 744.046669][ T5630] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 744.053613][ T5630] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 744.060180][ T5630] blk_mq_run_work_fn+0x16c/0x300 [ 744.065759][ T5630] process_scheduled_works+0xa8e/0x14e0 [ 744.071852][ T5630] worker_thread+0xa47/0xfb0 [ 744.076978][ T5630] kthread+0x388/0x470 [ 744.081593][ T5630] ret_from_fork+0x514/0xb70 [ 744.086727][ T5630] ret_from_fork_asm+0x1a/0x30 [ 744.092024][ T5630] [ 744.092024][ T5630] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 744.099276][ T5630] __mutex_lock+0x19d/0x1550 [ 744.104411][ T5630] nbd_queue_rq+0xc1/0x1150 [ 744.109456][ T5630] blk_mq_dispatch_rq_list+0x499/0x1990 [ 744.115544][ T5630] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 744.122414][ T5630] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 744.128940][ T5630] blk_mq_run_work_fn+0x16c/0x300 [ 744.134504][ T5630] process_scheduled_works+0xa8e/0x14e0 [ 744.140584][ T5630] worker_thread+0xa47/0xfb0 [ 744.145720][ T5630] kthread+0x388/0x470 [ 744.150337][ T5630] ret_from_fork+0x514/0xb70 [ 744.155488][ T5630] ret_from_fork_asm+0x1a/0x30 [ 744.160800][ T5630] [ 744.160800][ T5630] -> #4 (set->srcu){.+.+}-{0:0}: [ 744.167942][ T5630] __synchronize_srcu+0xc9/0x2f0 [ 744.173420][ T5630] elevator_switch+0x1e8/0x7b0 [ 744.178798][ T5630] elevator_change+0x2fa/0x480 [ 744.184122][ T5630] elevator_set_default+0x375/0x440 [ 744.189858][ T5630] blk_register_queue+0x3f3/0x4e0 [ 744.195467][ T5630] __add_disk+0x6cb/0xe30 [ 744.200336][ T5630] add_disk_fwnode+0x100/0x3a0 [ 744.205639][ T5630] nbd_dev_add+0x733/0xb60 [ 744.210590][ T5630] nbd_init+0x15f/0x1e0 [ 744.215348][ T5630] do_one_initcall+0x250/0x870 [ 744.220659][ T5630] do_initcall_level+0x10a/0x1a0 [ 744.226172][ T5630] do_initcalls+0x59/0xa0 [ 744.231035][ T5630] kernel_init_freeable+0x29d/0x3e0 [ 744.236774][ T5630] kernel_init+0x1d/0x1d0 [ 744.241636][ T5630] ret_from_fork+0x514/0xb70 [ 744.246779][ T5630] ret_from_fork_asm+0x1a/0x30 [ 744.252078][ T5630] [ 744.252078][ T5630] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 744.259914][ T5630] __mutex_lock+0x19d/0x1550 [ 744.265058][ T5630] elevator_change+0x1af/0x480 [ 744.270370][ T5630] elevator_set_none+0xb5/0x140 [ 744.275777][ T5630] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 744.282132][ T5630] nbd_start_device+0x189/0xb30 [ 744.287533][ T5630] nbd_genl_connect+0x1597/0x1c10 [ 744.293091][ T5630] genl_family_rcv_msg_doit+0x233/0x340 [ 744.299168][ T5630] genl_rcv_msg+0x614/0x7a0 [ 744.304203][ T5630] netlink_rcv_skb+0x226/0x4a0 [ 744.309504][ T5630] genl_rcv+0x28/0x40 [ 744.314027][ T5630] netlink_unicast+0x7bb/0x940 [ 744.319376][ T5630] netlink_sendmsg+0x813/0xb40 [ 744.324706][ T5630] sock_sendmsg_nosec+0x13a/0x180 [ 744.330286][ T5630] ____sys_sendmsg+0x54e/0x850 [ 744.335596][ T5630] ___sys_sendmsg+0x2a5/0x360 [ 744.340818][ T5630] __x64_sys_sendmsg+0x1b1/0x290 [ 744.346304][ T5630] do_syscall_64+0x174/0x580 [ 744.351450][ T5630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.357885][ T5630] [ 744.357885][ T5630] -> #2 (&q->q_usage_counter(io)#55){++++}-{0:0}: [ 744.366536][ T5630] blk_alloc_queue+0x544/0x690 [ 744.371858][ T5630] __blk_mq_alloc_disk+0x194/0x390 [ 744.377518][ T5630] nbd_dev_add+0x494/0xb60 [ 744.382488][ T5630] nbd_init+0x15f/0x1e0 [ 744.387186][ T5630] do_one_initcall+0x250/0x870 [ 744.392512][ T5630] do_initcall_level+0x10a/0x1a0 [ 744.398005][ T5630] do_initcalls+0x59/0xa0 [ 744.402893][ T5630] kernel_init_freeable+0x29d/0x3e0 [ 744.408631][ T5630] kernel_init+0x1d/0x1d0 [ 744.413513][ T5630] ret_from_fork+0x514/0xb70 [ 744.418670][ T5630] ret_from_fork_asm+0x1a/0x30 [ 744.423966][ T5630] [ 744.423966][ T5630] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 744.431196][ T5630] fs_reclaim_acquire+0x71/0x100 [ 744.436672][ T5630] __kmalloc_noprof+0xbc/0x720 [ 744.441979][ T5630] tls_sw_sendmsg+0x599/0x2860 [ 744.447349][ T5630] sock_sendmsg_nosec+0x90/0x180 [ 744.452835][ T5630] sock_sendmsg+0x1ca/0x2d0 [ 744.457902][ T5630] splice_to_socket+0xb5e/0x12a0 [ 744.463380][ T5630] direct_splice_actor+0x101/0x160 [ 744.469025][ T5630] splice_direct_to_actor+0x57b/0xcb0 [ 744.474935][ T5630] do_splice_direct+0x195/0x290 [ 744.480346][ T5630] do_sendfile+0x52e/0x7c0 [ 744.485300][ T5630] __se_sys_sendfile64+0x144/0x1a0 [ 744.490955][ T5630] do_syscall_64+0x174/0x580 [ 744.496090][ T5630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.502533][ T5630] [ 744.502533][ T5630] -> #0 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 744.510644][ T5630] __lock_acquire+0x1520/0x2cf0 [ 744.516046][ T5630] lock_acquire+0x106/0x350 [ 744.521092][ T5630] lock_sock_nested+0x41/0x100 [ 744.526393][ T5630] inet_shutdown+0x6a/0x390 [ 744.531442][ T5630] nbd_mark_nsock_dead+0x2cb/0x550 [ 744.537107][ T5630] recv_work+0x1cee/0x1e10 [ 744.542055][ T5630] process_scheduled_works+0xa8e/0x14e0 [ 744.548140][ T5630] worker_thread+0xa47/0xfb0 [ 744.553266][ T5630] kthread+0x388/0x470 [ 744.557881][ T5630] ret_from_fork+0x514/0xb70 [ 744.563023][ T5630] ret_from_fork_asm+0x1a/0x30 [ 744.568323][ T5630] [ 744.568323][ T5630] other info that might help us debug this: [ 744.568323][ T5630] [ 744.578564][ T5630] Chain exists of: [ 744.578564][ T5630] sk_lock-AF_INET6-NBD --> &cmd->lock --> &nsock->tx_lock [ 744.578564][ T5630] [ 744.591630][ T5630] Possible unsafe locking scenario: [ 744.591630][ T5630] [ 744.599158][ T5630] CPU0 CPU1 [ 744.604571][ T5630] ---- ---- [ 744.609965][ T5630] lock(&nsock->tx_lock); [ 744.614421][ T5630] lock(&cmd->lock); [ 744.620965][ T5630] lock(&nsock->tx_lock); [ 744.627942][ T5630] lock(sk_lock-AF_INET6-NBD); [ 744.632827][ T5630] [ 744.632827][ T5630] *** DEADLOCK *** [ 744.632827][ T5630] [ 744.641058][ T5630] 3 locks held by kworker/u9:3/5630: [ 744.646355][ T5630] #0: ffff888022700140 ((wq_completion)nbd7-recv){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 744.657678][ T5630] #1: ffffc9000401fc40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 744.669444][ T5630] #2: ffff88803d1fd068 (&nsock->tx_lock){+.+.}-{4:4}, at: recv_work+0x1cd9/0x1e10 [ 744.678792][ T5630] [ 744.678792][ T5630] stack backtrace: [ 744.684696][ T5630] CPU: 0 UID: 0 PID: 5630 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 744.684717][ T5630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 744.684730][ T5630] Workqueue: nbd7-recv recv_work [ 744.684751][ T5630] Call Trace: [ 744.684760][ T5630] [ 744.684769][ T5630] dump_stack_lvl+0xe8/0x150 [ 744.684801][ T5630] print_circular_bug+0x2e1/0x300 [ 744.684822][ T5630] check_noncircular+0x12e/0x150 [ 744.684843][ T5630] __lock_acquire+0x1520/0x2cf0 [ 744.684871][ T5630] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 744.684948][ T5630] ? try_to_wake_up+0x8c5/0x14d0 [ 744.684983][ T5630] ? inet_shutdown+0x6a/0x390 [ 744.685001][ T5630] lock_acquire+0x106/0x350 [ 744.685036][ T5630] ? inet_shutdown+0x6a/0x390 [ 744.685056][ T5630] ? __queue_work+0x1ea/0x10a0 [ 744.685078][ T5630] lock_sock_nested+0x41/0x100 [ 744.685093][ T5630] ? inet_shutdown+0x6a/0x390 [ 744.685111][ T5630] inet_shutdown+0x6a/0x390 [ 744.685130][ T5630] nbd_mark_nsock_dead+0x2cb/0x550 [ 744.685148][ T5630] recv_work+0x1cee/0x1e10 [ 744.685171][ T5630] ? lockdep_unlock+0x5d/0xd0 [ 744.685190][ T5630] ? __lock_acquire+0x13e8/0x2cf0 [ 744.685233][ T5630] ? __pfx_recv_work+0x10/0x10 [ 744.685257][ T5630] ? process_scheduled_works+0xa20/0x14e0 [ 744.685280][ T5630] ? rcu_is_watching+0x15/0xb0 [ 744.685298][ T5630] ? process_scheduled_works+0xa20/0x14e0 [ 744.685317][ T5630] process_scheduled_works+0xa8e/0x14e0 [ 744.685348][ T5630] ? __pfx_process_scheduled_works+0x10/0x10 [ 744.685370][ T5630] ? assign_work+0x3cf/0x5d0 [ 744.685390][ T5630] worker_thread+0xa47/0xfb0 [ 744.685416][ T5630] ? __kthread_parkme+0x71/0x1f0 [ 744.685442][ T5630] kthread+0x388/0x470 [ 744.685466][ T5630] ? __pfx_worker_thread+0x10/0x10 [ 744.685485][ T5630] ? __pfx_kthread+0x10/0x10 [ 744.685509][ T5630] ret_from_fork+0x514/0xb70 [ 744.685536][ T5630] ? __pfx_ret_from_fork+0x10/0x10 [ 744.685560][ T5630] ? __switch_to+0xc89/0x1420 [ 744.685582][ T5630] ? __pfx_kthread+0x10/0x10 [ 744.685606][ T5630] ret_from_fork_asm+0x1a/0x30 [ 744.685628][ T5630] [ 745.874404][T25411] Set syz1 is full, maxelem 65536 reached [ 745.908658][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!