last executing test programs: 3.24841348s ago: executing program 4 (id=1956): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0x3, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001300)={&(0x7f0000000c00)='net_dev_start_xmit\x00', r3}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [], {0x14}}, 0x28}}, 0x4048010) r5 = socket$igmp(0x2, 0x3, 0x2) getsockopt$inet_int(r5, 0x0, 0x22, 0x0, &(0x7f00000000c0)) socket$nl_generic(0x10, 0x3, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f00000004c0)=ANY=[@ANYBLOB="16080000000000a1878b9bc9ba4c5900ffffffffffffff7f13", @ANYRES64=0x0, @ANYBLOB="0000000000000000b70200001c000000b7030000000000008500000005000000bca900000000000035090100180000009500000000000000b50900001a000000c3aaf8fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffa4090000220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf980000000000005608000000000000850000000700000300000000000000002100000000000000"], &(0x7f0000000980)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', r6, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x94) 3.105577649s ago: executing program 4 (id=1959): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="2c0000001200576326bd7000fbdbdf2507000000", @ANYRES32=0x0, @ANYBLOB="2000000004210000080029"], 0x2c}, 0x1, 0x0, 0x0, 0x80d0}, 0x20004000) recvmmsg(r0, &(0x7f0000004ec0)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x10000, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) unshare(0x6020400) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f00000001c0)="adaf44", 0x3, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000000c0)={0x0, 0x0, 0xfe, 0x2, 0x0, 0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r2, 0x1) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000100)=0x1000006, 0xffffffffffffffde) recvmmsg(r2, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e0000006600816657bb97c9269de9aaec8488040f0000004cb9cca7480ef402000000e305000a00000200000000", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) socket$inet_mptcp(0x2, 0x1, 0x106) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$PNPIPE_HANDLE(r6, 0x113, 0x3, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x140e, 0xc3ef2dc4aaddb62c, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4001}, 0x10) connect$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x5, @none, 0x687d, 0x2}, 0xe) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r4, 0x81f8943c, &(0x7f0000000200)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000000400)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000600)={"7651f7694963198af76736c44abffab6", r7, r9, {0x100000000, 0x80000001}, {0x2, 0x4}, 0x2, [0x1, 0x8, 0x81, 0x6, 0x7, 0x2, 0x7, 0x10000, 0x7, 0x100000001, 0x0, 0x6, 0x6, 0xe, 0x2, 0x7]}) setsockopt$packet_int(r5, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x29, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000080)=0x1, 0x69) sendmsg$IPCTNL_MSG_CT_GET(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES64=r8], 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a40)=ANY=[@ANYBLOB="2c0000001d00070f000000000000000007000000", @ANYRES32=r11, @ANYBLOB="00005200060005000100000008000800", @ANYBLOB="ea"], 0x2c}}, 0x20008000) 2.849971427s ago: executing program 2 (id=1963): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtfilter={0x63, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0xfff3, 0xf}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xed43, 0xf8, 0x6, 0x9, 0x951}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x8, 0x8}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40045}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r4, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), r1) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x24, r5, 0x800, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004080}, 0x200040c0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x4, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000c00) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 2.633932775s ago: executing program 2 (id=1965): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000100)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r3, &(0x7f0000000540)=[{&(0x7f0000000100)="89e7ee2c21fe62a3b47380c96558", 0xe}], 0x1) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r2, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010025bd7000f767df400000a248bd2acaa0", @ANYRES32=r6, @ANYBLOB="50002f800c0002000203aaaaaaaaaaaa0c000380080001000200000034000380080001"], 0x6c}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) 2.165199175s ago: executing program 4 (id=1966): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'veth0_to_hsr\x00', 0x0}) socket$can_j1939(0x1d, 0x2, 0x7) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r1, @ANYBLOB="0500060001000000050007d60500000005000300df00000008000200", @ANYRES64=r0], 0x68}}, 0x0) 2.02288841s ago: executing program 2 (id=1968): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002000)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x39, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0x4000000) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[], 0x30}}, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000000)=0xe39, 0x4) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000040)=0x92c, 0x4) recvfrom$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) r6 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r6, 0x110, 0x5, &(0x7f0000000300)=[0x2, 0x1], 0x2) setsockopt$inet_sctp_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000240)={0x3, 0x1d, 0x1, 0x93, 0x9, 0x7f, 0xb, 0x1, 0xf2, 0x4, 0x6, 0x9, 0x3, 0xf8}, 0xe) getpeername(r2, &(0x7f0000000000)=@x25={0x9, @remote}, &(0x7f00000000c0)=0x80) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket(0x6, 0x3, 0x4) bind$bt_hci(r7, &(0x7f0000000080)={0x1f, 0x2, 0x3}, 0x6) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) write(r7, &(0x7f0000000140)="5c000000010006", 0x7) r8 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000100)) accept4$packet(r8, 0x0, &(0x7f00000001c0), 0x0) 1.950991327s ago: executing program 4 (id=1970): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000007710000104fc9b4f0f02", @ANYRESOCT=r1, @ANYRES8=r0, @ANYRES8=r0], 0x40}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x34, 0x13, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2400000019000100000000000000000080200000000400050000000008000f000700000003a2e3ca7955bbec915b7a080117fa9eb85be502f96f042ee430193e75476c"], 0x24}}, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = socket(0x840000000002, 0x3, 0xfa) setsockopt$inet_int(r5, 0x0, 0x21, &(0x7f0000000140)=0xec62, 0x4) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000008500000097000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r4) ioctl$sock_ifreq(r0, 0x891f, &(0x7f00000001c0)={'team_slave_0\x00', @ifru_settings={0x2, 0x8, @te1=&(0x7f0000000180)={0x3, 0x8, 0x3e11, 0x8}}}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) close(r7) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01020000000000800001410000001c001700000000000000006574683a73797a6b616c6c657230", @ANYRES16=r1], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r10) r11 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x4, &(0x7f0000000480)=@framed={{}, [@alu={0x4, 0x1, 0x3, 0x0, 0x0, 0x1}]}, &(0x7f00000005c0)='syzkaller\x00', 0x6}, 0x90) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x8001}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x25dfdbfe, {0x0, 0x0, 0x0, r12, {0x0, 0xe}, {0x2, 0xb}, {0xd, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x400c010) ioctl$SIOCSIFHWADDR(r10, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.82682189s ago: executing program 0 (id=1973): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), 0xffffffffffffffff) (async) mmap(&(0x7f00001b3000/0x1000)=nil, 0x1000, 0x7, 0x40010, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000040)={0xffffffffffffffff, 0x9, 0x10000, 0xfff}) (async) epoll_create1(0x80000) (async) socket$unix(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$inet6(0xa, 0x800000000000002, 0x0) (async) socket$kcm(0x2, 0x3, 0x2) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000080000000d"], 0x48) socket$inet6(0xa, 0x800000000000002, 0x0) (async) socket(0x28, 0x1, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) socket$inet6_icmp(0xa, 0x2, 0x3a) (async) socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) (async) socket$rds(0x15, 0x5, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='task_newtask\x00', r2, 0x0, 0x2000000000}, 0x18) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r3, @ANYRES64=0x0, @ANYRESOCT=r1], 0x20) (async) openat$cgroup_ro(r0, &(0x7f0000000000)='blkio.bfq.io_queued\x00', 0x275a, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r4, &(0x7f0000000200), 0x806000) 1.679938039s ago: executing program 0 (id=1974): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, r1, 0x1, 0x70bd2c, 0x25dfdbfb}, 0xfffffffffffffede}, 0x1, 0x0, 0x0, 0x4c000}, 0x4040000) 1.619976543s ago: executing program 3 (id=1975): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) (async) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x3, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x2, 0xff}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) epoll_wait(r0, &(0x7f0000002a80)=[{}], 0x1, 0xfffeffff) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x9d32f4b2e0c65377}) 1.590566213s ago: executing program 4 (id=1976): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x4004) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in6=@private0, 0x0, 0x0, 0x4e21, 0x0, 0xa, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty, 0x0, 0x2}}, 0xe8) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x101042, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0xffffffff, '\x00', 0x0, 0x0, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="180073375d4cfc76388d8100000000000000000000000000f1cb125b8361ff7fc8dcb100b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200", @ANYRES32=r5, @ANYBLOB="0000000000000000b705000008000000850000006a0000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r6}, 0x18) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000000c0)={'wlan1\x00', &(0x7f0000000080)=@ethtool_stats}) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0001c2cb0000000d00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fe80000000000000000000000000003c"], 0x5c}}, 0x40000) sendmmsg$sock(r7, &(0x7f0000003640), 0x0, 0x20040059) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000100)=0x14) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r11 = openat$cgroup_pressure(r10, &(0x7f0000000140)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r11, &(0x7f00000001c0)={'full', 0x20, 0x6, 0x20, 0xfffda}, 0x41) close(0x4) socket(0x1d, 0x2, 0x6) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x3}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000840)={r9, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, 0xffffffffffffffff, 0x4000) socket(0x2a, 0x2, 0x0) 1.511658316s ago: executing program 0 (id=1977): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x34, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r0, {0xffff}, {0xfffe, 0xffff}, {0xc, 0x6}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xfffffffffffffe1b}}]}, 0x34}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000003c0)='sys_enter\x00', r2}, 0x18) nanosleep(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @private1}, 0x1c) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r4, &(0x7f0000002a80)=[{&(0x7f0000000a00)="1b", 0x1}], 0x1) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) write$cgroup_pid(r7, &(0x7f0000000000), 0xffffff98) splice(r3, 0x0, r7, 0x0, 0x80, 0x8) write(r5, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c0001800600060065580000d1000280cb001480080007"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 1.389775093s ago: executing program 3 (id=1979): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='freezer.parent_freezing\x00', 0x275a, 0x0) writev(r0, &(0x7f0000000380)=[{&(0x7f00000003c0)="ea", 0x1}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4000003, 0x13, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_buf(r2, 0x0, 0x8008000000013, &(0x7f00000003c0)="17000000", 0x4) sendmmsg$inet(r2, &(0x7f0000005240), 0x4000095, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x100, 0x1, 0x81, 0x0, 0xd, @local}, 0x10) setsockopt(r1, 0x8, 0x2, &(0x7f0000000080)="035d13a0fb92c57b921aa86063be70524837af154f2ed0a2a9aa9615ddfe9ca51c487e186acf175250f16bf2f0cc355eae7fc72288a96cb128557d0b518548cd631f6e94959cacb97e559f9e28288eca2f977412b2504daa7f8d5cba9631766a87a952e437ee0118fef3e5dfa290ba87eece5b665c5ddfc8f45ec262", 0x7c) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000240)={'batadv0\x00', &(0x7f0000000040)=@ethtool_gstrings}) 1.168085273s ago: executing program 1 (id=1982): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r2, &(0x7f0000001280)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x29}, 0x9}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000ec0)="ada3468ff5", 0x5}], 0x1, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695e85000000a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918000000000000002900000037"], 0x590}}], 0x1, 0x8008801) sendmmsg$inet6(r2, &(0x7f0000001540)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000140)="c8100b8210e864858a792e43fa6bdba69852f18093a285b2c3c42224e31cd6196a4ef100200ea673", 0x28}], 0x1}}], 0x1, 0x2604082c) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000840)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff3, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0xe37, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x40010) 1.152886307s ago: executing program 2 (id=1983): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x40, 0x8, 0xfe, 0xff7ffeff}, {0x6, 0xa, 0xfe, 0x8001}]}) r1 = socket$can_bcm(0x1d, 0x2, 0x2) readv(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x20000216}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x71}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r6, @ANYBLOB="0c00990000000000000000000800a100ffff0000080026008d03000008009f"], 0x40}}, 0x0) r7 = socket(0x2a, 0x2, 0x0) accept4(r7, 0x0, 0x0, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$nci(r8, &(0x7f0000000000)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x0, 0x2, 0x2, 0x9, {0x1, 0x6b, "628386f8e7042b388b8271827c243baa9664e57fc4ec559f2527724b2042aa0a7b4922ce5144c30dcf22a320e32a10afde35297f3089c91d68fa5fc11357597b99d59bc3cae9cc326a367990403d199dc2154c70b5c42a0a0eda0a419b67428dc8692306931b306cb01288"}}, 0x70) r9 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-generic\x00'}, 0x58) r11 = accept4(r10, 0x0, 0x0, 0x80800) sendmsg$key(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0xe, 0x8, 0x9, 0x2, 0x0, 0x70bd26, 0x25dfdbfb}, 0x10}}, 0x8000) write$cgroup_int(r9, 0x0, 0x0) recvmsg$unix(r3, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000100) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000940)="1a06e3cc4e", 0x5}], 0x1) 1.031489438s ago: executing program 3 (id=1984): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01bbdd000000000000003d0000000e0001004907740000000f0002006e657464657673696d300000a0fd820000000000000000000000041ffb1dae8c3814fdd29d12d03f46c23d0b9750c433994e3668a8fbf7cca51b8613638369ddf6504b7812d60e91f3e0f36de8e416267ebd4d73d533630789140da58bd202297dcf35ef0b26163ad0f633366f6e4b5a917595ac5207c7f3e728"], 0x3c}}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b14, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000b40)=ANY=[@ANYBLOB="20000000120001000000000000000000040000000c002e8008002600", @ANYRES32=0x0, @ANYBLOB="6ad3bb8a5e401156b9d4960d2b08c5aff779029a34d7089d8858858ad1e97b9abaa08141672a230a72cde0a9017225335f55ac04caef66041e619b9e81237d93a638fd1d76fdf104a848e741256723e4d56d16d730eadf61210b1c0e303b6b224e43e6fd8b3a01c3e367ea0e5d072b06bd9a2223e32c5a9a6252cceb3a574d5d2652b2be5e69b9a039fcbc53450f94dea458a47506f9504161d8ee8555e4c6daa9b866227e45d49afdd4cdb49cda6e6684083ee883feb09958663f4115abb57eaa"], 0x20}], 0x1}, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x77, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000140)={0x0, &(0x7f0000000280)}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e22, @private=0xa010100}, 0x10) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000180)={0x6e1f, 0x7, 0xfffffffa, 0x1}, 0x10) write(r4, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000000000200000800040001000000", 0x24) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r2, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000c40)="5c5eafd3ae55a73702d6befaee97f47f4be65587e1fca708cee084691e4587d887a5eaab43ac5edc4886496910cd7a153cd84b93208c7b1a625b3ea990092389b19dab4f61e30ee60a4d7e51ffc9a5accbe20844356dd0ce192542d5e58d80657b3b5fb7a3d39337df", 0x69}, {&(0x7f0000000800)="104b0b7073fbd7f77a847bdbfdf6da474f700bf113b18d16d8380f42e296b49f1326c7d0d97be798e205654b8a885df6ee57ec7b690491c55ca484b54170549c7a72b8a579005ffcb0b309dae34571b17126534a763ca881f12d750072abc05a7cb8f0e32fc3ec3ed14c3322630ae8e710fb68299cbb5accee8813185c77248ddec7b5688599f1bfccbec448bc6ce5c139c2095da22c9d7edf7bfa1392c76ab0dddf4db130420df295ea16aa3e841d50dc813025315eea3990c2de68e835c4fec57e2dd70f47b58472c2f915de1a", 0xce}], 0x2}}, {{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001800)="353a35d6094e4ee7d764b6993f65136c5d6b84d9b1324a0b25e094700c9a66f9181738098f32e3e48859c3878d53a9752474da0d6af299d849d48f2fa2c8c807d7a1521da940585790ff1e6f9da83e32b751d1af9cfac640c1361f5ae8b99c187dafe9ea854120f6eaab11e7fdeb3f2152ebdbc21520ca01f64bb821576deef4ed6696cdddc1768b5b4fbd68a687cb6ba52ecf5cc6f8f05062f26de19d6aaaeb6cbca00e46685f77d2b3e8dd9d0d099e799cd5a76c67ab283f790366f7f744508edc9e48fa101b89215b", 0xca}, {&(0x7f0000000180)="d7dbdba577061e4e52e720022b7a3b0f40cfb0205e5fc23d7555ac21b674feb3b7bf705d3b4fd1d84d60baa95963d6a74c1ec58f17070cc392c83893878d1bfdb771963f938e002c13ddb6ef11d265b4543c", 0x52}, {&(0x7f0000000d40)="3794c1c2f791f4e67f50ea7bc95a2842f2990f3d7d9754304cde9192d23d13759fedda217763c26d7414268fc5a85a809bbaaf0c8cbed9c8b4f957ddecc49039374768b86dcb17cce76e74b0d44f99f084ab096b7a67672c7d7980fd65aa90191a5b74253d8c21b1ac8e06f1477d10d5d8d4e364c7352ba05f4fc0b12da748c8c379a6239d9829fedde9f66e3950873f43", 0x91}, {&(0x7f0000001900)="1cc83f21c7ae8e724d5a897d8d9fef44e0322a7741e5dcd17acda9a97cd3f9af381e73427e363ef43c3762a232e76d1cbcfca6a26461e6b05b56c6eafc2db8edd972909b602c534491a7f23f62d907bf3b431c6696c51b4f2581db9acab4a266740aa5e77ceef07a37e2f4c9f71e9f63feb66c7e8e92809604e296fe227bf9d1884ae001a24241c6b5787ffbdad04730cd691dfb4ff8244c6a90cdf25b9d75eec2ad50e982f54f6782be9ad982bb0763fbf4df6d0ca118dafd93c280977d42ca3cc0490dc36733e6e30386a054038cbb2ae1b9417eca0c9259c383146cbb8cc78d2e845fa4d330253ad558e5454aaf81006229c75e55c201ea6d9b7527df5155e4e114035d5a39b588c64f1a34463e3f4a4a8a2ed6008383b72bcdf05bed9c8f4c42490acbe635703fc7b3e1d33ef80089f413112dcb313b2f03103ede66dc777969fa662a334db6185c69858f1f24dbf2f61b420d24ec75b91162f41dd679f32775786af1a30c4ea998950697821f1cbe2f7578a2074d308c8e9cc8600449a729adaee58029c6589ea26bee83ac4de24c16048082e4aa6ce9bfeb4ddc83d2b95600c972a853c214b26fae2f8efa1e996c565388e79f6b4d588767e2c0c3e16e86dfc94d83e4d103b95eb4ce9ca5ae7d355e0e8c48902a0c48d2670b3eab9284f811de447b808eeff944d1e01c98c14a62b052688bfe6e937807c0923c93a8d5d4b320873018f6fcfea7c0e185bbbdf6ae89571bfcad9b9a8e774ca4fefa20e7f7b16c0874ab9a815884e069cac95321978a2acd087c808ed67f09c98c88bca2c278c191d95b2d630e9b8c4ae09d214dff16cdbeae7f1621193194ba2a0a9641a43218e3f09c963ad0428fef940c1b592552edba50ce74861b524211da9132573a3271f3afe1fb8968ee30ceafcd2006a3d050124666da21ae648d671c3c9a2655ddb264acd6293c13dbff4d26e4430efc73675f38c3a3e7958e0a79e3316092a4113dd077d71aa3304d505e016027e025f25d58df047ad6e6505cd74a967636c7155fb1cf8a56df85c8cd41db86dc60ee150d2d3ca0ccf880c7372d7d928784f7b29ad45dda65f15113e0424e44f6a3cab3202d2949f2f38fc128575ec786fab7f7971a822f947e9e1418a1a78ab64bc9b0f2ebd3803ef444db994c255791e1501beacea139a2ba632f644f133b09bd04eb3f20e79c5d17d0aa11b42a32f3062e14192a18e8349fe8684bc9016849e18c2f60efe374204d659e33eadd319c679c6f5cb8a0853eb44ecf341550d291bb4c4e449fbee01c2a8c792c0e358c449a6f9e377a46941df37d17ea1d8640178d1d711fbf89994be24d75d01c24a0d86b8375de590244124c802b95a2fc034d1fc2198adfd7c408a631cc16b0624b08508ed3d8de81a55c1878513ee0839779c34dcc96e2957af6409f7115aac5ae3f3361b788b581ffb47e682ef6c5279c2bf3da4b3b8273c928be78b8f5a10630b37c839400a311fa4cab52448fc4fd0d45bb58c684dfabac3cdc50051f574c390fae5ca7f56e6c6170383816bcb5e5e7a1f492a28475cd0fcc1bc124c2a1e3bc11dd7025737038dd985cbf918b9670e829a290852f16d7b482c316350c4ac322504192f938d59b7df578d24608fdb3305233f2c73c6535201315335898c19d0c7554330edf1efbeb442bc619c40cac56d943b13c5de6fa5cb5372412d215271d82bcbf3654105b1fd31c25dc6564293ffafdbd70302e2776ca2e9fc23c6f332e5b8852340d3ac0d34d7194619bc67d8351ac21dee61e455bc70b7d06b85a1c1dbdcea0ff3142b8beb6091b9ebf3b8f08bc3ca7c816c07924e74a0c73a8d9f7882ecf04171bb3598d6c580cc816f7012d10d86fe1ece0a78bd033fcaf1bda5b73430dd0b8785469018cc2a41e47fbdd2999fec46ad5310f385af0ff6f443a486c6b98a72d76e15033001d2ea26710e5da5fdb9190529cb92bd1281de7e8ea5ef6e2e09927a0b1466b3220d82fd6b4d57a6d19f285e40b55da713a546c922d554511a24fdc95de9ed7db774498a7acfda7c97a40732fc7ba580314d5d7ceee3fa05c0858ca6676ce2ffb9ea070dbd47e71fe0eeb202637847b6d39ba58c74295c5a7966d1a29d0b3652a19fed4d88c42c5eaa8d697d3cc1bddfdd9eac170d052c21ec14a58592cb3624e442267233f9b33aadb3fc0bfbadc04a1047fecbbe3db67743fb2852219048c716775a115a4dd44a8f1e98ff7f37762349d2422797942097e9eac47bf6e8504a449843a8f9e71d43691da669b0dce5f422b33b9c90da91d5dfab54d1f5630c3b7c31ff6356cd6735f46e3e2afeaaa78f179d624436d419857e3709234639706d6246cadace6f7a3b13ba71e074b5e83478326f78723eee529cac1e7f3516dc512a95110217814f639a445d35263ed6bf29d9b06398b680f853a9fb3e367a453b4c3a5616e3ed76842ec8d87e13e2a50f212d3adbb9ff6ceb2910823f5c1b57af3407fc2567a72e8f8995daa7f5ef1c77a5e7196957699b8191db6b6b5ceb85f08c3f2aece1d262c06cffda73e5489689a7357f57d4a5c1ef06a1194d01adab020c6e1e450e423d66531b0e2b3498fcfbb1029b21148d338cdfb25f6c9b7c6c4d3c9febfe9f7fd94b59f7d936604ca4c0f214f3d95abbc2fa3d7900ba954cc85695ec9f2f55815665904c3cc0d997a170ec436c7d02cf40543645dff95087716d1fe42ed1b449a5171c7c45c72dcef6839d2d3888707593bb182f41f72704dea45eca16df3644d87e3ee3496190289c7b61219954b6ae4808fe0d1bbb4a396ee88203f02171e65c8ea17caf2509c92767bd2aa8e4bcc35ba48dc142e3928a95d70ca42aa61901a63e8a416ec2f4b9b26b548ac12f0abc0848b4776f3881e36cc3ebff61943931d63325991e57d6f27bb74de9bc09d0dbd83345e9a641d0c8384063ae332c9fbbb5b2ddb8b37cb559647eadb1fa827e6a9ca6cd24cdab367afbae9b9e4023e540ebde1a392f9c2e494c39ebd8a6f903cb91b5500f7d7c0196719913289737d31df670ae2974fc686586d8ae94a84d6d1bf8aa60c89e5e51225ec7f83664b6cad719df62cf355f30d6bacb3f621bb665e4e19f01e0f84caf8e093b1be0d6327f9dc90cc8be98f2d41d08f1678a56b7a9d81aa82993b54ed4ac6408ad5084e0222de43c773c380a55f1c88675e44827058b7bdab5ba9fe55e7a3699ae87f56744370e7f5f0fa1b7a97abf1e097c2c9cd4f76432ea98b0a3e9c11aed00759ce8b05a1f928d01bc95676892869dac62fa4aba2a39dd20d744d22c3dc7e1a3f09ff74750070c2e57ba2475d7697dae79ed2c0ca6eec35ff81f980d08a886a9e75239acea264c97ccc39a42e2a185a4f7a78d80c27db975a47c77a439d87916c588cb768c0ea53a7362b4982028ce82807bdd94fcfd21c77676aa13679346cce9b69f9a724bb56ee3d2f75e2e0fca935779440e63e981c23bc0cb9d13e75b2b50ab364f204b86eb175889545efb501fba30fe3297f675d9793e3f9c73aede06a9ac39003dbae466548ed6861d404c09dd87bf62821a8247259891d76ed86aa4b60c70baa288470b71cda444fdd3c6e70075ece7e216ae90f6d8bc782f0dd8204b62d1ad759316240a40dc764c7c0ea9ca4386f8630dafa8ccf6cec651249a9dddd4e0a748dba67c45d11e0993eaf29a88bd5352ebedc84f11ea34ca5ce40d984492fec23b21203222fcc94a785d2347d8f21e31f59eadabd05ea6f716de90e73920d963b3e816c7dd7b7ef36b87b22510966493a9d1e84b7c542afce893c701bf20279347dab5d5442bd01e921555414f58113c313f60830a1a4de30cb99e1ab74cba2fdc7e22a15e6a1a17d6ffbff2146466c804804af45718ff0aed6223f7478d4ee4b3462ffac5d193c6751233864416b821aa9e7382c4b5b1254e1586a0c0986ed941f4e9b796566f4c929e3a765b2be16249b4693f48214bbd8019b4ad197013a5f4bac53783dae5c57986882ed7f53afc55af36cb72deed408ee9cc9399ec716b34da39d7a312f8974cd718e2b4d3605c720e864661a45b44a33272f7f1dcf451c24afd79f6bb64f3d856503a25298a630525c9e0d60cbdd42788d2b020894c2dd472a05a4137c7498db48b03e183eaf39d8118fe1cbfa7accb5d2bb2b517edb4aab5f04005a0da0256563240eeeb2cce721b2abde4dc38d8c718bf4c9388f50b627dd73d46a46d3094825e95c234cd8c9d95f3d72dd60e43e04006758adfdae2d6a9bace671bb12f23abf4a46325224be1d50d96617ff50b69cbef1d3ce3a12a7d600d6755bc03df3508a8de2a0496c2c2d3b7157861f38323fdc99b11917b01adc09f8097d1759ab8e0296eee07b2ab9c6a843e65c3675964578d31db110578a74a058b5a49550a90caf39a1b495ef375b7216f6044fa576fb77bdeef359e12e4c90a080415e949187a29836ddec4d67860dbf442b33393f1a0869b9d06d700062b59c431b282fa5026329d03a771bf3b741b6d511ffe186e284258e8d22b33df440d5ecf2ac93b97bde7b460186ac9a272f5122a4a6b26e663fe86e3edad67efa24d5daabe16b135ea50883eb1caeaaa0029a79bed9b740f257997c69b988174b46dd1429cc979dba275271bef7384b4bef53712920899b2faadb3c48ac87a2697ba41c2419e8710bf0d2e654e1fe269ede31781a39f1088c323502ae4247340f575057f9289ca72e3ffedff78597f81e8c4f6a996dc62fcdcd760fc2cfc75e1bc555a100999ec7ba7edd1489332a0072accca410b7e9310177bb4327a22a0e86f6ec7c5df819cf5aa2dd70ac097d7c75df852294fc37962dd2733037184b9913da86fcf2888ad1a79df5e90d7f32caf3cf6cc931ef301e41cc9cc897502a689755bce8049a74aef870af73c492ead32558a7ef32a7f6c7e0aa5e991547a3d149fecebcd9f3e437d369e23a07e40b28db983235a68924e4a08aa71018aef9f6d4a6a7aef533729288a396b2ba19f36128da27a80fa4994d6f7553a4ef9a42e3ab4ff0ad7ec945eeff54b9c9ee1594a854145af2dfb2a559fcffba0a76a597250412b29bbeed43392e768e594e860c20934cca2db8de67a1a89697acdca6b30293ca72c025ab6000ef1714a961e78de5aff52c6da0504f3a85ab51ac4e9cdb0101492227654daa39bc8f5a5b8d94ce574af84e729b952b58abf454f6875d2359866ee9023aeea8c598c3c054ab62d1124157c1e333681fd04a7bbba6f9640aa66a4b84105e82993dcd7b6d515e878886daae4cc038aa116f25b55ea3cca6c13764c5d9e84ec7397e6979e13c8563ae2adf0843faef1232fe3f3d23b2a777e46ddd77db4d5dd62e2747ca5ae18833a1b1388b7bb8add7ba5416ae3123d56d56e7a1fec71954a35d142cebbc552b9c346912fc7294533037ab2ee8c2f8a4c4948ecd29ef05d34bc603ff0583a526254f38289f8b7174762d3591c7f2f812d79d57667061f3fa507b21c8fb0756a314f2fef2e73b9be1af4790abca545d55e889f6605411518689c25a2b5892a68d4cc279e032c13d615656376cf291089dd5c8ddaf9a50479b383d5997aad34c7c1e5542e6d5d88270001d75920fd3832373c0edd897f8c17cd130d94e289044da24657d5337f095c847b49ab488bf95f389960f7cc62ba9b952796b1203250bac49233616e9e86ee5865d6650dda91854d1fdc204650436827ae4da9c35263032d941d83c49400d3d8df470f3e493f232b39b3907f57480532285b2c4c621f5b6bf417c4049ee", 0x1000}], 0x4}}], 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$key(0xf, 0x3, 0x2) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000002c0)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100d0000000fbdbdf25010000001800018014000200766574683100000000000000000000001c0002800c00018008000100030000000c000180"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x4008800) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a00000001010000ff7f0000cc00000000000000", @ANYRES8=r4, @ANYBLOB="fdff000000000000ecffffff", @ANYRES32=0x0, @ANYRES64=r3, @ANYBLOB='\x00'/28], 0x50) sendto$inet(r2, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000000)='dctcp-reno\x00', 0xb) setsockopt$inet_opts(r7, 0x0, 0x4, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000b00), r8) 1.030930999s ago: executing program 1 (id=1985): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000009c0)=@newqdisc={0x34, 0x24, 0x200, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0x8, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_drr={0x8}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x6}]}, 0x34}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d40)={0x1e, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB=',[\x00\x00\"\x00\x00\x00z\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00'], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = epoll_create1(0x80000) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000180)={0x6}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="300000001a00010000000000000000001c0000000000", @ANYRESOCT], 0x30}}, 0x0) clock_gettime(0x4, &(0x7f0000000a00)) epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, r3) r6 = socket$igmp6(0xa, 0x3, 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r8, @ANYBLOB='\a\x00', @ANYRES32, @ANYBLOB="08000400000000000c0003000000000000000100080005000000000008000100", @ANYRES32=0x0, @ANYBLOB="0800020000000000060006"], 0x50}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="14020000f403010000000000000000000000000a14000000f903010000000000000000000000000a"], 0x28}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYRESHEX=r9], 0x78}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r11, 0x8914, &(0x7f0000000100)={'nr0\x00', 0x2}) syz_emit_ethernet(0x11e, &(0x7f0000000ac0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0d86dd6a005c3900e83a00fc000000000000000000000000000001200100000000000000000000000000018f0090788100000200020003fe8000000000000000000000000000aa00000000000000000000000000000000fe80000000000000000000000000001f20650093d5d03b4101000000000000000000000000000007000000c40000000e040007fe80000000000000000000000000002800000000000000000000000000000000ff020000000000000000000000000001fe8000000000000000000000000000bb00000000000000000000000000000001000000000000000000080e00000000000001fc000000000000000000000000000000fc01000000000000000000000000000006080000000000000400000061002eef5c0006cf3ea787749a3704a3f63aee16a9af275b77f4b385dcd01145819ec3003fb9573a945f84a542a35f2f1d6734b834cc593566065f2f2bb137ebb2e2350b59d63a4179e1c2573310ac3e8a50108a0e6a11cfea51bd6ad51e7898aa699b010314edad6a2dd532584f404d9b7dfe7dd69dd7224d460bb562367f131465c3884477b3357e582e3f48a9a18646d7973af6f884a85d7ebbe81d9cab7eb223a5d6f8206b9d5b580d3d2b2b6f85ff1d202d904f75911cb1553d3d7696e280b6a210715d928e568396fe65b762837a9a723b6736b5cab89c305f8d5ef60d7797fe"], 0x0) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), r5) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPP(r7, &(0x7f0000000a80)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a40)={&(0x7f00000002c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="000328bd7000ffdbdf256b00000008000300", @ANYRES32=r13, @ANYBLOB="0a000600ffffffffffff00000a001affffff00000a001a00ffffffffffff00000a001a0008021100"/60], 0x58}, 0x1, 0x0, 0x0, 0x41}, 0x4008010) r14 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r14, 0x400448c9, &(0x7f0000000000)={@any, 0x200}) 928.624207ms ago: executing program 1 (id=1986): socket$kcm(0x10, 0x2, 0x0) (async, rerun: 64) r0 = socket(0x80000000000000a, 0x2, 0x0) (rerun: 64) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x2000, @remote}}}, 0x108) socket$inet6_sctp(0xa, 0x1, 0x84) (async) close(0x4) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x81, 0x4, 0x8000, 0x16, 0xffffffffffffffff, 0x2}, 0x50) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r3, 0x34}, 0x10) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) r4 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$alg(r4, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000140)={0x20}) (async) recvmsg$unix(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/44, 0x2c}], 0x1}, 0x0) 676.566533ms ago: executing program 1 (id=1987): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000de670001000000000000000000020020ff0000000a00000000"], 0x1c}}, 0x8000) r0 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000140)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001e008d2a"], 0x24}, 0x1, 0x0, 0x0, 0x4001}, 0x40000c0) 585.950969ms ago: executing program 4 (id=1988): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000280)={r2, 0x5}, 0x8) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000040)={{r3, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000680)='%pi6 \x00'}, 0x20) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r5}, 0x10) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x28, r8, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r9, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r4, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x1c, &(0x7f00000003c0)=ANY=[@ANYBLOB="180800001d000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000fcffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70500000800000085000000a5000000de9800000000000056080000000000008500000005000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 581.864882ms ago: executing program 3 (id=1989): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_BITWISE_DATA={0xc, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "00da"}]}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x114}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(r0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000400)={0x14, 0x5, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, ["", "", ""]}, 0x14}}, 0x11) (async, rerun: 64) r1 = socket(0x2b, 0x1, 0x1) (rerun: 64) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e22, 0xa4, @mcast1, 0xfff}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x2c) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000100), r1) (async, rerun: 32) sendmsg$GTP_CMD_ECHOREQ(r1, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20040014}, 0x4) (async, rerun: 32) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000000, 0x2, 0x0, 0xa, 0x4}, 0x20) (async) accept4$inet(r1, &(0x7f0000000000)={0x2, 0x0, @private}, &(0x7f0000000040)=0x10, 0x0) (async, rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route_sched(r2, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=@newtaction={0x4c, 0x30, 0x101, 0xfffffffe, 0x0, {}, [{0x38, 0x1, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x4c}}, 0x0) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r5 = accept4$rose(r1, &(0x7f00000002c0)=@full={0xb, @dev, @rose, 0x0, [@null, @default, @remote, @default, @remote, @null]}, &(0x7f0000000300)=0x40, 0x80000) (async) sendmsg$NL80211_CMD_GET_REG(r1, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x64, r3, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_RULES={0x3c, 0x22, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x1a}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x2}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xff800000}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x2}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x7fff}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xffff}]}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000080}, 0x4) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) (async, rerun: 64) r7 = socket$packet(0x11, 0x2, 0x300) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'veth0_to_team\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x162f}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0xe0a2ff6baa7cc2d2}, {0xde, 0x0, 0x0, 0x0, 0x0, 0x100}, 0xffffffff}}]}}]}, 0x60}}, 0x4800) (async) sendmsg$can_bcm(r6, &(0x7f0000000700)={&(0x7f0000000600)={0x1d, r8}, 0x10, &(0x7f00000006c0)={&(0x7f0000000640)={0x4, 0x11a, 0x2, {0x77359400}, {0x77359400}, {0x2, 0x0, 0x1, 0x1}, 0x1, @can={{0x4, 0x1, 0x1}, 0x8, 0x0, 0x0, 0x0, "9b9826fb202daa71"}}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x2000, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x3}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_drr={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x1}}, {0xffffffffffffffc4, 0x2, [0x1]}}]}]}, 0x54}}, 0x4000010) (async, rerun: 32) recvfrom$rose(r5, &(0x7f0000000340)=""/56, 0x38, 0x21, &(0x7f0000000380)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, 0x6, [@default, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40) (async, rerun: 32) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, r3, 0x200, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x48000) (async) syz_emit_ethernet(0x52, &(0x7f0000000040)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xc, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@timestamp_prespec={0x44, 0x1c, 0xe, 0x3, 0x6, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x800}, {@dev={0xac, 0x14, 0x14, 0x24}, 0x7}, {@multicast2, 0x2}]}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) 535.636168ms ago: executing program 0 (id=1990): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b05, &(0x7f0000000000)={'wlan1\x00'}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x1, 0x0, @dev}, 0x7a) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001a00010029bd70000000000002202000000000000020000008001f"], 0x2c}}, 0x0) socket(0x22, 0x2, 0x1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x74, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x68, 0x0, &(0x7f00000004c0)="ae7c18bc5a99ca36edfb2a8877ed05e0ac0cf1da03b371515d915d060d67ab3b904c15ed561cc257709744dadc1b3a34e826c29cb71173b0c48997714cf6cd7db217b3b1a76bdf5da09f85e7e57f19c595f627f9058d4b9ba3667742e344340e9e5276ce977adbbb", 0x0, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r4}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg$qrtr(r7, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000640)=""/1, 0x1}, {&(0x7f0000000700)=""/192, 0xc0}], 0x2, 0x0, 0x0, 0x10000}, 0x38, 0x2) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="190a000004000000040000000001000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00!\x00'/28], 0x1d) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r8, 0x0, 0x0}, 0x20) ioctl$PPPIOCBRIDGECHAN(0xffffffffffffffff, 0x40047435, &(0x7f00000000c0)=0x8) 446.073523ms ago: executing program 1 (id=1991): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) (async) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet_tcp(0x2, 0x1, 0x0) unshare(0x10080) (async) setsockopt$sock_attach_bpf(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000006c0)={0x14, 0x0, 0x1, 0x3, 0x0, 0x0, {0xb, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0xc010}, 0xc0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000400008500000001000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f0000000080)='fdb_delete\x00', r5, 0x0, 0x100000000000000}, 0x18) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r4, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)=r5}, 0x20) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r8 = socket$inet(0x2, 0xb6f713b6f0b9caa9, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000780)={0x1d, r9}, 0x10, &(0x7f0000000200)={&(0x7f0000001100)=@can={{0x0, 0x0, 0x0, 0x1}, 0x5, 0x1, 0x0, 0x0, "09151995c95f32cc"}, 0x10}}, 0x44001) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_ext={0x1c, 0x7, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000f2ffffff000000006362934c85200000040000009500000000000000184000000100000000000100000001000000000000000000"], &(0x7f0000000380)='GPL\x00', 0xf0, 0x0, 0x0, 0x41000, 0x0, '\x00', r9, 0x0, r1, 0x8, &(0x7f0000000400)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000480)={0x0, 0xc, 0x9, 0xfffffff9}, 0x10, 0x8f29, r2, 0x0, &(0x7f00000004c0)=[r6, r1, r1, r1, r1], &(0x7f0000000580), 0x10, 0x6}, 0x94) connect$inet(r8, &(0x7f0000000300)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) (async) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="d80000001c0081044e81f782db44b904021d0802010000001c7e12a118000c000600142603600e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c13223e3f52a98516277ce06bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x700) (async) ioctl$SIOCSIFHWADDR(r7, 0x8937, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) 415.369991ms ago: executing program 0 (id=1992): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539esp(ecb-blowfish-asm,tgr192)\x00'}, 0x58) (async) r1 = socket(0xa, 0x3, 0x2) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x1, 0x9, @loopback, 0xd9b}, 0x1c) (async) sendmmsg$inet6(r1, &(0x7f0000000300)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@dstopts_2292={{0x18, 0x29, 0x3e, {0x2c}}}], 0x18}}], 0x2, 0x4004804) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_NEW_SEC_DEV(r2, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000580)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="78000000c541e963189de6b3e28dc8d10e91895f4d45d4251ea3abed6d88fa84677f742c8b67a3d07edc6c1da69f2411b6523f2b3e7682b22161ba10cd26", @ANYRESHEX=r1, @ANYBLOB="00042dbd7000fddbdf251a00000008000300", @ANYRES32=0x0, @ANYBLOB="50002e8008000600000000000c00040000000000000000000500050000000000060004000200aaaaaaaaaaaa0600020003000000050005000000000000000300fcff000000000500010000000c0006000100000001000000"], 0x78}}, 0x8000) (async) ioctl$sock_inet6_udp_SIOCINQ(r1, 0x541b, &(0x7f00000000c0)) (async) r3 = accept4(r0, 0x0, 0x0, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000800)={'ip6_vti0\x00', 0x0}) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="2f0000001c0005c5ffffff000d000000020000000b000000ec0091c913000180f0ffffeb", 0x24}], 0x1}, 0x1) (async) r4 = socket(0x10, 0x80002, 0x0) r5 = socket(0x1e, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000440)=@newqdisc={0x50, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x24, 0x2, [@TCA_FQ_QUANTUM={0x8, 0x3, 0x7}, @TCA_FQ_ORPHAN_MASK={0x8, 0xa, 0x7ff}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0x2}, @TCA_FQ_RATE_ENABLE={0x8, 0x5, 0xfffffffc}]}}]}, 0x50}}, 0x0) (async) write(0xffffffffffffffff, &(0x7f0000000000)="fc0000001c00071bab0925000900070007ab08000c000000f0007e93210001c000000000000000000000000000039915fa2c1ec28670e9889bb94b46fe0000000a0002", 0xff82) (async) sendmmsg$alg(r4, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0xc}], 0x492492492492856, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6gre0\x00', 0x0, 0x29, 0xe, 0x3, 0x401, 0xc, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x700, 0x817f, 0x9, 0x2}}) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r8) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r8, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="50020000", @ANYRES16=r9, @ANYBLOB="000329bd7000fddbdf254f0000004000654aeead2a47da74b55248069d290b99f5a7e180a74b46f225ad5a0c000300cfc2a5782cc9ac810c0003008ecfe05ffb4f20fb80007a80140001005b822978bbd832bcc402a24b4495875724000100cf8e480eaa63885cbfdfa33678f0a5e760782c7d045d23e874bad3a27aaba81e0c000300ce61658e73525876240001004ae28fdb9ea84188bf8a5900206a1eb540029f26fcee0c835a1e18286ae2fef0140002000c39e6c4b7b8f9b3b359d58b44cda5c254007a800c000300f7f11ddc085e10d41c000200f160f13c4fc23c28baf6d0590edff4d01cafd25e237b33a90c000300d9c8814824d292040c0003005191460092cd3d4f080004000100008008000400070000003c007a8014000200ad390a1aea2db92ee05d1a6d9511fd75240001001314d52c87c6ba964aaed1d941cad07661e4f763873772de83ffaad518dc8a9674007a801c000200f2c9c7163e192768a4e0e7179e2d16385ee10a8424e5054708000400010400001c00020075baf58ec1f18726573c4a3e3a7f63e32a7184e962866463080004000000000014000200554195d8a62d5e52555cb594afd2357914000100dbf598e0e9efc48922b2b3e7dcf9a0a610007a800c000300d1a6f20d866b5e3468007a80140002006906a44f537567e6e80efcdbe0b082210c0003009bfeef56d087b708080004000200000024000100813092f2a6a826cb0a37eac8e8d0029daf8d7c82d4ac70f76d7ebeeaf00cccd00c00030011e794d548b073410c00030060b203db3eb930f200"/586], 0x250}, 0x1, 0x0, 0x0, 0x4008001}, 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000004c0)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x34, 0xf9, 0xe33, 0x56, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, 0x1, 0x700, 0x68, 0x3}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x2f, 0x7, 0xe, 0xb958, 0x0, @mcast2, @empty, 0x40, 0x8846, 0x4, 0xff}}) (async) pipe(&(0x7f00000002c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='cachefiles_mark_inactive\x00', 0xffffffffffffffff, 0x0, 0x7}, 0x18) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000020603000000000000000000000000000c000780080006400000000311000300686173683a6e65742c6e657400000000050005000a0000001300010007000000797a31000000000500040003000000"], 0x58}}, 0x0) 215.813759ms ago: executing program 2 (id=1993): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x2, 0x4) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x38, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_BETA={0x4}]}}]}, 0x38}}, 0x0) sendmsg$kcm(r1, &(0x7f0000000180)={&(0x7f0000000040)=@hci={0x1f, 0x2, 0x8f20451a7f7ad85c}, 0x80, 0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{0x60, 0x133, 0x0, "4f6848c749908756177f16e18101643359ff3809b09b79120576a2133e8e4d2e906dc85a7dbb58d78b2598cc176d08a105bb5938567442ceef3e64c82ec03ee039dd3d3131a6ff3b6c"}], 0x60}, 0x800) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001840)=@newtaction={0x6c, 0x1c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x58, 0x1, [@m_mpls={0x54, 0x1b, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5, 0x7, 0x2}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x2, 0x7, 0x8, 0x6, 0xfffffff7}, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0xa8c0}, 0x2000a004) socket$netlink(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x2, 0x4) (async) socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00'}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x38, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_BETA={0x4}]}}]}, 0x38}}, 0x0) (async) sendmsg$kcm(r1, &(0x7f0000000180)={&(0x7f0000000040)=@hci={0x1f, 0x2, 0x8f20451a7f7ad85c}, 0x80, 0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{0x60, 0x133, 0x0, "4f6848c749908756177f16e18101643359ff3809b09b79120576a2133e8e4d2e906dc85a7dbb58d78b2598cc176d08a105bb5938567442ceef3e64c82ec03ee039dd3d3131a6ff3b6c"}], 0x60}, 0x800) (async) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001840)=@newtaction={0x6c, 0x1c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x58, 0x1, [@m_mpls={0x54, 0x1b, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5, 0x7, 0x2}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x2, 0x7, 0x8, 0x6, 0xfffffff7}, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0xa8c0}, 0x2000a004) (async) 215.317565ms ago: executing program 3 (id=1994): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) 214.401702ms ago: executing program 0 (id=1995): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000000f1401e6"], 0x28}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x0, 0x2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_USE_CARRIER={0x5}]}}}]}, 0x3c}}, 0x8004) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xb, 0x6, 0x8, 0xb, 0x39720, 0x1, 0x7, '\x00', 0x0, r3, 0x4, 0x0, 0x5}, 0x50) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000040)={&(0x7f00000000c0)="7127dfde24f5c39f6724033fa3be5d54569697ed276b2a34eaa2b53553a25665ff771115c1f6ddea2ae4a7391ec8a08fe5415771def4ddb069a2a4a15620c714d5b9233d60eebd7e83", &(0x7f00000001c0)=""/250, &(0x7f0000000380)="aa9e715ce81c1275b25aeb3895e95be41ee6973eabfac859ab28114a78de2f0b189b174bc5b7676923fee58fa6f4c19ee8a780b4dd63bd8069f0469461a73c28e66084d3db5ea2b792757dbe25cadd130c46b520efadde9b5742054046ab3e9e4cccaa908a1e89c246cfbfbaece47665d8b02f3893021050800de71593d299561596ffcebc4503e94696cf3c0a69df2b55e3eefdfae9ae1934f820b282fad986ab600001cf9c5c8f2610389104c76d4f844fae0a38d13260b66107dc46ca7a25e5396ee4440fb531d096c94f84143f76c19140dab3f48eafbb78ff429c05a82e7f4d7adb8fec19568a01227785f2356a51016aa1a58bb2f36d", &(0x7f0000000480)="e7419d0ad1f6cc220294d77dcd0a7cd7ea885d8215348b51cbc715e86d373b21eae6e97196e84e963f9908b3868639104495311a5e973d28fbe4c6b6d9cd9d4abc1c1ff1f57f8d4358be67975b1b705662b505f90405bca4c6600f231a7613cf3f136d55904ffe2005efa6dd410f5a0210ee7838a51bca64ba596876e1f2b00521fbaac4e613af535ae0455f97ea5c420ac66a3f379b4650355114712839c2d937faca4060a709f281d8ed0160aa9a6ff6082c2c3358f0382d5f8897ab7c4f436da02738906448d28975b4912ea12be7f39c320ca0acbcee79ba9582c3347f1a25430f43", 0x6, r5}, 0x38) 200.599042ms ago: executing program 1 (id=1996): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x20, r4, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x3, 0xc}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x20008000}, 0x24000040) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000002540)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000004c0)='kmem_cache_free\x00', r6}, 0x18) r7 = socket$pppl2tp(0x18, 0x1, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x1e, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe8, 0x0, 0x0, 0x0, 0x4}, [@map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0xc}, @alu={0x0, 0x0, 0x9, 0x0, 0xb, 0xc, 0xffffffffffffffff}, @map_idx={0x18, 0x1, 0x5, 0x0, 0x8}, @ldst={0x3, 0x0, 0x2, 0x5, 0x8, 0x18, 0x1}, @map_fd={0x18, 0x8, 0x1, 0x0, r0}, @map_idx={0x18, 0x6, 0x5, 0x0, 0xa}, @printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf29d}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000000600)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000640)={0x8, 0x3}, 0x8, 0x10, &(0x7f00000007c0)={0x0, 0xb, 0x9, 0xff}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000800)=[r0, r0, r0, r0, r0], &(0x7f0000000840)=[{0x1, 0x3, 0x1, 0x3}, {0x5, 0x3, 0x8, 0x5}, {0x4, 0x4, 0xf, 0x6}, {0x5, 0x3, 0xa, 0x4}], 0x10, 0x5}, 0x94) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) connect$pppl2tp(r7, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r9 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14, 0xc00) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000200)={'ip_vti0\x00', &(0x7f0000000140)={'gre0\x00', 0x0, 0x8050, 0x7, 0x80000000, 0xe, {{0x8, 0x4, 0x2, 0x10, 0x20, 0x64, 0x0, 0x5, 0x29, 0x0, @multicast1, @local, {[@timestamp={0x44, 0xc, 0x41, 0x0, 0x3, [0x3, 0x1]}]}}}}}) accept4$inet6(r8, &(0x7f00000003c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000400)=0x1c, 0x800) setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000280)={r10, 0x1, 0x6, @broadcast}, 0x10) writev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x180204}], 0x1) r11 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r11, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r11, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r11, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x42}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x10000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x8, 0x0, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@local, 0x2, 0x6c}, 0x0, @in=@multicast1, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) sendmmsg(r11, &(0x7f0000007fc0), 0x800001d, 0x0) 117.973547ms ago: executing program 3 (id=1997): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000001200)={0x60000010}) r2 = epoll_create1(0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000300)={0x10000000}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000600)) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000f40)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007126000000000000bf670000000000005601000000ff07ad6706000002000000070200000ee60000bf250000000000003d350000000000006507000002000000070700004c0000001f750000000000006154000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56600a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa55eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8ddaf2cdad3d1a74a2f078aa6402483856a6e495408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae06e394c9639564f000fc3cdd05a157544d0200000000000000ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc6ae8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f88e80ef80c6ed3e1ff91ff111000000000000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcbacec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0ddd932d838ff651023853d42210642986f8bbc7340bc8393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d68124674478186edd036f15bf847c33f79e1a0ad3d2b5080ecb01420c9f1b534e969fce97ffff07000009000000bfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d62875e5319cd51bdd224878a0b25edf0e83c930633bd9a823e28f359608ea326c77a1aa17318f392a0ec6c188916f4149c503027feccfd68ec826da90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8e68f076c659f56d6c7f97a94d604f45cfe88b30c170000000001000000ef931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f0400000000000000d23b48bb38b31a14ffcddd92ce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6423065624f1300007d6072f0cf120ad2ba519afdd43a14000000000000000000000000007ef2f3c58d045f0700000094069acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d000000000000000000007758b1267669ded883b5867c5916a74843b784955108f750c57744c76a09629dd0aaca5cb0f14f49db80a1aa2692c18fbb31cbdb3f2e138e6d5ba3491fc3617b511f24bad26466407e39000000000000d7a1bf4624d31c13a6840f45a7f4e01a50d790132abb36915e35b1ac35bf3921357f638684bba17b8fe1e2123153ecd6d1f76820d4f8fa0b96b50c457ae8d5f2351cdb7bc8170380557bc11cf6ee3395974e37018a2a7473312cb32affb8ff72a253e0d36099e460f13694b9891af526d9608271838e83d17103887f34210dd4c0cf60dec608b4ca5ba2f3037bf381e7b5d5b27820000000000000000000000b719bd34f3244730f708fdd532640edc6b82dd4ad72ecbaccafef806f5447aba2246d56a601bbd8c24ba1e16dda3296ce10de683000"/1782], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) 0s ago: executing program 2 (id=1998): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd29}, 0x14}}, 0x40000) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00', @ANYRES16, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c0002"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000480)={0x0, 0x11, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000eeff120000000a0004007778616e3300000008001500", @ANYRES32=0x0, @ANYBLOB="080001"], 0x30}}, 0x0) kernel console output (not intermixed with test programs): tered allmulticast mode [ 198.268645][ T8582] netlink: 'syz.1.692': attribute type 15 has an invalid length. [ 198.315429][ T8587] netlink: 'syz.2.694': attribute type 1 has an invalid length. [ 198.372195][ T8588] netlink: 8 bytes leftover after parsing attributes in process `syz.2.694'. [ 198.400511][ T8588] openvswitch: netlink: nsh attr 0 has unexpected len 7 expected 0 [ 198.414833][ T8588] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 198.710878][ T8593] netlink: 'syz.1.695': attribute type 1 has an invalid length. [ 198.719467][ T8589] bond3: entered promiscuous mode [ 198.719491][ T8589] bond3: entered allmulticast mode [ 198.721603][ T8589] 8021q: adding VLAN 0 to HW filter on device bond3 [ 198.727951][ T8593] netlink: 224 bytes leftover after parsing attributes in process `syz.1.695'. [ 198.819647][ T8588] bridge2: entered promiscuous mode [ 198.826429][ T8588] bridge2: entered allmulticast mode [ 198.833803][ T8588] bond3: (slave bridge2): Enslaving as a backup interface with an up link [ 198.843711][ T60] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 198.950162][ T8598] netlink: 'syz.2.697': attribute type 29 has an invalid length. [ 198.962270][ T60] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 199.095201][ T8600] netlink: 44 bytes leftover after parsing attributes in process `syz.2.699'. [ 199.318630][ T8610] netlink: 830 bytes leftover after parsing attributes in process `syz.2.702'. [ 199.623549][ T8619] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 199.636065][ T8619] dvmrp1: linktype set to 773 [ 199.649350][ T8626] netlink: 12 bytes leftover after parsing attributes in process `syz.3.708'. [ 199.671412][ T8625] netlink: 12 bytes leftover after parsing attributes in process `syz.3.708'. [ 199.683977][ T8619] dvmrp1: tun_chr_ioctl cmd 21731 [ 199.739891][ T8623] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.759695][ T8624] netlink: 248 bytes leftover after parsing attributes in process `syz.2.707'. [ 199.787950][ T8626] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 199.790407][ T8625] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 199.934678][ T8623] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.999380][ T8639] syzkaller0: entered promiscuous mode [ 200.005727][ T8639] syzkaller0: entered allmulticast mode [ 200.039499][ T8623] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.167741][ T8623] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.391141][ T3079] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.490188][ T8656] vxcan1 speed is unknown, defaulting to 1000 [ 200.498957][ T3079] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.591923][ T8665] netlink: 24 bytes leftover after parsing attributes in process `syz.2.716'. [ 200.626992][ T8666] netlink: 24 bytes leftover after parsing attributes in process `syz.2.716'. [ 200.686812][ T60] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.872460][ T7048] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.898841][ T8672] tipc: Started in network mode [ 200.927992][ T8672] tipc: Node identity ac14140f, cluster identity 4711 [ 200.944676][ T8672] tipc: New replicast peer: 255.255.255.255 [ 200.971316][ T8672] tipc: Enabled bearer , priority 10 [ 200.986460][ T8674] sch_tbf: burst 4398 is lower than device lo mtu (11337746) ! [ 201.600196][ T8697] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 202.092183][ T24] tipc: Node number set to 2886997007 [ 202.242936][ T8718] netlink: 44 bytes leftover after parsing attributes in process `syz.2.727'. [ 202.619190][ T8725] netlink: 52 bytes leftover after parsing attributes in process `syz.2.730'. [ 202.950019][ T8734] vxcan1 speed is unknown, defaulting to 1000 [ 204.825739][ T8822] __nla_validate_parse: 4 callbacks suppressed [ 204.825757][ T8822] netlink: 52 bytes leftover after parsing attributes in process `syz.2.751'. [ 204.866280][ T8822] netlink: 52 bytes leftover after parsing attributes in process `syz.2.751'. [ 204.883033][ T8818] netlink: 92 bytes leftover after parsing attributes in process `syz.3.750'. [ 204.933958][ T8822] netlink: 52 bytes leftover after parsing attributes in process `syz.2.751'. [ 204.981318][ T8823] netlink: 'syz.2.751': attribute type 10 has an invalid length. [ 205.536400][ T8850] netlink: 12 bytes leftover after parsing attributes in process `syz.3.758'. [ 205.753188][ T8861] netlink: 8 bytes leftover after parsing attributes in process `syz.2.761'. [ 205.753188][ T8863] netlink: 8 bytes leftover after parsing attributes in process `syz.2.761'. [ 205.753318][ T8861] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 205.806609][ T8863] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 205.832791][ T8863] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.865434][ T8861] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 206.082435][ T8878] netlink: 28 bytes leftover after parsing attributes in process `syz.0.766'. [ 206.113364][ T8878] netlink: 28 bytes leftover after parsing attributes in process `syz.0.766'. [ 206.635629][ T8907] netlink: 72 bytes leftover after parsing attributes in process `syz.1.769'. [ 206.661797][ T8907] netlink: 'syz.1.769': attribute type 1 has an invalid length. [ 206.679415][ T5167] Bluetooth: hci1: command 0x0406 tx timeout [ 206.686546][ T5167] Bluetooth: hci2: command 0x0406 tx timeout [ 206.694895][ T5167] Bluetooth: hci3: command 0x0406 tx timeout [ 207.128621][ T8925] bond0: (slave bond1): Error -95 calling ndo_bpf [ 207.172640][ T8925] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 207.227877][ T8929] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 207.443403][ T8935] vxcan1 speed is unknown, defaulting to 1000 [ 207.447927][ T8938] tipc: Enabled bearer , priority 0 [ 207.656017][ T8944] syzkaller0: entered promiscuous mode [ 207.716082][ T8944] syzkaller0: entered allmulticast mode [ 207.887563][ T8968] tipc: Resetting bearer [ 208.030723][ T8944] syzkaller0: left promiscuous mode [ 208.063880][ T8944] syzkaller0: left allmulticast mode [ 208.200628][ T8934] tipc: Resetting bearer [ 209.955608][ T8934] tipc: Disabling bearer [ 209.995828][ T8989] syzkaller0: entered promiscuous mode [ 210.001639][ T8989] syzkaller0: entered allmulticast mode [ 210.008261][ T8997] __nla_validate_parse: 1 callbacks suppressed [ 210.008278][ T8997] netlink: 32 bytes leftover after parsing attributes in process `syz.4.786'. [ 210.329243][ T8942] smc: removing ib device syz1 [ 211.080514][ T9021] netlink: 3 bytes leftover after parsing attributes in process `syz.4.788'. [ 211.238628][ T9023] netlink: 48 bytes leftover after parsing attributes in process `syz.4.788'. [ 212.020775][ T9026] netlink: 'syz.3.789': attribute type 1 has an invalid length. [ 212.040334][ T9027] netlink: 'syz.3.789': attribute type 1 has an invalid length. [ 212.347029][ T9021] batadv1: entered promiscuous mode [ 212.358290][ T9021] batadv1: entered allmulticast mode [ 212.646872][ T9048] FAULT_INJECTION: forcing a failure. [ 212.646872][ T9048] name failslab, interval 1, probability 0, space 0, times 1 [ 212.684904][ T9048] CPU: 1 UID: 0 PID: 9048 Comm: syz.4.793 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 212.684931][ T9048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 212.684949][ T9048] Call Trace: [ 212.684959][ T9048] [ 212.684968][ T9048] dump_stack_lvl+0x189/0x250 [ 212.684992][ T9048] ? __pfx____ratelimit+0x10/0x10 [ 212.685018][ T9048] ? __pfx_dump_stack_lvl+0x10/0x10 [ 212.685037][ T9048] ? __pfx__printk+0x10/0x10 [ 212.685064][ T9048] ? __pfx___might_resched+0x10/0x10 [ 212.685082][ T9048] ? fs_reclaim_acquire+0x7d/0x100 [ 212.685111][ T9048] should_fail_ex+0x414/0x560 [ 212.685142][ T9048] should_failslab+0xa8/0x100 [ 212.685173][ T9048] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 212.685195][ T9048] ? __alloc_skb+0x112/0x2d0 [ 212.685218][ T9048] __alloc_skb+0x112/0x2d0 [ 212.685240][ T9048] netlink_ack+0x146/0xa50 [ 212.685255][ T9048] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 212.685271][ T9048] ? ref_tracker_free+0x63a/0x7d0 [ 212.685290][ T9048] ? __asan_memcpy+0x40/0x70 [ 212.685308][ T9048] ? __pfx_ref_tracker_free+0x10/0x10 [ 212.685323][ T9048] ? __skb_clone+0x63/0x7a0 [ 212.685353][ T9048] netlink_rcv_skb+0x28c/0x470 [ 212.685372][ T9048] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 212.685391][ T9048] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 212.685421][ T9048] ? netlink_deliver_tap+0x2e/0x1b0 [ 212.685447][ T9048] netlink_unicast+0x82f/0x9e0 [ 212.685481][ T9048] ? __pfx_netlink_unicast+0x10/0x10 [ 212.685507][ T9048] ? netlink_sendmsg+0x642/0xb30 [ 212.685523][ T9048] ? skb_put+0x11b/0x210 [ 212.685545][ T9048] netlink_sendmsg+0x805/0xb30 [ 212.685573][ T9048] ? __pfx_netlink_sendmsg+0x10/0x10 [ 212.685594][ T9048] ? aa_sock_msg_perm+0x94/0x160 [ 212.685613][ T9048] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 212.685630][ T9048] ? __pfx_netlink_sendmsg+0x10/0x10 [ 212.685648][ T9048] __sock_sendmsg+0x219/0x270 [ 212.685676][ T9048] ____sys_sendmsg+0x52d/0x830 [ 212.685702][ T9048] ? __pfx_____sys_sendmsg+0x10/0x10 [ 212.685732][ T9048] ? import_iovec+0x74/0xa0 [ 212.685758][ T9048] ___sys_sendmsg+0x21f/0x2a0 [ 212.685781][ T9048] ? __pfx____sys_sendmsg+0x10/0x10 [ 212.685839][ T9048] ? __fget_files+0x2a/0x420 [ 212.685861][ T9048] ? __fget_files+0x3a0/0x420 [ 212.685894][ T9048] __sys_sendmmsg+0x227/0x430 [ 212.685919][ T9048] ? __pfx___sys_sendmmsg+0x10/0x10 [ 212.685936][ T9048] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 212.685983][ T9048] ? ksys_write+0x22a/0x250 [ 212.686007][ T9048] ? __pfx_ksys_write+0x10/0x10 [ 212.686024][ T9048] ? rcu_is_watching+0x15/0xb0 [ 212.686050][ T9048] __x64_sys_sendmmsg+0xa0/0xc0 [ 212.686073][ T9048] do_syscall_64+0xfa/0x3b0 [ 212.686089][ T9048] ? lockdep_hardirqs_on+0x9c/0x150 [ 212.686105][ T9048] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.686122][ T9048] ? clear_bhb_loop+0x60/0xb0 [ 212.686143][ T9048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.686159][ T9048] RIP: 0033:0x7f93fa18e9a9 [ 212.686182][ T9048] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 212.686196][ T9048] RSP: 002b:00007f93faf50038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 212.686223][ T9048] RAX: ffffffffffffffda RBX: 00007f93fa3b5fa0 RCX: 00007f93fa18e9a9 [ 212.686235][ T9048] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 212.686247][ T9048] RBP: 00007f93faf50090 R08: 0000000000000000 R09: 0000000000000000 [ 212.686258][ T9048] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 212.686268][ T9048] R13: 0000000000000000 R14: 00007f93fa3b5fa0 R15: 00007fffe84a5218 [ 212.686298][ T9048] [ 213.270629][ T9052] delete_channel: no stack [ 213.332968][ T9058] tipc: Enabled bearer , priority 0 [ 213.340689][ T9058] syzkaller0: entered promiscuous mode [ 213.346226][ T9058] syzkaller0: entered allmulticast mode [ 213.356457][ T9058] netlink: 8 bytes leftover after parsing attributes in process `syz.0.797'. [ 213.386804][ T9058] syzkaller0: left promiscuous mode [ 213.396745][ T9061] netlink: 244 bytes leftover after parsing attributes in process `syz.2.796'. [ 213.428233][ T9058] syzkaller0: left allmulticast mode [ 213.728900][ T9068] bridge0: port 2(bridge_slave_1) entered disabled state [ 213.737682][ T9068] bridge0: port 1(bridge_slave_0) entered disabled state [ 213.752581][ T9087] netlink: 20 bytes leftover after parsing attributes in process `syz.4.799'. [ 213.987251][ T9068] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 214.000421][ T9068] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 214.088968][ T9081] netlink: 152 bytes leftover after parsing attributes in process `syz.4.799'. [ 214.122952][ T9085] tipc: Resetting bearer [ 214.147488][ T9057] tipc: Resetting bearer [ 214.222192][ T9057] tipc: Disabling bearer [ 214.270152][ T49] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.280789][ T49] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.372494][ T9098] FAULT_INJECTION: forcing a failure. [ 214.372494][ T9098] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 214.387326][ T49] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.404408][ T49] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.416105][ T9098] CPU: 1 UID: 0 PID: 9098 Comm: syz.1.805 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 214.416132][ T9098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 214.416143][ T9098] Call Trace: [ 214.416150][ T9098] [ 214.416157][ T9098] dump_stack_lvl+0x189/0x250 [ 214.416181][ T9098] ? __pfx____ratelimit+0x10/0x10 [ 214.416212][ T9098] ? __pfx_dump_stack_lvl+0x10/0x10 [ 214.416229][ T9098] ? __pfx__printk+0x10/0x10 [ 214.416260][ T9098] should_fail_ex+0x414/0x560 [ 214.416290][ T9098] _copy_to_user+0x31/0xb0 [ 214.416313][ T9098] simple_read_from_buffer+0xe1/0x170 [ 214.416340][ T9098] proc_fail_nth_read+0x1df/0x250 [ 214.416365][ T9098] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 214.416400][ T9098] ? rw_verify_area+0x258/0x650 [ 214.416419][ T9098] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 214.416445][ T9098] vfs_read+0x200/0x980 [ 214.416470][ T9098] ? __pfx___mutex_lock+0x10/0x10 [ 214.416487][ T9098] ? __pfx_vfs_read+0x10/0x10 [ 214.416509][ T9098] ? __fget_files+0x2a/0x420 [ 214.416537][ T9098] ? __fget_files+0x3a0/0x420 [ 214.416558][ T9098] ? __fget_files+0x2a/0x420 [ 214.416590][ T9098] ksys_read+0x145/0x250 [ 214.416620][ T9098] ? __pfx_ksys_read+0x10/0x10 [ 214.416638][ T9098] ? rcu_is_watching+0x15/0xb0 [ 214.416662][ T9098] ? do_syscall_64+0xbe/0x3b0 [ 214.416684][ T9098] do_syscall_64+0xfa/0x3b0 [ 214.416699][ T9098] ? lockdep_hardirqs_on+0x9c/0x150 [ 214.416716][ T9098] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.416733][ T9098] ? clear_bhb_loop+0x60/0xb0 [ 214.416754][ T9098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.416771][ T9098] RIP: 0033:0x7fc739b8d3bc [ 214.416787][ T9098] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 214.416801][ T9098] RSP: 002b:00007fc73a99a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 214.416820][ T9098] RAX: ffffffffffffffda RBX: 00007fc739db5fa0 RCX: 00007fc739b8d3bc [ 214.416833][ T9098] RDX: 000000000000000f RSI: 00007fc73a99a0a0 RDI: 0000000000000005 [ 214.416843][ T9098] RBP: 00007fc73a99a090 R08: 0000000000000000 R09: 0000000000000000 [ 214.416854][ T9098] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 214.416864][ T9098] R13: 0000000000000000 R14: 00007fc739db5fa0 R15: 00007ffe45f1ddf8 [ 214.416894][ T9098] [ 214.723591][ T9110] netlink: 24 bytes leftover after parsing attributes in process `syz.4.811'. [ 214.737550][ T9110] netlink: 75 bytes leftover after parsing attributes in process `syz.4.811'. [ 214.753209][ T9110] netlink: 32 bytes leftover after parsing attributes in process `syz.4.811'. [ 214.768643][ T9114] netlink: 'syz.1.812': attribute type 1 has an invalid length. [ 214.854674][ T9117] syzkaller1: entered promiscuous mode [ 214.860194][ T9117] syzkaller1: entered allmulticast mode [ 215.170903][ T9138] netlink: 'syz.3.817': attribute type 4 has an invalid length. [ 216.996025][ T9168] __nla_validate_parse: 3 callbacks suppressed [ 216.996042][ T9168] netlink: 12 bytes leftover after parsing attributes in process `syz.4.827'. [ 217.019175][ T9166] only policy match revision 0 supported [ 217.019194][ T9166] unable to load match [ 217.041555][ T9174] netlink: 8 bytes leftover after parsing attributes in process `syz.2.825'. [ 217.059449][ T9174] netlink: 'syz.2.825': attribute type 1 has an invalid length. [ 217.147446][ T9174] 8021q: adding VLAN 0 to HW filter on device bond4 [ 217.170863][ T9178] bond4: (slave geneve2): making interface the new active one [ 217.181856][ T9178] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 217.607735][ T9192] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.615732][ T9192] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.830662][ T9192] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 217.926680][ T9192] geneve0: left allmulticast mode [ 217.966132][ T9192] bridge1: left promiscuous mode [ 217.971895][ T9192] ip6tnl1: left promiscuous mode [ 217.976863][ T9192] ip6tnl1: left allmulticast mode [ 218.015696][ T9207] netlink: 100 bytes leftover after parsing attributes in process `syz.3.838'. [ 218.025813][ T9207] netlink: 100 bytes leftover after parsing attributes in process `syz.3.838'. [ 218.043073][ T7047] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.062299][ T7047] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.105479][ T7047] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.122511][ T7047] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.169246][ T9216] netlink: 248 bytes leftover after parsing attributes in process `syz.2.841'. [ 218.259938][ T9222] netlink: 'syz.2.844': attribute type 1 has an invalid length. [ 218.308099][ T9222] veth5: entered promiscuous mode [ 218.367855][ T9222] netlink: 'syz.2.844': attribute type 1 has an invalid length. [ 218.406704][ T9222] netlink: 4 bytes leftover after parsing attributes in process `syz.2.844'. [ 218.548628][ T9236] netlink: 8 bytes leftover after parsing attributes in process `syz.4.850'. [ 218.579898][ T9236] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 218.611496][ T9236] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 218.768187][ T9250] netlink: 4 bytes leftover after parsing attributes in process `syz.1.854'. [ 218.873230][ T9254] netlink: 'syz.4.855': attribute type 1 has an invalid length. [ 218.881818][ T9254] netlink: 'syz.4.855': attribute type 1 has an invalid length. [ 218.889957][ T9254] netlink: 'syz.4.855': attribute type 1 has an invalid length. [ 218.904506][ T9254] netlink: 'syz.4.855': attribute type 1 has an invalid length. [ 218.912915][ T9254] netlink: 'syz.4.855': attribute type 1 has an invalid length. [ 218.921556][ T9254] netlink: 'syz.4.855': attribute type 1 has an invalid length. [ 219.284149][ T9275] netlink: 'syz.0.864': attribute type 4 has an invalid length. [ 219.297225][ T9275] netlink: 14345 bytes leftover after parsing attributes in process `syz.0.864'. [ 219.319347][ T9275] netlink: 88 bytes leftover after parsing attributes in process `syz.0.864'. [ 219.379271][ T9275] tun0: tun_chr_ioctl cmd 2147767521 [ 219.419288][ T9275] tun0: tun_chr_ioctl cmd 35108 [ 219.464157][ T9281] gretap0: entered promiscuous mode [ 219.838765][ T9302] syz.4.875: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 219.901998][ T9302] CPU: 0 UID: 0 PID: 9302 Comm: syz.4.875 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 219.902025][ T9302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 219.902035][ T9302] Call Trace: [ 219.902056][ T9302] [ 219.902064][ T9302] dump_stack_lvl+0x189/0x250 [ 219.902092][ T9302] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.902112][ T9302] ? __pfx__printk+0x10/0x10 [ 219.902141][ T9302] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 219.902163][ T9302] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 219.902185][ T9302] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 219.902208][ T9302] warn_alloc+0x214/0x310 [ 219.902239][ T9302] ? __pfx_warn_alloc+0x10/0x10 [ 219.902273][ T9302] ? __get_vm_area_node+0x28f/0x300 [ 219.902296][ T9302] ? fq_pie_init+0x430/0x840 [ 219.902323][ T9302] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 219.902373][ T9302] ? up_write+0x1c4/0x420 [ 219.902391][ T9302] ? tcf_block_get_ext+0x8d4/0x17d0 [ 219.902419][ T9302] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 219.902446][ T9302] ? rcu_is_watching+0x15/0xb0 [ 219.902466][ T9302] ? fq_pie_init+0x430/0x840 [ 219.902487][ T9302] ? fq_pie_init+0x430/0x840 [ 219.902507][ T9302] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 219.902530][ T9302] ? fq_pie_init+0x430/0x840 [ 219.902551][ T9302] ? tcf_block_get+0x67/0xa0 [ 219.902566][ T9302] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 219.902588][ T9302] fq_pie_init+0x430/0x840 [ 219.902614][ T9302] ? __pfx_fq_pie_init+0x10/0x10 [ 219.902637][ T9302] qdisc_create+0x7a9/0xea0 [ 219.902671][ T9302] tc_modify_qdisc+0x1538/0x20e0 [ 219.902718][ T9302] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 219.902775][ T9302] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 219.902796][ T9302] rtnetlink_rcv_msg+0x779/0xb70 [ 219.902819][ T9302] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 219.902836][ T9302] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 219.902851][ T9302] ? ref_tracker_free+0x63a/0x7d0 [ 219.902869][ T9302] ? __asan_memcpy+0x40/0x70 [ 219.902887][ T9302] ? __pfx_ref_tracker_free+0x10/0x10 [ 219.902903][ T9302] ? __skb_clone+0x63/0x7a0 [ 219.902934][ T9302] netlink_rcv_skb+0x205/0x470 [ 219.902954][ T9302] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 219.902974][ T9302] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 219.903005][ T9302] ? netlink_deliver_tap+0x2e/0x1b0 [ 219.903032][ T9302] netlink_unicast+0x82f/0x9e0 [ 219.903067][ T9302] ? __pfx_netlink_unicast+0x10/0x10 [ 219.903093][ T9302] ? netlink_sendmsg+0x642/0xb30 [ 219.903109][ T9302] ? skb_put+0x11b/0x210 [ 219.903132][ T9302] netlink_sendmsg+0x805/0xb30 [ 219.903162][ T9302] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.903184][ T9302] ? aa_sock_msg_perm+0x94/0x160 [ 219.903203][ T9302] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 219.903220][ T9302] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.903239][ T9302] __sock_sendmsg+0x219/0x270 [ 219.903267][ T9302] ____sys_sendmsg+0x505/0x830 [ 219.903295][ T9302] ? __pfx_____sys_sendmsg+0x10/0x10 [ 219.903326][ T9302] ? import_iovec+0x74/0xa0 [ 219.903352][ T9302] ___sys_sendmsg+0x21f/0x2a0 [ 219.903376][ T9302] ? __pfx____sys_sendmsg+0x10/0x10 [ 219.903439][ T9302] ? __fget_files+0x2a/0x420 [ 219.903461][ T9302] ? __fget_files+0x3a0/0x420 [ 219.903496][ T9302] __x64_sys_sendmsg+0x19b/0x260 [ 219.903519][ T9302] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 219.903551][ T9302] ? rcu_is_watching+0x15/0xb0 [ 219.903575][ T9302] ? do_syscall_64+0xbe/0x3b0 [ 219.903597][ T9302] do_syscall_64+0xfa/0x3b0 [ 219.903613][ T9302] ? lockdep_hardirqs_on+0x9c/0x150 [ 219.903628][ T9302] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.903645][ T9302] ? clear_bhb_loop+0x60/0xb0 [ 219.903667][ T9302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.903683][ T9302] RIP: 0033:0x7f93fa18e9a9 [ 219.903705][ T9302] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 219.903719][ T9302] RSP: 002b:00007f93faf50038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 219.903739][ T9302] RAX: ffffffffffffffda RBX: 00007f93fa3b5fa0 RCX: 00007f93fa18e9a9 [ 219.903752][ T9302] RDX: 000000002000400c RSI: 0000200000000300 RDI: 000000000000000d [ 219.903764][ T9302] RBP: 00007f93fa210d69 R08: 0000000000000000 R09: 0000000000000000 [ 219.903774][ T9302] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 219.903785][ T9302] R13: 0000000000000000 R14: 00007f93fa3b5fa0 R15: 00007fffe84a5218 [ 219.903816][ T9302] [ 219.903835][ T9302] Mem-Info: [ 220.364631][ T9302] active_anon:4269 inactive_anon:0 isolated_anon:0 [ 220.364631][ T9302] active_file:1385 inactive_file:39884 isolated_file:0 [ 220.364631][ T9302] unevictable:768 dirty:180 writeback:0 [ 220.364631][ T9302] slab_reclaimable:11198 slab_unreclaimable:115053 [ 220.364631][ T9302] mapped:34155 shmem:1362 pagetables:1071 [ 220.364631][ T9302] sec_pagetables:0 bounce:0 [ 220.364631][ T9302] kernel_misc_reclaimable:0 [ 220.364631][ T9302] free:1311477 free_pcp:15938 free_cma:0 [ 220.453655][ T9302] Node 0 active_anon:17168kB inactive_anon:0kB active_file:5540kB inactive_file:159332kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:140728kB dirty:724kB writeback:0kB shmem:3912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12260kB pagetables:4060kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 220.559179][ T9302] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 220.621282][ T9302] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 220.673677][ T5851] Bluetooth: hci4: command 0x0405 tx timeout [ 220.689307][ T9302] lowmem_reserve[]: 0 2498 2500 2500 2500 [ 220.706231][ T9302] Node 0 DMA32 free:1334872kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:17320kB inactive_anon:0kB active_file:5540kB inactive_file:157756kB unevictable:1536kB writepending:724kB present:3129332kB managed:2558508kB mlocked:0kB bounce:0kB free_pcp:43604kB local_pcp:20196kB free_cma:0kB [ 220.742818][ T9302] lowmem_reserve[]: 0 0 1 1 1 [ 220.747771][ T9302] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 220.780209][ T9302] lowmem_reserve[]: 0 0 0 0 0 [ 220.785204][ T9302] Node 1 Normal free:3897168kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:21152kB local_pcp:7616kB free_cma:0kB [ 220.816647][ T9302] lowmem_reserve[]: 0 0 0 0 0 [ 220.821438][ T9302] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 220.834585][ T9302] Node 0 DMA32: 509*4kB (UME) 352*8kB (UM) 392*16kB (UME) 591*32kB (UME) 251*64kB (UME) 95*128kB (UM) 42*256kB (UME) 16*512kB (UME) 16*1024kB (UM) 4*2048kB (UME) 301*4096kB (M) = 1334676kB [ 220.856099][ T9302] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 220.868840][ T9302] Node 1 Normal: 188*4kB (UME) 62*8kB (UME) 37*16kB (UME) 101*32kB (UME) 32*64kB (UME) 5*128kB (UME) 3*256kB (ME) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (E) 948*4096kB (M) = 3897168kB [ 220.891450][ T9302] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 220.903843][ T9302] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 220.914607][ T9302] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 220.930676][ T9302] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 220.947285][ T9302] 42627 total pagecache pages [ 220.952807][ T9302] 0 pages in swap cache [ 220.956991][ T9302] Free swap = 124996kB [ 220.964558][ T9302] Total swap = 124996kB [ 220.968744][ T9302] 2097051 pages RAM [ 220.973579][ T9302] 0 pages HighMem/MovableOnly [ 220.978376][ T9302] 425382 pages reserved [ 220.986388][ T9302] 0 pages cma reserved [ 221.012232][ T9318] tipc: Enabled bearer , priority 0 [ 221.029862][ T9319] syzkaller0: entered promiscuous mode [ 221.042494][ T9319] syzkaller0: entered allmulticast mode [ 221.178317][ T9319] tipc: Resetting bearer [ 221.257225][ T9319] tipc: Disabling bearer [ 221.896444][ T9397] vxcan1 speed is unknown, defaulting to 1000 [ 222.276159][ T9424] vxcan1 speed is unknown, defaulting to 1000 [ 222.380609][ T9431] __nla_validate_parse: 6 callbacks suppressed [ 222.380627][ T9431] netlink: 16 bytes leftover after parsing attributes in process `syz.4.901'. [ 222.618719][ T9443] validate_nla: 1 callbacks suppressed [ 222.618739][ T9443] netlink: 'syz.3.905': attribute type 10 has an invalid length. [ 222.749610][ T9446] netlink: 8 bytes leftover after parsing attributes in process `syz.0.907'. [ 223.037193][ T9455] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 223.070623][ T9425] vxcan1 speed is unknown, defaulting to 1000 [ 223.339217][ T9464] netlink: 24 bytes leftover after parsing attributes in process `syz.3.913'. [ 223.412409][ T9464] bond0: invalid ARP target 0.0.0.0 specified for addition [ 223.419655][ T9464] bond0: option arp_ip_target: invalid value (0) [ 223.428434][ T9466] tipc: Enabled bearer , priority 0 [ 223.436565][ T9462] syzkaller0: entered promiscuous mode [ 223.443055][ T9462] syzkaller0: entered allmulticast mode [ 223.495710][ T9462] tipc: Resetting bearer [ 223.512663][ T9461] tipc: Resetting bearer [ 223.558941][ T9461] tipc: Disabling bearer [ 223.922186][ T9477] syzkaller0: entered promiscuous mode [ 223.929561][ T9477] syzkaller0: entered allmulticast mode [ 224.395031][ T9493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.921'. [ 224.424814][ T9493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.921'. [ 224.444294][ T9493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.921'. [ 224.463614][ T9493] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 224.514080][ T9497] siw: device registration error -23 [ 224.704999][ T9509] netlink: 76 bytes leftover after parsing attributes in process `syz.3.929'. [ 224.736451][ T9508] netlink: 'syz.4.927': attribute type 10 has an invalid length. [ 224.744570][ T9508] netlink: 40 bytes leftover after parsing attributes in process `syz.4.927'. [ 224.758552][ T9509] RDS: rds_bind could not find a transport for ::ffff:172.30.1.4, load rds_tcp or rds_rdma? [ 224.765756][ T9512] netlink: 28 bytes leftover after parsing attributes in process `syz.0.928'. [ 224.792318][ T9517] netlink: 16 bytes leftover after parsing attributes in process `syz.4.927'. [ 224.806234][ T9508] team0: Port device geneve0 added [ 224.824764][ T9518] RDS: rds_bind could not find a transport for ::ffff:172.30.1.1, load rds_tcp or rds_rdma? [ 224.915296][ T9517] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 224.941405][ T9500] netlink: 'syz.1.925': attribute type 4 has an invalid length. [ 225.255420][ T9542] netlink: 'syz.0.933': attribute type 13 has an invalid length. [ 227.065562][ T9569] vxcan1 speed is unknown, defaulting to 1000 [ 227.419682][ T9589] __nla_validate_parse: 5 callbacks suppressed [ 227.419701][ T9589] netlink: 32 bytes leftover after parsing attributes in process `syz.2.944'. [ 227.727257][ T9605] netlink: 4 bytes leftover after parsing attributes in process `syz.0.948'. [ 227.793727][ T9609] netlink: 12 bytes leftover after parsing attributes in process `syz.3.954'. [ 228.245618][ T9624] vxcan1 speed is unknown, defaulting to 1000 [ 228.406223][ T9637] netlink: 'syz.0.962': attribute type 10 has an invalid length. [ 228.429056][ T9637] netlink: 40 bytes leftover after parsing attributes in process `syz.0.962'. [ 228.549325][ T9637] dummy0: entered promiscuous mode [ 228.555317][ T9637] dummy0: entered allmulticast mode [ 228.585259][ T9637] team0: Port device dummy0 removed [ 228.595551][ T9637] bridge0: port 3(dummy0) entered blocking state [ 228.615072][ T9637] bridge0: port 3(dummy0) entered disabled state [ 228.714068][ T9644] tipc: Started in network mode [ 228.738431][ T9644] tipc: Node identity 080211, cluster identity 4711 [ 228.755503][ T9644] tipc: Enabled bearer , priority 0 [ 228.776404][ T9645] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 228.805876][ T9645] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 228.834621][ T9654] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 228.876596][ T51] Bluetooth: hci4: link tx timeout [ 228.885045][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 228.897798][ T51] Bluetooth: hci4: link tx timeout [ 228.906056][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 228.915556][ T51] Bluetooth: hci4: link tx timeout [ 228.924449][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 228.932226][ T51] Bluetooth: hci4: link tx timeout [ 228.937352][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 228.969284][ T9644] x_tables: ip_tables: udp match: only valid for protocol 17 [ 229.007891][ T9644] tipc: Resetting bearer [ 229.217445][ T9677] netlink: 248 bytes leftover after parsing attributes in process `syz.3.972'. [ 229.271741][ T9675] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 229.551449][ T9693] netlink: 12 bytes leftover after parsing attributes in process `syz.2.975'. [ 229.705308][ T9705] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 229.729148][ T9703] netlink: 36 bytes leftover after parsing attributes in process `syz.3.977'. [ 229.774933][ T9703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.977'. [ 229.810862][ T9703] netlink: 36 bytes leftover after parsing attributes in process `syz.3.977'. [ 229.856634][ T9703] netlink: 36 bytes leftover after parsing attributes in process `syz.3.977'. [ 229.881295][ T5959] tipc: Node number set to 134353152 [ 229.934400][ T9706] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 230.070975][ T9715] netlink: 'syz.4.979': attribute type 1 has an invalid length. [ 230.237620][ T9715] tipc: Enabled bearer , priority 0 [ 230.269816][ T9720] syzkaller0: entered promiscuous mode [ 230.298817][ T9720] syzkaller0: entered allmulticast mode [ 230.324189][ T9715] tipc: Resetting bearer [ 230.334168][ T9715] sctp: [Deprecated]: syz.4.979 (pid 9715) Use of int in max_burst socket option. [ 230.334168][ T9715] Use struct sctp_assoc_value instead [ 230.360273][ T9714] tipc: Resetting bearer [ 230.439674][ T9714] tipc: Disabling bearer [ 230.694361][ T9748] block nbd0: not configured, cannot reconfigure [ 230.913395][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 231.080247][ T9772] netlink: 'syz.1.995': attribute type 1 has an invalid length. [ 231.739759][ T9803] vxcan1 speed is unknown, defaulting to 1000 [ 231.807937][ T9805] netlink: 'syz.4.1002': attribute type 7 has an invalid length. [ 232.657321][ T9828] __nla_validate_parse: 6 callbacks suppressed [ 232.657339][ T9828] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1007'. [ 232.683103][ T9825] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1007'. [ 232.769543][ T9834] vxcan1 speed is unknown, defaulting to 1000 [ 233.042633][ T9855] FAULT_INJECTION: forcing a failure. [ 233.042633][ T9855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.079118][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: syz.3.1016 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 233.079144][ T9855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 233.079155][ T9855] Call Trace: [ 233.079162][ T9855] [ 233.079170][ T9855] dump_stack_lvl+0x189/0x250 [ 233.079195][ T9855] ? __pfx____ratelimit+0x10/0x10 [ 233.079219][ T9855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 233.079235][ T9855] ? __pfx__printk+0x10/0x10 [ 233.079256][ T9855] ? __might_fault+0xb0/0x130 [ 233.079289][ T9855] should_fail_ex+0x414/0x560 [ 233.079317][ T9855] _copy_from_user+0x2d/0xb0 [ 233.079337][ T9855] ___sys_sendmsg+0x158/0x2a0 [ 233.079361][ T9855] ? __pfx____sys_sendmsg+0x10/0x10 [ 233.079416][ T9855] ? __fget_files+0x2a/0x420 [ 233.079438][ T9855] ? __fget_files+0x3a0/0x420 [ 233.079471][ T9855] __sys_sendmmsg+0x227/0x430 [ 233.079497][ T9855] ? __pfx___sys_sendmmsg+0x10/0x10 [ 233.079513][ T9855] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 233.079558][ T9855] ? ksys_write+0x22a/0x250 [ 233.079580][ T9855] ? __pfx_ksys_write+0x10/0x10 [ 233.079596][ T9855] ? rcu_is_watching+0x15/0xb0 [ 233.079618][ T9855] __x64_sys_sendmmsg+0xa0/0xc0 [ 233.079638][ T9855] do_syscall_64+0xfa/0x3b0 [ 233.079654][ T9855] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.079669][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.079696][ T9855] ? clear_bhb_loop+0x60/0xb0 [ 233.079718][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.079733][ T9855] RIP: 0033:0x7f2df2b8e9a9 [ 233.079749][ T9855] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 233.079762][ T9855] RSP: 002b:00007f2df396d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 233.079781][ T9855] RAX: ffffffffffffffda RBX: 00007f2df2db5fa0 RCX: 00007f2df2b8e9a9 [ 233.079794][ T9855] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 233.079806][ T9855] RBP: 00007f2df396d090 R08: 0000000000000000 R09: 0000000000000000 [ 233.079817][ T9855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 233.079827][ T9855] R13: 0000000000000000 R14: 00007f2df2db5fa0 R15: 00007ffeafc5ce38 [ 233.079853][ T9855] [ 233.355002][ T9862] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1019'. [ 233.755676][ T9883] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1023'. [ 233.778127][ T9883] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1023'. [ 233.877333][ T9883] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1023'. [ 233.917696][ T9883] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1023'. [ 234.007443][ T9892] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1025'. [ 234.098613][ T9883] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1023'. [ 234.115348][ T9883] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1023'. [ 234.130659][ T9894] tipc: Enabled bearer , priority 0 [ 234.141984][ T9894] syzkaller0: entered promiscuous mode [ 234.148104][ T9894] syzkaller0: entered allmulticast mode [ 234.227585][ T9894] tipc: Resetting bearer [ 234.354579][ T9901] batman_adv: batadv0: Adding interface: macvlan2 [ 234.365869][ T9901] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 234.425130][ T9901] batman_adv: batadv0: Interface activated: macvlan2 [ 234.607301][ T9893] tipc: Resetting bearer [ 234.626549][ T9893] tipc: Disabling bearer [ 235.246918][ T9947] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 235.317386][ T9950] sch_tbf: burst 2 is lower than device lo mtu (11337746) ! [ 235.397128][ T9951] sch_tbf: burst 2 is lower than device lo mtu (11337746) ! [ 235.432672][ T9951] sch_tbf: burst 2 is lower than device lo mtu (11337746) ! [ 235.548402][ T30] audit: type=1800 audit(1753898595.847:3): pid=9965 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1049" name=14 dev="tmpfs" ino=1053 res=0 errno=0 [ 235.948428][ T9992] netlink: 'syz.1.1059': attribute type 1 has an invalid length. [ 235.974606][ T9992] netlink: 'syz.1.1059': attribute type 1 has an invalid length. [ 236.036912][ T9997] !: renamed from dummy0 [ 236.089431][T10001] netlink: 'syz.4.1063': attribute type 4 has an invalid length. [ 236.333270][T10016] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 236.386558][T10012] vxcan1 speed is unknown, defaulting to 1000 [ 236.497491][T10022] tipc: Enabled bearer , priority 0 [ 236.516103][T10022] syzkaller0: entered promiscuous mode [ 236.544002][T10022] syzkaller0: entered allmulticast mode [ 236.610820][T10022] tipc: Resetting bearer [ 236.639484][T10020] tipc: Resetting bearer [ 236.684687][T10020] tipc: Disabling bearer [ 237.693967][T10057] __nla_validate_parse: 9 callbacks suppressed [ 237.693984][T10057] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1076'. [ 238.071825][T10073] FAULT_INJECTION: forcing a failure. [ 238.071825][T10073] name failslab, interval 1, probability 0, space 0, times 0 [ 238.101810][T10073] CPU: 0 UID: 0 PID: 10073 Comm: syz.2.1079 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 238.101860][T10073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 238.101881][T10073] Call Trace: [ 238.101897][T10073] [ 238.101913][T10073] dump_stack_lvl+0x189/0x250 [ 238.101939][T10073] ? __pfx____ratelimit+0x10/0x10 [ 238.101964][T10073] ? __pfx_dump_stack_lvl+0x10/0x10 [ 238.101983][T10073] ? __pfx__printk+0x10/0x10 [ 238.102006][T10073] ? __lock_acquire+0xab9/0xd20 [ 238.102034][T10073] should_fail_ex+0x414/0x560 [ 238.102066][T10073] should_failslab+0xa8/0x100 [ 238.102091][T10073] kmem_cache_alloc_noprof+0x73/0x3c0 [ 238.102110][T10073] ? skb_clone+0x212/0x3a0 [ 238.102137][T10073] skb_clone+0x212/0x3a0 [ 238.102162][T10073] __netlink_deliver_tap+0x404/0x850 [ 238.102195][T10073] ? netlink_deliver_tap+0x2e/0x1b0 [ 238.102215][T10073] netlink_deliver_tap+0x19c/0x1b0 [ 238.102234][T10073] netlink_unicast+0x7fa/0x9e0 [ 238.102269][T10073] ? __pfx_netlink_unicast+0x10/0x10 [ 238.102295][T10073] ? netlink_sendmsg+0x642/0xb30 [ 238.102317][T10073] ? skb_put+0x11b/0x210 [ 238.102348][T10073] netlink_sendmsg+0x805/0xb30 [ 238.102377][T10073] ? __pfx_netlink_sendmsg+0x10/0x10 [ 238.102399][T10073] ? aa_sock_msg_perm+0x94/0x160 [ 238.102419][T10073] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 238.102436][T10073] ? __pfx_netlink_sendmsg+0x10/0x10 [ 238.102455][T10073] __sock_sendmsg+0x219/0x270 [ 238.102483][T10073] ____sys_sendmsg+0x52d/0x830 [ 238.102510][T10073] ? __pfx_____sys_sendmsg+0x10/0x10 [ 238.102541][T10073] ? import_iovec+0x74/0xa0 [ 238.102567][T10073] ___sys_sendmsg+0x21f/0x2a0 [ 238.102590][T10073] ? __pfx____sys_sendmsg+0x10/0x10 [ 238.102654][T10073] ? __fget_files+0x2a/0x420 [ 238.102675][T10073] ? __fget_files+0x3a0/0x420 [ 238.102710][T10073] __sys_sendmmsg+0x227/0x430 [ 238.102737][T10073] ? __pfx___sys_sendmmsg+0x10/0x10 [ 238.102754][T10073] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 238.102805][T10073] ? ksys_write+0x22a/0x250 [ 238.102829][T10073] ? __pfx_ksys_write+0x10/0x10 [ 238.102846][T10073] ? rcu_is_watching+0x15/0xb0 [ 238.102873][T10073] __x64_sys_sendmmsg+0xa0/0xc0 [ 238.102896][T10073] do_syscall_64+0xfa/0x3b0 [ 238.102912][T10073] ? lockdep_hardirqs_on+0x9c/0x150 [ 238.102929][T10073] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.102946][T10073] ? clear_bhb_loop+0x60/0xb0 [ 238.102968][T10073] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.102984][T10073] RIP: 0033:0x7f2b5df8e9a9 [ 238.102999][T10073] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 238.103013][T10073] RSP: 002b:00007f2b5edc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 238.103032][T10073] RAX: ffffffffffffffda RBX: 00007f2b5e1b5fa0 RCX: 00007f2b5df8e9a9 [ 238.103045][T10073] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 238.103057][T10073] RBP: 00007f2b5edc4090 R08: 0000000000000000 R09: 0000000000000000 [ 238.103068][T10073] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 238.103078][T10073] R13: 0000000000000000 R14: 00007f2b5e1b5fa0 R15: 00007ffde9dd6e68 [ 238.103110][T10073] [ 238.553332][T10076] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1080'. [ 238.566500][T10082] vxcan1 speed is unknown, defaulting to 1000 [ 238.590824][T10076] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1080'. [ 238.676630][T10090] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1083'. [ 239.437718][T10076] bond0 (unregistering): Released all slaves [ 239.858564][T10121] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1088'. [ 239.896521][T10121] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1088'. [ 240.047483][T10121] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1088'. [ 240.079194][T10121] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1088'. [ 240.113130][T10133] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1091'. [ 240.217995][T10136] netlink: 'syz.2.1092': attribute type 21 has an invalid length. [ 240.256352][T10136] bond0: option mode: unable to set because the bond device has slaves [ 240.436896][T10121] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1088'. [ 240.981537][T10163] netlink: 'syz.1.1096': attribute type 11 has an invalid length. [ 241.758129][T10186] vxcan1 speed is unknown, defaulting to 1000 [ 241.765080][T10194] syzkaller0: entered promiscuous mode [ 241.772974][T10194] syzkaller0: entered allmulticast mode [ 242.160491][T10216] netlink: 'syz.4.1114': attribute type 1 has an invalid length. [ 242.362943][T10220] netlink: 'syz.2.1117': attribute type 4 has an invalid length. [ 243.397626][T10242] macvlan1: entered promiscuous mode [ 243.443601][T10242] ipvlan0: entered promiscuous mode [ 243.455623][T10251] __nla_validate_parse: 7 callbacks suppressed [ 243.455641][T10251] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1127'. [ 243.484896][T10256] netlink: 'syz.1.1129': attribute type 30 has an invalid length. [ 243.491122][T10242] ipvlan0: left promiscuous mode [ 243.498697][T10242] macvlan1: left promiscuous mode [ 243.555811][T10256] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1129'. [ 243.570460][T10256] sctp: [Deprecated]: syz.1.1129 (pid 10256) Use of struct sctp_assoc_value in delayed_ack socket option. [ 243.570460][T10256] Use struct sctp_sack_info instead [ 243.598134][T10256] netlink: 'syz.1.1129': attribute type 1 has an invalid length. [ 243.626874][T10253] netlink: 124 bytes leftover after parsing attributes in process `syz.3.1128'. [ 243.752250][T10265] bond3 (unregistering): Released all slaves [ 243.933458][T10274] !: renamed from dummy0 (while UP) [ 244.280399][T10272] vxcan1 speed is unknown, defaulting to 1000 [ 244.455874][T10300] FAULT_INJECTION: forcing a failure. [ 244.455874][T10300] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 244.518784][T10300] CPU: 0 UID: 0 PID: 10300 Comm: syz.3.1136 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 244.518811][T10300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 244.518836][T10300] Call Trace: [ 244.518843][T10300] [ 244.518850][T10300] dump_stack_lvl+0x189/0x250 [ 244.518875][T10300] ? __pfx____ratelimit+0x10/0x10 [ 244.518901][T10300] ? __pfx_dump_stack_lvl+0x10/0x10 [ 244.518920][T10300] ? __pfx__printk+0x10/0x10 [ 244.518942][T10300] ? __might_fault+0xb0/0x130 [ 244.518976][T10300] should_fail_ex+0x414/0x560 [ 244.519008][T10300] _copy_from_user+0x2d/0xb0 [ 244.519031][T10300] kstrtouint_from_user+0xc4/0x170 [ 244.519054][T10300] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 244.519102][T10300] proc_fail_nth_write+0x88/0x240 [ 244.519128][T10300] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 244.519158][T10300] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 244.519181][T10300] vfs_write+0x27e/0xa90 [ 244.519209][T10300] ? __pfx_vfs_write+0x10/0x10 [ 244.519232][T10300] ? __fget_files+0x2a/0x420 [ 244.519260][T10300] ? __fget_files+0x3a0/0x420 [ 244.519280][T10300] ? __fget_files+0x2a/0x420 [ 244.519307][T10300] ksys_write+0x145/0x250 [ 244.519326][T10300] ? __pfx_ksys_write+0x10/0x10 [ 244.519340][T10300] ? rcu_is_watching+0x15/0xb0 [ 244.519359][T10300] ? do_syscall_64+0xbe/0x3b0 [ 244.519377][T10300] do_syscall_64+0xfa/0x3b0 [ 244.519389][T10300] ? lockdep_hardirqs_on+0x9c/0x150 [ 244.519402][T10300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.519415][T10300] ? clear_bhb_loop+0x60/0xb0 [ 244.519432][T10300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.519444][T10300] RIP: 0033:0x7f2df2b8d45f [ 244.519458][T10300] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 244.519468][T10300] RSP: 002b:00007f2df396d030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 244.519484][T10300] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2df2b8d45f [ 244.519493][T10300] RDX: 0000000000000001 RSI: 00007f2df396d0a0 RDI: 0000000000000005 [ 244.519501][T10300] RBP: 00007f2df396d090 R08: 0000000000000000 R09: 0000000000000000 [ 244.519509][T10300] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 244.519516][T10300] R13: 0000000000000000 R14: 00007f2df2db5fa0 R15: 00007ffeafc5ce38 [ 244.519539][T10300] [ 245.205419][T10322] team0: Port device geneve0 removed [ 245.245179][T10327] netlink: 'syz.2.1145': attribute type 2 has an invalid length. [ 245.253961][T10327] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1145'. [ 245.412240][T10322] team0: Failed to send options change via netlink (err -105) [ 245.419905][T10322] team0: Mode changed to "activebackup" [ 245.620358][T10335] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1148'. [ 245.905788][T10343] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1149'. [ 245.966379][T10343] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1149'. [ 246.078574][T10357] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1151'. [ 246.270838][T10360] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1154'. [ 246.373923][T10360] vxcan1 speed is unknown, defaulting to 1000 [ 246.663693][ T3079] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 246.685214][ T3079] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 246.699328][T10378] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1159'. [ 246.960246][T10392] netlink: 'syz.1.1163': attribute type 1 has an invalid length. [ 246.991013][T10394] netlink: 'syz.4.1164': attribute type 1 has an invalid length. [ 247.045331][T10392] 8021q: adding VLAN 0 to HW filter on device bond3 [ 247.116536][T10397] bond3: (slave veth3): Enslaving as an active interface with a down link [ 247.236027][T10392] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 247.255218][T10392] bond3: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 247.418176][T10407] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 247.524214][T10410] FAULT_INJECTION: forcing a failure. [ 247.524214][T10410] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.586014][T10414] netlink: 'syz.3.1169': attribute type 1 has an invalid length. [ 247.590549][T10410] CPU: 0 UID: 0 PID: 10410 Comm: syz.1.1168 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 247.590577][T10410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 247.590587][T10410] Call Trace: [ 247.590594][T10410] [ 247.590602][T10410] dump_stack_lvl+0x189/0x250 [ 247.590626][T10410] ? __pfx____ratelimit+0x10/0x10 [ 247.590651][T10410] ? __pfx_dump_stack_lvl+0x10/0x10 [ 247.590669][T10410] ? __pfx__printk+0x10/0x10 [ 247.590690][T10410] ? __might_fault+0xb0/0x130 [ 247.590722][T10410] should_fail_ex+0x414/0x560 [ 247.590752][T10410] _copy_from_iter+0x1db/0x16f0 [ 247.590777][T10410] ? rcu_is_watching+0x15/0xb0 [ 247.590796][T10410] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 247.590819][T10410] ? __pfx__copy_from_iter+0x10/0x10 [ 247.590840][T10410] ? __build_skb_around+0x257/0x3e0 [ 247.590862][T10410] ? netlink_sendmsg+0x642/0xb30 [ 247.590878][T10410] ? skb_put+0x11b/0x210 [ 247.590899][T10410] netlink_sendmsg+0x6b2/0xb30 [ 247.590926][T10410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.590947][T10410] ? aa_sock_msg_perm+0x94/0x160 [ 247.590966][T10410] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 247.590988][T10410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.591006][T10410] __sock_sendmsg+0x219/0x270 [ 247.591033][T10410] ____sys_sendmsg+0x52d/0x830 [ 247.591059][T10410] ? __pfx_____sys_sendmsg+0x10/0x10 [ 247.591087][T10410] ? import_iovec+0x74/0xa0 [ 247.591111][T10410] ___sys_sendmsg+0x21f/0x2a0 [ 247.591134][T10410] ? __pfx____sys_sendmsg+0x10/0x10 [ 247.591194][T10410] ? __fget_files+0x2a/0x420 [ 247.591215][T10410] ? __fget_files+0x3a0/0x420 [ 247.591248][T10410] __sys_sendmmsg+0x227/0x430 [ 247.591274][T10410] ? __pfx___sys_sendmmsg+0x10/0x10 [ 247.591291][T10410] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 247.591335][T10410] ? ksys_write+0x22a/0x250 [ 247.591358][T10410] ? __pfx_ksys_write+0x10/0x10 [ 247.591374][T10410] ? rcu_is_watching+0x15/0xb0 [ 247.591398][T10410] __x64_sys_sendmmsg+0xa0/0xc0 [ 247.591420][T10410] do_syscall_64+0xfa/0x3b0 [ 247.591436][T10410] ? lockdep_hardirqs_on+0x9c/0x150 [ 247.591451][T10410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.591468][T10410] ? clear_bhb_loop+0x60/0xb0 [ 247.591487][T10410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.591502][T10410] RIP: 0033:0x7fc739b8e9a9 [ 247.591518][T10410] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 247.591532][T10410] RSP: 002b:00007fc73a99a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 247.591551][T10410] RAX: ffffffffffffffda RBX: 00007fc739db5fa0 RCX: 00007fc739b8e9a9 [ 247.591564][T10410] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 247.591575][T10410] RBP: 00007fc73a99a090 R08: 0000000000000000 R09: 0000000000000000 [ 247.591585][T10410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.591594][T10410] R13: 0000000000000000 R14: 00007fc739db5fa0 R15: 00007ffe45f1ddf8 [ 247.591623][T10410] [ 248.087579][T10427] netlink: 'syz.1.1172': attribute type 4 has an invalid length. [ 248.588419][T10453] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 248.590912][T10455] FAULT_INJECTION: forcing a failure. [ 248.590912][T10455] name failslab, interval 1, probability 0, space 0, times 0 [ 248.615089][T10455] CPU: 1 UID: 0 PID: 10455 Comm: syz.2.1182 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 248.615114][T10455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 248.615124][T10455] Call Trace: [ 248.615131][T10455] [ 248.615138][T10455] dump_stack_lvl+0x189/0x250 [ 248.615161][T10455] ? __pfx____ratelimit+0x10/0x10 [ 248.615187][T10455] ? __pfx_dump_stack_lvl+0x10/0x10 [ 248.615206][T10455] ? __pfx__printk+0x10/0x10 [ 248.615230][T10455] ? __lock_acquire+0xab9/0xd20 [ 248.615258][T10455] should_fail_ex+0x414/0x560 [ 248.615290][T10455] should_failslab+0xa8/0x100 [ 248.615315][T10455] kmem_cache_alloc_noprof+0x73/0x3c0 [ 248.615336][T10455] ? skb_clone+0x212/0x3a0 [ 248.615362][T10455] skb_clone+0x212/0x3a0 [ 248.615387][T10455] __netlink_deliver_tap+0x404/0x850 [ 248.615420][T10455] ? netlink_deliver_tap+0x2e/0x1b0 [ 248.615439][T10455] netlink_deliver_tap+0x19c/0x1b0 [ 248.615458][T10455] netlink_unicast+0x7fa/0x9e0 [ 248.615497][T10455] ? __pfx_netlink_unicast+0x10/0x10 [ 248.615522][T10455] ? netlink_sendmsg+0x642/0xb30 [ 248.615535][T10455] ? skb_put+0x11b/0x210 [ 248.615560][T10455] netlink_sendmsg+0x805/0xb30 [ 248.615592][T10455] ? __pfx_netlink_sendmsg+0x10/0x10 [ 248.615615][T10455] ? aa_sock_msg_perm+0x94/0x160 [ 248.615635][T10455] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 248.615650][T10455] ? __pfx_netlink_sendmsg+0x10/0x10 [ 248.615669][T10455] __sock_sendmsg+0x219/0x270 [ 248.615697][T10455] ____sys_sendmsg+0x52d/0x830 [ 248.615724][T10455] ? __pfx_____sys_sendmsg+0x10/0x10 [ 248.615755][T10455] ? import_iovec+0x74/0xa0 [ 248.615780][T10455] ___sys_sendmsg+0x21f/0x2a0 [ 248.615803][T10455] ? __pfx____sys_sendmsg+0x10/0x10 [ 248.615863][T10455] ? __fget_files+0x2a/0x420 [ 248.615883][T10455] ? __fget_files+0x3a0/0x420 [ 248.615916][T10455] __sys_sendmmsg+0x227/0x430 [ 248.615942][T10455] ? __pfx___sys_sendmmsg+0x10/0x10 [ 248.615959][T10455] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 248.616005][T10455] ? ksys_write+0x22a/0x250 [ 248.616026][T10455] ? __pfx_ksys_write+0x10/0x10 [ 248.616042][T10455] ? rcu_is_watching+0x15/0xb0 [ 248.616065][T10455] __x64_sys_sendmmsg+0xa0/0xc0 [ 248.616086][T10455] do_syscall_64+0xfa/0x3b0 [ 248.616102][T10455] ? lockdep_hardirqs_on+0x9c/0x150 [ 248.616117][T10455] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.616133][T10455] ? clear_bhb_loop+0x60/0xb0 [ 248.616153][T10455] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.616168][T10455] RIP: 0033:0x7f2b5df8e9a9 [ 248.616183][T10455] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 248.616197][T10455] RSP: 002b:00007f2b5edc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 248.616215][T10455] RAX: ffffffffffffffda RBX: 00007f2b5e1b5fa0 RCX: 00007f2b5df8e9a9 [ 248.616228][T10455] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 248.616239][T10455] RBP: 00007f2b5edc4090 R08: 0000000000000000 R09: 0000000000000000 [ 248.616249][T10455] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 248.616260][T10455] R13: 0000000000000000 R14: 00007f2b5e1b5fa0 R15: 00007ffde9dd6e68 [ 248.616290][T10455] [ 249.277314][T10467] vxcan1 speed is unknown, defaulting to 1000 [ 249.281859][T10477] __nla_validate_parse: 4 callbacks suppressed [ 249.281876][T10477] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1191'. [ 249.307186][T10479] netlink: 'syz.0.1185': attribute type 1 has an invalid length. [ 249.354959][T10480] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1191'. [ 249.383333][T10478] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1191'. [ 249.709359][T10494] FAULT_INJECTION: forcing a failure. [ 249.709359][T10494] name failslab, interval 1, probability 0, space 0, times 0 [ 249.722391][T10494] CPU: 0 UID: 0 PID: 10494 Comm: syz.2.1197 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 249.722418][T10494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 249.722430][T10494] Call Trace: [ 249.722438][T10494] [ 249.722445][T10494] dump_stack_lvl+0x189/0x250 [ 249.722470][T10494] ? __pfx____ratelimit+0x10/0x10 [ 249.722504][T10494] ? __pfx_dump_stack_lvl+0x10/0x10 [ 249.722524][T10494] ? __pfx__printk+0x10/0x10 [ 249.722549][T10494] ? __lock_acquire+0xab9/0xd20 [ 249.722576][T10494] should_fail_ex+0x414/0x560 [ 249.722608][T10494] should_failslab+0xa8/0x100 [ 249.722634][T10494] kmem_cache_alloc_noprof+0x73/0x3c0 [ 249.722656][T10494] ? skb_clone+0x212/0x3a0 [ 249.722675][T10494] ? __pfx_skb_network_protocol+0x10/0x10 [ 249.722702][T10494] skb_clone+0x212/0x3a0 [ 249.722721][T10494] ? dev_queue_xmit_nit+0x25a/0xcc0 [ 249.722743][T10494] dev_queue_xmit_nit+0x416/0xcc0 [ 249.722761][T10494] ? dev_queue_xmit_nit+0x2d/0xcc0 [ 249.722794][T10494] dev_hard_start_xmit+0x1be/0x830 [ 249.722835][T10494] __dev_queue_xmit+0x1b8d/0x3b50 [ 249.722870][T10494] ? __dev_queue_xmit+0x27b/0x3b50 [ 249.722911][T10494] ? __pfx___dev_queue_xmit+0x10/0x10 [ 249.722948][T10494] ? __copy_skb_header+0xa7/0x550 [ 249.722970][T10494] ? __asan_memcpy+0x40/0x70 [ 249.722990][T10494] ? __skb_clone+0x63/0x7a0 [ 249.723016][T10494] ? __skb_clone+0x483/0x7a0 [ 249.723045][T10494] ? skb_clone+0x246/0x3a0 [ 249.723070][T10494] __netlink_deliver_tap+0x5ad/0x850 [ 249.723104][T10494] ? netlink_deliver_tap+0x2e/0x1b0 [ 249.723125][T10494] netlink_deliver_tap+0x19c/0x1b0 [ 249.723144][T10494] netlink_unicast+0x7fa/0x9e0 [ 249.723181][T10494] ? __pfx_netlink_unicast+0x10/0x10 [ 249.723208][T10494] ? netlink_sendmsg+0x642/0xb30 [ 249.723224][T10494] ? skb_put+0x11b/0x210 [ 249.723247][T10494] netlink_sendmsg+0x805/0xb30 [ 249.723275][T10494] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.723296][T10494] ? aa_sock_msg_perm+0x94/0x160 [ 249.723315][T10494] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 249.723333][T10494] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.723353][T10494] __sock_sendmsg+0x219/0x270 [ 249.723381][T10494] ____sys_sendmsg+0x52d/0x830 [ 249.723409][T10494] ? __pfx_____sys_sendmsg+0x10/0x10 [ 249.723441][T10494] ? import_iovec+0x74/0xa0 [ 249.723468][T10494] ___sys_sendmsg+0x21f/0x2a0 [ 249.723500][T10494] ? __pfx____sys_sendmsg+0x10/0x10 [ 249.723561][T10494] ? __fget_files+0x2a/0x420 [ 249.723583][T10494] ? __fget_files+0x3a0/0x420 [ 249.723617][T10494] __sys_sendmmsg+0x227/0x430 [ 249.723644][T10494] ? __pfx___sys_sendmmsg+0x10/0x10 [ 249.723662][T10494] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 249.723711][T10494] ? ksys_write+0x22a/0x250 [ 249.723735][T10494] ? __pfx_ksys_write+0x10/0x10 [ 249.723764][T10494] __x64_sys_sendmmsg+0xa0/0xc0 [ 249.723788][T10494] do_syscall_64+0xfa/0x3b0 [ 249.723805][T10494] ? lockdep_hardirqs_on+0x9c/0x150 [ 249.723822][T10494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.723839][T10494] ? clear_bhb_loop+0x60/0xb0 [ 249.723862][T10494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.723879][T10494] RIP: 0033:0x7f2b5df8e9a9 [ 249.723896][T10494] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 249.723912][T10494] RSP: 002b:00007f2b5edc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 249.723943][T10494] RAX: ffffffffffffffda RBX: 00007f2b5e1b5fa0 RCX: 00007f2b5df8e9a9 [ 249.723956][T10494] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 249.723969][T10494] RBP: 00007f2b5edc4090 R08: 0000000000000000 R09: 0000000000000000 [ 249.723980][T10494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 249.723991][T10494] R13: 0000000000000000 R14: 00007f2b5e1b5fa0 R15: 00007ffde9dd6e68 [ 249.724023][T10494] [ 250.146258][T10500] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1199'. [ 250.403269][T10488] vxcan1 speed is unknown, defaulting to 1000 [ 250.482187][T10490] netlink: 244 bytes leftover after parsing attributes in process `syz.4.1195'. [ 250.727634][T10507] vxcan1 speed is unknown, defaulting to 1000 [ 251.234993][T10536] netlink: 'syz.2.1208': attribute type 3 has an invalid length. [ 251.427638][T10538] netlink: 'syz.2.1209': attribute type 13 has an invalid length. [ 251.441833][T10538] netlink: 'syz.2.1209': attribute type 17 has an invalid length. [ 251.489494][T10538] gretap0: refused to change device tx_queue_len [ 251.500359][T10538] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 251.531871][T10542] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1210'. [ 252.037092][T10553] netlink: 'syz.0.1215': attribute type 10 has an invalid length. [ 252.057209][T10553] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 252.269608][T10574] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1220'. [ 252.355200][T10574] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1220'. [ 252.417251][T10581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1222'. [ 252.919724][T10612] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0 [ 252.932718][T10609] IPVS: stopping backup sync thread 10612 ... [ 252.988000][T10608] vxcan1 speed is unknown, defaulting to 1000 [ 253.089124][T10619] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1231'. [ 253.143677][T10625] tipc: Enabled bearer , priority 0 [ 253.165029][T10625] syzkaller0: entered promiscuous mode [ 253.178738][T10625] syzkaller0: entered allmulticast mode [ 253.308217][T10625] tipc: Resetting bearer [ 253.408079][T10643] IPVS: length: 30 != 8 [ 253.413281][T10642] IPVS: length: 30 != 8 [ 253.707986][T10655] tipc: Enabling of bearer rejected, already enabled [ 253.826995][T10668] netlink: 'syz.2.1247': attribute type 6 has an invalid length. [ 253.996696][ T5918] IPVS: starting estimator thread 0... [ 254.092371][T10684] IPVS: using max 30 ests per chain, 72000 per kthread [ 254.163652][ T5918] tipc: Node number set to 3750341738 [ 254.817356][T10722] netlink: 'syz.4.1260': attribute type 1 has an invalid length. [ 254.838994][T10722] netlink: 'syz.4.1260': attribute type 4 has an invalid length. [ 254.874347][T10722] __nla_validate_parse: 7 callbacks suppressed [ 254.874364][T10722] netlink: 188 bytes leftover after parsing attributes in process `syz.4.1260'. [ 254.974809][T10726] netlink: 'syz.0.1262': attribute type 16 has an invalid length. [ 254.999231][T10726] netlink: 'syz.0.1262': attribute type 3 has an invalid length. [ 255.008867][T10726] netlink: 64066 bytes leftover after parsing attributes in process `syz.0.1262'. [ 255.069759][T10737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1265'. [ 255.147878][T10739] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1266'. [ 255.203028][T10743] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1267'. [ 255.224618][T10739] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 255.241736][T10739] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 255.259858][T10739] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 255.277976][T10739] bond0 (unregistering): Released all slaves [ 255.297269][T10747] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1269'. [ 255.409526][T10752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1270'. [ 255.547278][T10764] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1273'. [ 255.727237][T10771] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1276'. [ 255.748753][T10772] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1276'. [ 255.995434][T10781] netlink: 'syz.3.1278': attribute type 3 has an invalid length. [ 256.152236][T10796] siw: device registration error -23 [ 256.184992][T10793] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 256.570029][T10821] syzkaller0: entered promiscuous mode [ 256.577032][T10821] syzkaller0: entered allmulticast mode [ 256.850247][T10845] netlink: 'syz.3.1297': attribute type 2 has an invalid length. [ 256.870103][T10845] : entered promiscuous mode [ 257.850303][T10892] sctp: [Deprecated]: syz.1.1310 (pid 10892) Use of struct sctp_assoc_value in delayed_ack socket option. [ 257.850303][T10892] Use struct sctp_sack_info instead [ 258.067705][T10901] tipc: Enabling of bearer rejected, already enabled [ 258.087655][T10901] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 258.104156][T10901] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 258.136900][T10905] netlink: 'syz.4.1315': attribute type 3 has an invalid length. [ 258.319422][T10911] net veth1_virt_wifi virt_wifi0: left allmulticast mode [ 258.329837][T10913] warn_alloc: 1 callbacks suppressed [ 258.329856][T10913] syz.0.1318: vmalloc error: size 33558528, failed to allocated page array size 65544, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 258.366588][T10913] CPU: 1 UID: 0 PID: 10913 Comm: syz.0.1318 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 258.366616][T10913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 258.366627][T10913] Call Trace: [ 258.366634][T10913] [ 258.366642][T10913] dump_stack_lvl+0x189/0x250 [ 258.366667][T10913] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 258.366694][T10913] ? __pfx_dump_stack_lvl+0x10/0x10 [ 258.366714][T10913] ? __pfx__printk+0x10/0x10 [ 258.366736][T10913] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 258.366758][T10913] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 258.366788][T10913] warn_alloc+0x214/0x310 [ 258.366819][T10913] ? __pfx_warn_alloc+0x10/0x10 [ 258.366854][T10913] ? __get_vm_area_node+0x28f/0x300 [ 258.366878][T10913] ? xskq_create+0xbf/0x170 [ 258.366907][T10913] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 258.366975][T10913] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 258.367006][T10913] ? __kasan_kmalloc+0x93/0xb0 [ 258.367031][T10913] vmalloc_user_noprof+0xad/0xf0 [ 258.367053][T10913] ? xskq_create+0xbf/0x170 [ 258.367078][T10913] xskq_create+0xbf/0x170 [ 258.367104][T10913] xsk_init_queue+0xb0/0x110 [ 258.367126][T10913] xsk_setsockopt+0x57b/0x8d0 [ 258.367150][T10913] ? __pfx_xsk_setsockopt+0x10/0x10 [ 258.367172][T10913] ? __pfx_aa_sk_perm+0x10/0x10 [ 258.367199][T10913] ? __fget_files+0x2a/0x420 [ 258.367221][T10913] ? aa_sock_opt_perm+0x74/0x110 [ 258.367237][T10913] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 258.367252][T10913] ? __pfx_xsk_setsockopt+0x10/0x10 [ 258.367276][T10913] do_sock_setsockopt+0x17c/0x1b0 [ 258.367303][T10913] __x64_sys_setsockopt+0x13f/0x1b0 [ 258.367329][T10913] do_syscall_64+0xfa/0x3b0 [ 258.367345][T10913] ? lockdep_hardirqs_on+0x9c/0x150 [ 258.367362][T10913] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.367379][T10913] ? clear_bhb_loop+0x60/0xb0 [ 258.367401][T10913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.367418][T10913] RIP: 0033:0x7f918fb8e9a9 [ 258.367434][T10913] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 258.367449][T10913] RSP: 002b:00007f91909ba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 258.367469][T10913] RAX: ffffffffffffffda RBX: 00007f918fdb5fa0 RCX: 00007f918fb8e9a9 [ 258.367482][T10913] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000003 [ 258.367499][T10913] RBP: 00007f918fc10d69 R08: 0000000000000004 R09: 0000000000000000 [ 258.367511][T10913] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 258.367522][T10913] R13: 0000000000000000 R14: 00007f918fdb5fa0 R15: 00007ffeba36a208 [ 258.367554][T10913] [ 258.370608][T10913] Mem-Info: [ 258.666678][T10913] active_anon:4300 inactive_anon:0 isolated_anon:0 [ 258.666678][T10913] active_file:1419 inactive_file:39902 isolated_file:0 [ 258.666678][T10913] unevictable:768 dirty:49 writeback:0 [ 258.666678][T10913] slab_reclaimable:11756 slab_unreclaimable:141180 [ 258.666678][T10913] mapped:29139 shmem:1384 pagetables:1068 [ 258.666678][T10913] sec_pagetables:0 bounce:0 [ 258.666678][T10913] kernel_misc_reclaimable:0 [ 258.666678][T10913] free:1278512 free_pcp:21793 free_cma:0 [ 258.722076][T10911] bond3: left promiscuous mode [ 258.727742][T10922] netlink: 'syz.2.1320': attribute type 1 has an invalid length. [ 258.736118][T10913] Node 0 active_anon:17200kB inactive_anon:0kB active_file:5676kB inactive_file:159404kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116556kB dirty:192kB writeback:0kB shmem:4000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12136kB pagetables:4124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 258.773555][T10913] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 258.808667][T10913] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 258.840240][T10913] lowmem_reserve[]: 0 2498 2500 2500 2500 [ 258.843300][T10911] gtp0: left promiscuous mode [ 258.848817][T10913] Node 0 DMA32 free:1200996kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:17152kB inactive_anon:0kB active_file:5676kB inactive_file:157828kB unevictable:1536kB writepending:192kB present:3129332kB managed:2558508kB mlocked:0kB bounce:0kB free_pcp:66120kB local_pcp:55056kB free_cma:0kB [ 258.862254][T10911] gtp0: left allmulticast mode [ 258.889213][T10913] lowmem_reserve[]: 0 0 1 1 1 [ 258.894190][T10913] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 258.928285][T10913] lowmem_reserve[]: 0 0 0 0 0 [ 258.933195][T10913] Node 1 Normal free:3897680kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:20672kB local_pcp:7136kB free_cma:0kB [ 258.974706][T10913] lowmem_reserve[]: 0 0 0 0 0 [ 258.979629][T10913] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 258.997637][T10913] Node 0 DMA32: 1722*4kB (UM) 1039*8kB (UME) 283*16kB (UM) 291*32kB (UM) 248*64kB (UME) 120*128kB (UM) 55*256kB (UME) 14*512kB (UME) 16*1024kB (UME) 9*2048kB (UME) 265*4096kB (M) = 1201776kB [ 259.020532][T10913] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 259.036446][T10913] Node 1 Normal: 188*4kB (UME) 62*8kB (UME) 37*16kB (UME) 107*32kB (UME) 35*64kB (UME) 6*128kB (UME) 3*256kB (ME) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (E) 948*4096kB (M) = 3897680kB [ 259.058081][T10913] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 259.068778][T10913] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 259.098089][T10913] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 259.109639][T10913] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 259.121072][T10913] 42696 total pagecache pages [ 259.128283][T10913] 0 pages in swap cache [ 259.139957][T10913] Free swap = 124996kB [ 259.143550][T10922] 8021q: adding VLAN 0 to HW filter on device bond5 [ 259.144496][T10913] Total swap = 124996kB [ 259.155356][T10913] 2097051 pages RAM [ 259.159276][T10913] 0 pages HighMem/MovableOnly [ 259.172693][T10913] 425382 pages reserved [ 259.177088][T10913] 0 pages cma reserved [ 259.185469][T10927] bond5: (slave geneve3): making interface the new active one [ 259.196505][T10927] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 259.524542][T10943] tipc: Enabling of bearer rejected, already enabled [ 259.563587][T10948] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 259.592382][T10948] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 259.889311][T10971] __nla_validate_parse: 14 callbacks suppressed [ 259.889332][T10971] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1337'. [ 260.053046][T10982] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1340'. [ 260.075080][T10982] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1340'. [ 260.095977][T10984] sctp: [Deprecated]: syz.3.1342 (pid 10984) Use of struct sctp_assoc_value in delayed_ack socket option. [ 260.095977][T10984] Use struct sctp_sack_info instead [ 260.238740][T10987] ksmbd: Unknown IPC event: 3, ignore. [ 260.383363][T11000] netlink: 'syz.2.1345': attribute type 16 has an invalid length. [ 260.391466][T11000] netlink: 'syz.2.1345': attribute type 17 has an invalid length. [ 260.535812][T11009] IPv6: NLM_F_REPLACE set, but no existing node found! [ 260.729281][T11000] tipc: Resetting bearer [ 260.748695][T10998] vxcan1 speed is unknown, defaulting to 1000 [ 260.755398][T11005] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1345'. [ 260.796956][ T12] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.815326][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.826435][ T12] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.835806][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.857999][ T6089] vxcan1 speed is unknown, defaulting to 1000 [ 260.883782][ T6089] syz1: Port: 1 Link DOWN [ 260.904460][T11017] netlink: 'syz.1.1350': attribute type 1 has an invalid length. [ 260.924633][ T12] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.953772][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.963452][ T12] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.981295][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.993726][ T6089] vxcan1 speed is unknown, defaulting to 1000 [ 261.012738][T11020] netlink: 25 bytes leftover after parsing attributes in process `syz.3.1351'. [ 261.416530][T11043] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1360'. [ 261.464304][T11043] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 261.687415][T11057] netlink: 'syz.4.1363': attribute type 9 has an invalid length. [ 261.750102][T11057] netlink: 'syz.4.1363': attribute type 6 has an invalid length. [ 261.875755][T11068] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.1366'. [ 261.886921][T11068] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 261.960904][T11068] openvswitch: netlink: Duplicate key (type 0). [ 262.177769][T11076] 8021q: VLANs not supported on ip_vti0 [ 262.184025][T11077] 8021q: VLANs not supported on ip_vti0 [ 262.359560][T11082] nbd0: detected capacity change from 0 to 127 [ 262.373546][ T5851] block nbd0: Receive control failed (result -32) [ 262.682038][T11106] @: renamed from bond_slave_0 [ 262.803364][T11109] netlink: 'syz.0.1375': attribute type 10 has an invalid length. [ 262.812208][T11109] dummy0: left allmulticast mode [ 262.817243][T11109] dummy0: left promiscuous mode [ 262.834497][T11109] bridge0: port 3(dummy0) entered disabled state [ 262.859226][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 262.890215][T11109] team0: Port device dummy0 added [ 262.964847][T11113] : entered promiscuous mode [ 263.001640][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.144657][T11113] validate_nla: 7 callbacks suppressed [ 263.144675][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.210533][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.251540][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.278241][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.287151][T11124] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1381'. [ 263.287952][T11127] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1381'. [ 263.322670][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.352643][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.409901][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.443458][T11124] tipc: Enabled bearer , priority 0 [ 263.462942][T11127] tipc: Enabling of bearer rejected, already enabled [ 263.494799][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.504255][T11124] syzkaller0: entered promiscuous mode [ 263.509785][T11124] syzkaller0: entered allmulticast mode [ 263.548073][T11113] netlink: 'syz.1.1376': attribute type 2 has an invalid length. [ 263.598985][T11127] tipc: Resetting bearer [ 263.628861][T11122] tipc: Resetting bearer [ 263.667047][T11122] tipc: Disabling bearer [ 263.707572][T11138] netlink: 51 bytes leftover after parsing attributes in process `syz.3.1383'. [ 263.864621][T11144] vxcan1 speed is unknown, defaulting to 1000 [ 264.268460][T11160] netlink: 'syz.1.1391': attribute type 2 has an invalid length. [ 264.994832][T11184] __nla_validate_parse: 38 callbacks suppressed [ 264.994852][T11184] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1397'. [ 265.012279][T11184] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1397'. [ 265.046838][T11182] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1397'. [ 265.059854][T11182] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1397'. [ 265.083132][T11188] tipc: Enabled bearer , priority 0 [ 265.107405][T11188] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 265.168246][T11188] tipc: Resetting bearer [ 265.221812][T11187] tipc: Disabling bearer [ 265.440854][T11202] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1401'. [ 266.000872][T11213] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1406'. [ 266.010751][T11213] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1406'. [ 266.052685][T11219] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1406'. [ 266.065670][T11219] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1406'. [ 266.297419][T11218] vxcan1 speed is unknown, defaulting to 1000 [ 266.682441][T11230] bond7: entered promiscuous mode [ 266.696585][T11230] 8021q: adding VLAN 0 to HW filter on device bond7 [ 266.742190][T11233] bond7: (slave bridge1): making interface the new active one [ 266.750578][T11233] bridge1: entered promiscuous mode [ 266.769971][T11233] bond7: (slave bridge1): Enslaving as an active interface with an up link [ 267.086081][T11247] vxcan1 speed is unknown, defaulting to 1000 [ 267.369121][T11248] vxcan1 speed is unknown, defaulting to 1000 [ 268.526366][T11305] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1421'. [ 268.615845][T11307] validate_nla: 2 callbacks suppressed [ 268.615863][T11307] netlink: 'syz.4.1422': attribute type 2 has an invalid length. [ 268.767580][T11307] bridge0: entered promiscuous mode [ 268.794830][T11307] bridge0: left promiscuous mode [ 268.933819][T11310] vlan0: entered promiscuous mode [ 268.939149][T11310] gretap0: entered promiscuous mode [ 269.138226][T11316] syzkaller0: entered promiscuous mode [ 269.152928][T11316] syzkaller0: entered allmulticast mode [ 272.195306][T11406] __nla_validate_parse: 3 callbacks suppressed [ 272.195332][T11406] netlink: 212264 bytes leftover after parsing attributes in process `syz.0.1441'. [ 272.385404][T11422] syzkaller0: entered promiscuous mode [ 272.392825][T11422] syzkaller0: entered allmulticast mode [ 272.400037][T11419] tipc: Enabled bearer , priority 0 [ 272.477571][T11419] tipc: Resetting bearer [ 272.507319][T11419] tipc: Disabling bearer [ 272.709134][T11442] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1451'. [ 272.732127][T11442] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1451'. [ 272.799827][T11447] netlink: 'syz.4.1452': attribute type 11 has an invalid length. [ 272.830595][T11447] netlink: 'syz.4.1452': attribute type 4 has an invalid length. [ 272.840373][T11447] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1452'. [ 272.840499][T11450] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1453'. [ 272.852504][T11446] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1452'. [ 272.871699][T11453] sctp: [Deprecated]: syz.0.1454 (pid 11453) Use of int in maxseg socket option. [ 272.871699][T11453] Use struct sctp_assoc_value instead [ 272.972485][T11455] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 273.098406][T11460] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1457'. [ 273.378866][T11479] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1463'. [ 273.399857][T11479] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1463'. [ 273.541979][T11487] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1465'. [ 273.767162][T11498] netlink: 'syz.1.1470': attribute type 1 has an invalid length. [ 273.849800][T11495] vxcan1 speed is unknown, defaulting to 1000 [ 274.118397][T11507] Bluetooth: MGMT ver 1.23 [ 274.366882][T11517] netlink: 'syz.0.1476': attribute type 10 has an invalid length. [ 274.487853][T11519] netlink: 'syz.1.1478': attribute type 1 has an invalid length. [ 274.977837][ T889] IPVS: starting estimator thread 0... [ 275.091756][T11552] IPVS: using max 27 ests per chain, 64800 per kthread [ 275.135220][T11553] vxcan1 speed is unknown, defaulting to 1000 [ 275.473000][T11564] team0: Port device dummy0 removed [ 275.502051][T11564] bond0: (slave bond1): Releasing backup interface [ 275.510484][T11564] bond3: (slave bridge2): Removing an active aggregator [ 275.532292][T11564] bond3: (slave bridge2): Releasing backup interface [ 275.546743][T11564] bridge2: left promiscuous mode [ 275.553112][T11564] bridge2: left allmulticast mode [ 275.560042][T11564] bond4: (slave geneve2): Releasing active interface [ 275.570045][T11564] bond5: (slave geneve3): Releasing active interface [ 276.108164][T11582] netlink: 'syz.1.1495': attribute type 1 has an invalid length. [ 276.136702][T11583] netlink: 'syz.1.1495': attribute type 1 has an invalid length. [ 276.256912][T11588] netlink: 'syz.0.1496': attribute type 10 has an invalid length. [ 276.352680][T11594] sctp: [Deprecated]: syz.2.1497 (pid 11594) Use of int in max_burst socket option deprecated. [ 276.352680][T11594] Use struct sctp_assoc_value instead [ 276.710837][T11614] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 276.739995][T11614] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 276.829155][T11621] bond0: (slave 0!): Releasing backup interface [ 276.846431][T11621] bond0: (slave batadv0): Releasing backup interface [ 276.858805][T11621] bond0: (slave bond_slave_0): Releasing backup interface [ 276.870701][T11621] bond0: (slave bond_slave_1): Releasing backup interface [ 276.888856][T11621] team0: Port device team_slave_0 removed [ 276.897467][T11621] team0: Port device team_slave_1 removed [ 276.905215][T11621] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 276.916549][T11629] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 276.926962][T11621] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 276.936514][T11621] bond7: (slave bridge1): Releasing backup interface [ 276.943838][T11630] netlink: 'syz.3.1508': attribute type 10 has an invalid length. [ 276.952212][T11621] bridge1: left promiscuous mode [ 276.977803][T11630] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 277.114763][T11639] IPVS: Unknown mcast interface: pim6reg0 [ 277.241124][T11650] __nla_validate_parse: 8 callbacks suppressed [ 277.242739][T11651] RDS: rds_bind could not find a transport for fc02::1, load rds_tcp or rds_rdma? [ 277.247660][T11650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1516'. [ 277.275330][T11650] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1516'. [ 277.697193][T11677] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1525'. [ 277.707474][T11677] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1525'. [ 277.978515][T11687] netlink: 'syz.2.1527': attribute type 13 has an invalid length. [ 278.049248][T11693] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1527'. [ 278.329619][T11694] lo: entered allmulticast mode [ 278.458007][T11708] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1534'. [ 278.626876][T11717] tipc: Enabled bearer , priority 0 [ 278.662751][T11717] syzkaller0: entered promiscuous mode [ 278.679283][T11717] syzkaller0: entered allmulticast mode [ 278.790647][T11722] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1536'. [ 278.854360][T11722] tipc: Resetting bearer [ 278.933149][T11722] tipc: Disabling bearer [ 278.964662][T11732] netlink: 'syz.2.1539': attribute type 1 has an invalid length. [ 278.992871][T11732] netlink: 'syz.2.1539': attribute type 4 has an invalid length. [ 279.000713][T11732] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.1539'. [ 279.016690][T11741] netlink: 'syz.3.1538': attribute type 13 has an invalid length. [ 279.027513][T11741] netlink: 'syz.3.1538': attribute type 17 has an invalid length. [ 279.129583][T11741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 279.145059][T11741] 8021q: adding VLAN 0 to HW filter on device team0 [ 279.179040][T11741] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 279.238878][T11743] netlink: 'syz.1.1540': attribute type 1 has an invalid length. [ 279.311956][T11755] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1542'. [ 279.334621][T11751] vxcan1 speed is unknown, defaulting to 1000 [ 279.451772][T11758] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1543'. [ 280.843163][T11815] netlink: 'syz.1.1556': attribute type 21 has an invalid length. [ 280.917466][T11820] netlink: 'syz.0.1558': attribute type 1 has an invalid length. [ 281.200408][T11835] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 281.248441][T11834] netlink: 'syz.4.1561': attribute type 1 has an invalid length. [ 281.407922][T11846] netlink: 'syz.2.1565': attribute type 1 has an invalid length. [ 282.255058][ T30] audit: type=1107 audit(1753898642.557:4): pid=11881 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=' [ 282.255058][ T30] 9h", #TU1]lbt/N>l-1=}Zǵ8>Fd|f~Pl)Z5ddQnb㎿,}aW1c,ۘ-1 rejected, already enabled [ 286.086042][T12069] tipc: Enabling of bearer rejected, already enabled [ 286.161265][T12069] veth1_to_hsr: mtu less than device minimum [ 286.342787][T12094] syzkaller0: left promiscuous mode [ 286.348324][T12094] syzkaller0: left allmulticast mode [ 286.760481][T12107] netlink: 'syz.3.1639': attribute type 5 has an invalid length. [ 286.816087][T12113] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 286.924386][T12119] netlink: 'syz.3.1639': attribute type 13 has an invalid length. [ 286.968884][T12119] netlink: 'syz.3.1639': attribute type 17 has an invalid length. [ 287.056225][T12119] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 287.259695][T12127] netlink: 'syz.0.1643': attribute type 16 has an invalid length. [ 287.282243][T12127] netlink: 'syz.0.1643': attribute type 13 has an invalid length. [ 287.488085][T12145] vxcan1 speed is unknown, defaulting to 1000 [ 287.849969][T12168] bpq0: entered promiscuous mode [ 288.165686][ T1531] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 288.179170][ T1531] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 288.309673][T12179] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 288.359894][T12159] vxcan1 speed is unknown, defaulting to 1000 [ 288.551806][T12197] netlink: 'syz.1.1661': attribute type 10 has an invalid length. [ 288.559817][T12197] __nla_validate_parse: 17 callbacks suppressed [ 288.559835][T12197] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1661'. [ 288.652081][T12197] batadv0: entered promiscuous mode [ 288.657400][T12197] batadv0: entered allmulticast mode [ 288.697415][T12197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 288.723533][T12197] bridge0: port 3(batadv0) entered blocking state [ 288.730288][T12197] bridge0: port 3(batadv0) entered disabled state [ 288.808842][T12191] vxcan1 speed is unknown, defaulting to 1000 [ 289.127231][T12219] syzkaller1: entered promiscuous mode [ 289.133054][T12219] syzkaller1: entered allmulticast mode [ 289.258671][ T60] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 289.268883][ T60] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 289.419120][T12234] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1670'. [ 290.015666][T12258] netlink: 'syz.0.1679': attribute type 1 has an invalid length. [ 290.062415][T12258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 290.331913][T12261] bond0: (slave veth3): Enslaving as an active interface with a down link [ 290.383619][T12255] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 290.596569][T12278] netlink: 244 bytes leftover after parsing attributes in process `syz.3.1685'. [ 290.607880][T12278] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1685'. [ 290.617270][T12278] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1685'. [ 291.029593][T12301] netlink: 'syz.0.1693': attribute type 1 has an invalid length. [ 291.100215][T12301] 8021q: adding VLAN 0 to HW filter on device bond3 [ 291.380823][T12316] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 291.417284][T12316] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 291.428604][T12316] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 291.564914][T12322] vxcan1 speed is unknown, defaulting to 1000 [ 291.635506][T12324] bridge4: entered promiscuous mode [ 291.640741][T12324] bridge4: entered allmulticast mode [ 292.029744][T12337] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1703'. [ 292.148212][T12340] netlink: 'syz.0.1701': attribute type 4 has an invalid length. [ 292.409076][T12345] netlink: 25 bytes leftover after parsing attributes in process `syz.4.1705'. [ 292.569312][T12354] syzkaller0: entered promiscuous mode [ 292.581797][T12354] syzkaller0: entered allmulticast mode [ 292.608339][T12363] netlink: 'syz.4.1710': attribute type 11 has an invalid length. [ 292.625640][T12363] netlink: 'syz.4.1710': attribute type 12 has an invalid length. [ 292.660175][T12363] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1710'. [ 294.273352][T12377] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1714'. [ 294.290885][T12379] FAULT_INJECTION: forcing a failure. [ 294.290885][T12379] name failslab, interval 1, probability 0, space 0, times 0 [ 294.291688][T12376] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1714'. [ 294.340558][T12379] CPU: 0 UID: 0 PID: 12379 Comm: syz.2.1712 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 294.340589][T12379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 294.340600][T12379] Call Trace: [ 294.340607][T12379] [ 294.340616][T12379] dump_stack_lvl+0x189/0x250 [ 294.340643][T12379] ? __pfx____ratelimit+0x10/0x10 [ 294.340680][T12379] ? __pfx_dump_stack_lvl+0x10/0x10 [ 294.340700][T12379] ? __pfx__printk+0x10/0x10 [ 294.340727][T12379] ? __pfx___might_resched+0x10/0x10 [ 294.340751][T12379] should_fail_ex+0x414/0x560 [ 294.340782][T12379] should_failslab+0xa8/0x100 [ 294.340807][T12379] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 294.340830][T12379] ? __alloc_skb+0x112/0x2d0 [ 294.340853][T12379] __alloc_skb+0x112/0x2d0 [ 294.340875][T12379] netlink_sendmsg+0x5c6/0xb30 [ 294.340905][T12379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 294.340925][T12379] ? aa_sock_msg_perm+0x94/0x160 [ 294.340945][T12379] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 294.340962][T12379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 294.340981][T12379] __sock_sendmsg+0x219/0x270 [ 294.341009][T12379] ____sys_sendmsg+0x52d/0x830 [ 294.341036][T12379] ? __pfx_____sys_sendmsg+0x10/0x10 [ 294.341066][T12379] ? import_iovec+0x74/0xa0 [ 294.341093][T12379] ___sys_sendmsg+0x21f/0x2a0 [ 294.341116][T12379] ? __pfx____sys_sendmsg+0x10/0x10 [ 294.341168][T12379] ? __fget_files+0x2a/0x420 [ 294.341190][T12379] ? __fget_files+0x3a0/0x420 [ 294.341223][T12379] __sys_sendmmsg+0x227/0x430 [ 294.341250][T12379] ? __pfx___sys_sendmmsg+0x10/0x10 [ 294.341268][T12379] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 294.341311][T12379] ? ksys_write+0x22a/0x250 [ 294.341336][T12379] ? __pfx_ksys_write+0x10/0x10 [ 294.341354][T12379] ? rcu_is_watching+0x15/0xb0 [ 294.341379][T12379] __x64_sys_sendmmsg+0xa0/0xc0 [ 294.341402][T12379] do_syscall_64+0xfa/0x3b0 [ 294.341419][T12379] ? lockdep_hardirqs_on+0x9c/0x150 [ 294.341436][T12379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 294.341453][T12379] ? clear_bhb_loop+0x60/0xb0 [ 294.341474][T12379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 294.341490][T12379] RIP: 0033:0x7f2b5df8e9a9 [ 294.341507][T12379] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 294.341522][T12379] RSP: 002b:00007f2b5edc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 294.341542][T12379] RAX: ffffffffffffffda RBX: 00007f2b5e1b5fa0 RCX: 00007f2b5df8e9a9 [ 294.341555][T12379] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 294.341567][T12379] RBP: 00007f2b5edc4090 R08: 0000000000000000 R09: 0000000000000000 [ 294.341578][T12379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 294.341589][T12379] R13: 0000000000000000 R14: 00007f2b5e1b5fa0 R15: 00007ffde9dd6e68 [ 294.341619][T12379] [ 294.343350][T12381] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 294.615644][T12393] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1716'. [ 294.670807][T12387] netlink: 184 bytes leftover after parsing attributes in process `syz.0.1716'. [ 294.807477][T12403] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1720'. [ 294.817724][T12403] netlink: 'syz.4.1720': attribute type 6 has an invalid length. [ 294.827281][T12403] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1720'. [ 295.060888][T12413] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1721'. [ 295.301648][T12433] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1728'. [ 295.839124][T12438] netlink: 'syz.0.1729': attribute type 1 has an invalid length. [ 295.953705][T12443] tipc: Enabling of bearer rejected, already enabled [ 295.969984][T12443] syzkaller0: entered promiscuous mode [ 295.976055][T12443] syzkaller0: entered allmulticast mode [ 296.005497][T12443] netlink: 'syz.2.1730': attribute type 3 has an invalid length. [ 296.170299][T12462] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1735'. [ 296.239487][T12464] netlink: 'syz.3.1734': attribute type 15 has an invalid length. [ 296.286460][T12462] trusted_key: syz.2.1735 sent an empty control message without MSG_MORE. [ 296.295827][T12464] netlink: 666 bytes leftover after parsing attributes in process `syz.3.1734'. [ 296.356965][T12467] netlink: 'syz.0.1736': attribute type 2 has an invalid length. [ 296.532451][T12482] netlink: 'syz.3.1734': attribute type 22 has an invalid length. [ 296.751488][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 296.980060][T12505] 8021q: adding VLAN 0 to HW filter on device bond0 [ 297.044918][T12505] bond0: (slave rose0): Enslaving as an active interface with an up link [ 297.246140][T12509] A link change request failed with some changes committed already. Interface 0! may have been left with an inconsistent configuration, please check. [ 297.372931][T12528] lo speed is unknown, defaulting to 1000 [ 297.390633][T12505] sctp: [Deprecated]: syz.1.1747 (pid 12505) Use of struct sctp_assoc_value in delayed_ack socket option. [ 297.390633][T12505] Use struct sctp_sack_info instead [ 297.413961][T12533] vxcan1 speed is unknown, defaulting to 1000 [ 297.431277][T12528] lo speed is unknown, defaulting to 1000 [ 297.447844][T12528] lo speed is unknown, defaulting to 1000 [ 298.015530][T12528] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 298.090287][T12528] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 298.229685][T12528] lo speed is unknown, defaulting to 1000 [ 298.382779][T12528] lo speed is unknown, defaulting to 1000 [ 298.390569][T12528] lo speed is unknown, defaulting to 1000 [ 298.403291][T12528] lo speed is unknown, defaulting to 1000 [ 298.410918][T12528] lo speed is unknown, defaulting to 1000 [ 298.443827][T12528] lo speed is unknown, defaulting to 1000 [ 298.481804][T12569] sctp: [Deprecated]: syz.3.1758 (pid 12569) Use of int in max_burst socket option. [ 298.481804][T12569] Use struct sctp_assoc_value instead [ 299.203464][T12596] netlink: 'syz.2.1765': attribute type 6 has an invalid length. [ 299.217109][T12596] netlink: 'syz.2.1765': attribute type 6 has an invalid length. [ 299.384357][T12603] netlink: 'syz.4.1767': attribute type 5 has an invalid length. [ 299.508213][T12603] vxcan1 speed is unknown, defaulting to 1000 [ 299.519501][T12609] __nla_validate_parse: 7 callbacks suppressed [ 299.519520][T12609] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1769'. [ 299.535112][T12609] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1769'. [ 299.629671][T12616] netlink: 'syz.2.1771': attribute type 1 has an invalid length. [ 299.743157][T12616] 8021q: adding VLAN 0 to HW filter on device bond6 [ 299.964104][T12631] veth9: entered promiscuous mode [ 299.986308][T12631] bond6: (slave veth9): Enslaving as an active interface with a down link [ 300.127945][T12642] netlink: 'syz.2.1771': attribute type 11 has an invalid length. [ 300.182777][T12616] erspan0: entered allmulticast mode [ 300.809927][T12665] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1777'. [ 300.826087][T12663] bond0: entered promiscuous mode [ 300.834341][T12663] bond_slave_0: entered promiscuous mode [ 300.840243][T12663] bond_slave_1: entered promiscuous mode [ 300.896464][T12663] bond0: left promiscuous mode [ 300.911616][T12663] bond_slave_0: left promiscuous mode [ 300.919007][T12663] bond_slave_1: left promiscuous mode [ 300.985193][T12670] (unnamed net_device) (uninitialized): option ad_select: invalid value (34) [ 301.011269][T12603] lo speed is unknown, defaulting to 1000 [ 301.064906][T12675] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 301.317998][T12677] tipc: Failed to remove unknown binding: 66,1,1/871640792:2632354634/2632354635 [ 301.383031][T12680] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 301.550601][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 301.565921][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 301.682404][T12686] vxcan1 speed is unknown, defaulting to 1000 [ 301.689165][T12684] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 301.720748][T12684] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1784'. [ 301.752247][T12684] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1784'. [ 301.764353][T12684] Couldn't find request waiting for DGID: 0000:0000:0000:0000:0000:0000:0000:0000 [ 301.950737][T12686] lo speed is unknown, defaulting to 1000 [ 302.513050][ T12] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 302.534826][ T12] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 302.592344][ T12] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 302.604653][ T12] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 302.734743][T12735] tipc: Enabling of bearer rejected, already enabled [ 302.777677][T12729] IPVS: Unknown mcast interface: veth0_vlan [ 302.803080][T12740] netlink: 'syz.0.1796': attribute type 4 has an invalid length. [ 302.997044][T12745] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1797'. [ 303.017220][T12745] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1797'. [ 303.035964][T12745] netlink: 'syz.1.1797': attribute type 19 has an invalid length. [ 303.224079][T12744] vxcan1 speed is unknown, defaulting to 1000 [ 303.298248][T12768] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1804'. [ 303.324973][T12768] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1804'. [ 303.455934][T12726] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 303.938550][T12744] lo speed is unknown, defaulting to 1000 [ 304.385589][T12833] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1819'. [ 304.487663][T12833] vlan0: entered promiscuous mode [ 304.535021][T12833] gretap0: entered promiscuous mode [ 304.833151][ T5851] Bluetooth: hci2: command 0x0406 tx timeout [ 305.152059][T12862] __nla_validate_parse: 1 callbacks suppressed [ 305.152077][T12862] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1828'. [ 305.435158][T12869] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 305.772202][ T49] nci: nci_ntf_packet: unknown ntf opcode 0x127 [ 306.037527][T12924] vxcan1 speed is unknown, defaulting to 1000 [ 306.341478][T12929] vxcan1 speed is unknown, defaulting to 1000 [ 306.348759][T12924] lo speed is unknown, defaulting to 1000 [ 306.489958][T12895] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 307.005336][T12929] lo speed is unknown, defaulting to 1000 [ 307.013019][T12956] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1850'. [ 307.178321][T12964] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1852'. [ 307.286169][T12963] syzkaller1: entered promiscuous mode [ 307.295934][T12963] syzkaller1: entered allmulticast mode [ 307.456730][T12972] vxcan1 speed is unknown, defaulting to 1000 [ 307.671034][T12980] netlink: 'syz.2.1857': attribute type 4 has an invalid length. [ 307.721781][T12982] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1858'. [ 307.731583][T12983] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1858'. [ 308.004001][T12989] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1861'. [ 308.262665][T12972] lo speed is unknown, defaulting to 1000 [ 308.638333][T13023] netlink: 3 bytes leftover after parsing attributes in process `syz.2.1865'. [ 308.996634][T13036] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1870'. [ 309.008269][T13015] bond0 (unregistering): Released all slaves [ 309.088670][T13023] bridge0: port 1(bond0) entered blocking state [ 309.115367][T13023] bridge0: port 1(bond0) entered disabled state [ 309.125179][T13023] bond0: entered allmulticast mode [ 309.133350][T13023] bond0: entered promiscuous mode [ 309.319804][T13044] bridge5: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 309.514249][T13044] batadv_slave_0: entered promiscuous mode [ 309.747091][T13062] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1877'. [ 309.790796][T13062] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1877'. [ 309.929747][T13069] vxcan1 speed is unknown, defaulting to 1000 [ 309.974223][T13076] netlink: 'syz.4.1883': attribute type 1 has an invalid length. [ 310.153985][T13080] bond0: (slave gretap3): making interface the new active one [ 310.164813][T13086] netlink: 'syz.4.1883': attribute type 10 has an invalid length. [ 310.174948][T13080] bond0: (slave gretap3): Enslaving as an active interface with an up link [ 310.212466][T13076] veth0_virt_wifi: entered promiscuous mode [ 310.236630][T13076] macsec1: entered promiscuous mode [ 310.245450][T13076] macsec1: entered allmulticast mode [ 310.251059][T13076] veth0_virt_wifi: entered allmulticast mode [ 310.664358][T13076] veth0_virt_wifi: left allmulticast mode [ 310.670392][T13076] veth0_virt_wifi: left promiscuous mode [ 310.778819][T13069] lo speed is unknown, defaulting to 1000 [ 310.845432][T13096] FAULT_INJECTION: forcing a failure. [ 310.845432][T13096] name failslab, interval 1, probability 0, space 0, times 0 [ 310.903512][T13096] CPU: 0 UID: 0 PID: 13096 Comm: syz.3.1886 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 310.903541][T13096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 310.903552][T13096] Call Trace: [ 310.903566][T13096] [ 310.903574][T13096] dump_stack_lvl+0x189/0x250 [ 310.903597][T13096] ? __pfx____ratelimit+0x10/0x10 [ 310.903623][T13096] ? __pfx_dump_stack_lvl+0x10/0x10 [ 310.903642][T13096] ? __pfx__printk+0x10/0x10 [ 310.903671][T13096] ? __pfx___might_resched+0x10/0x10 [ 310.903688][T13096] ? fs_reclaim_acquire+0x7d/0x100 [ 310.903718][T13096] should_fail_ex+0x414/0x560 [ 310.903749][T13096] should_failslab+0xa8/0x100 [ 310.903774][T13096] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 310.903796][T13096] ? __alloc_skb+0x112/0x2d0 [ 310.903819][T13096] __alloc_skb+0x112/0x2d0 [ 310.903841][T13096] netlink_ack+0x146/0xa50 [ 310.903858][T13096] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 310.903874][T13096] ? ref_tracker_free+0x63a/0x7d0 [ 310.903894][T13096] ? __asan_memcpy+0x40/0x70 [ 310.903911][T13096] ? __pfx_ref_tracker_free+0x10/0x10 [ 310.903938][T13096] netlink_rcv_skb+0x28c/0x470 [ 310.903956][T13096] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 310.903975][T13096] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 310.904005][T13096] ? netlink_deliver_tap+0x2e/0x1b0 [ 310.904031][T13096] netlink_unicast+0x82f/0x9e0 [ 310.904066][T13096] ? __pfx_netlink_unicast+0x10/0x10 [ 310.904093][T13096] ? netlink_sendmsg+0x642/0xb30 [ 310.904109][T13096] ? skb_put+0x11b/0x210 [ 310.904131][T13096] netlink_sendmsg+0x805/0xb30 [ 310.904160][T13096] ? __pfx_netlink_sendmsg+0x10/0x10 [ 310.904182][T13096] ? aa_sock_msg_perm+0x94/0x160 [ 310.904201][T13096] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 310.904219][T13096] ? __pfx_netlink_sendmsg+0x10/0x10 [ 310.904238][T13096] __sock_sendmsg+0x219/0x270 [ 310.904266][T13096] ____sys_sendmsg+0x52d/0x830 [ 310.904294][T13096] ? __pfx_____sys_sendmsg+0x10/0x10 [ 310.904324][T13096] ? import_iovec+0x74/0xa0 [ 310.904351][T13096] ___sys_sendmsg+0x21f/0x2a0 [ 310.904374][T13096] ? __pfx____sys_sendmsg+0x10/0x10 [ 310.904451][T13096] ? __fget_files+0x2a/0x420 [ 310.904473][T13096] ? __fget_files+0x3a0/0x420 [ 310.904507][T13096] __sys_sendmmsg+0x227/0x430 [ 310.904534][T13096] ? __pfx___sys_sendmmsg+0x10/0x10 [ 310.904552][T13096] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 310.904606][T13096] ? ksys_write+0x22a/0x250 [ 310.904630][T13096] ? __pfx_ksys_write+0x10/0x10 [ 310.904648][T13096] ? rcu_is_watching+0x15/0xb0 [ 310.904675][T13096] __x64_sys_sendmmsg+0xa0/0xc0 [ 310.904698][T13096] do_syscall_64+0xfa/0x3b0 [ 310.904715][T13096] ? lockdep_hardirqs_on+0x9c/0x150 [ 310.904731][T13096] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.904748][T13096] ? clear_bhb_loop+0x60/0xb0 [ 310.904770][T13096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.904786][T13096] RIP: 0033:0x7f2df2b8e9a9 [ 310.904803][T13096] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 310.904818][T13096] RSP: 002b:00007f2df394c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 310.904839][T13096] RAX: ffffffffffffffda RBX: 00007f2df2db6080 RCX: 00007f2df2b8e9a9 [ 310.904853][T13096] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 310.904865][T13096] RBP: 00007f2df394c090 R08: 0000000000000000 R09: 0000000000000000 [ 310.904876][T13096] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 310.904887][T13096] R13: 0000000000000000 R14: 00007f2df2db6080 R15: 00007ffeafc5ce38 [ 310.904918][T13096] [ 311.407032][T13110] batadv_slave_1: entered promiscuous mode [ 311.486496][T13113] batadv_slave_0: entered allmulticast mode [ 311.574903][T13113] dvmrp8: entered allmulticast mode [ 311.648810][T13116] dvmrp1: entered allmulticast mode [ 311.655533][T13107] batadv_slave_1: left promiscuous mode [ 311.667121][T13113] dvmrp1: left allmulticast mode [ 311.830925][T13121] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.926005][T13121] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.057382][T13121] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.165391][T13121] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.208654][T13135] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 312.260129][T13134] 8021q: adding VLAN 0 to HW filter on device bond4 [ 312.268785][T13134] bridge0: port 3(bond4) entered blocking state [ 312.275627][T13134] bridge0: port 3(bond4) entered disabled state [ 312.282242][T13134] bond4: entered allmulticast mode [ 312.292888][T13134] bond4: entered promiscuous mode [ 312.300303][T13106] batadv_slave_0: left allmulticast mode [ 312.376867][T13134] __nla_validate_parse: 1 callbacks suppressed [ 312.376886][T13134] netlink: 212 bytes leftover after parsing attributes in process `syz.0.1895'. [ 312.480205][ T49] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.522127][ T49] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.544357][T13144] bpq0: left promiscuous mode [ 312.619190][ T49] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.703922][T13143] vxcan1 speed is unknown, defaulting to 1000 [ 312.732306][T13161] FAULT_INJECTION: forcing a failure. [ 312.732306][T13161] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 312.746935][ T49] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.787459][T13161] CPU: 1 UID: 0 PID: 13161 Comm: syz.2.1901 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 312.787492][T13161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 312.787503][T13161] Call Trace: [ 312.787511][T13161] [ 312.787520][T13161] dump_stack_lvl+0x189/0x250 [ 312.787545][T13161] ? __pfx____ratelimit+0x10/0x10 [ 312.787570][T13161] ? __pfx_dump_stack_lvl+0x10/0x10 [ 312.787587][T13161] ? __pfx__printk+0x10/0x10 [ 312.787623][T13161] should_fail_ex+0x414/0x560 [ 312.787654][T13161] _copy_to_user+0x31/0xb0 [ 312.787679][T13161] simple_read_from_buffer+0xe1/0x170 [ 312.787708][T13161] proc_fail_nth_read+0x1df/0x250 [ 312.787737][T13161] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 312.787764][T13161] ? rw_verify_area+0x258/0x650 [ 312.787784][T13161] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 312.787810][T13161] vfs_read+0x200/0x980 [ 312.787838][T13161] ? __pfx___mutex_lock+0x10/0x10 [ 312.787857][T13161] ? __pfx_vfs_read+0x10/0x10 [ 312.787879][T13161] ? __fget_files+0x2a/0x420 [ 312.787906][T13161] ? __fget_files+0x3a0/0x420 [ 312.787928][T13161] ? __fget_files+0x2a/0x420 [ 312.787960][T13161] ksys_read+0x145/0x250 [ 312.787983][T13161] ? __pfx_ksys_read+0x10/0x10 [ 312.788001][T13161] ? rcu_is_watching+0x15/0xb0 [ 312.788024][T13161] ? do_syscall_64+0xbe/0x3b0 [ 312.788044][T13161] do_syscall_64+0xfa/0x3b0 [ 312.788059][T13161] ? lockdep_hardirqs_on+0x9c/0x150 [ 312.788074][T13161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 312.788088][T13161] ? clear_bhb_loop+0x60/0xb0 [ 312.788109][T13161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 312.788122][T13161] RIP: 0033:0x7f2b5df8d3bc [ 312.788138][T13161] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 312.788151][T13161] RSP: 002b:00007f2b5edc4030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 312.788170][T13161] RAX: ffffffffffffffda RBX: 00007f2b5e1b5fa0 RCX: 00007f2b5df8d3bc [ 312.788182][T13161] RDX: 000000000000000f RSI: 00007f2b5edc40a0 RDI: 0000000000000005 [ 312.788192][T13161] RBP: 00007f2b5edc4090 R08: 0000000000000000 R09: 0000000000000000 [ 312.788202][T13161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 312.788211][T13161] R13: 0000000000000000 R14: 00007f2b5e1b5fa0 R15: 00007ffde9dd6e68 [ 312.788242][T13161] [ 313.380664][T13175] sctp: [Deprecated]: syz.2.1905 (pid 13175) Use of struct sctp_assoc_value in delayed_ack socket option. [ 313.380664][T13175] Use struct sctp_sack_info instead [ 313.414684][T13179] sctp: [Deprecated]: syz.2.1905 (pid 13179) Use of struct sctp_assoc_value in delayed_ack socket option. [ 313.414684][T13179] Use struct sctp_sack_info instead [ 313.437620][T13181] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 313.877238][T13143] lo speed is unknown, defaulting to 1000 [ 314.041748][T13218] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1912'. [ 315.461564][T13249] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1919'. [ 315.691855][T13249] bond6: (slave veth9): Releasing active interface [ 315.777079][T13249] bond0: left allmulticast mode [ 315.782787][T13249] bond0: left promiscuous mode [ 315.788009][T13249] bridge0: port 1(bond0) entered disabled state [ 315.882355][T13261] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1922'. [ 315.918831][T13258] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1921'. [ 316.021555][T13263] vxcan1 speed is unknown, defaulting to 1000 [ 316.188554][T13275] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1927'. [ 316.220758][T13275] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1927'. [ 316.950068][T13308] IPVS: set_ctl: invalid protocol: 136 172.20.20.170:20002 [ 316.960573][T13263] lo speed is unknown, defaulting to 1000 [ 316.990094][T13310] syzkaller1: entered promiscuous mode [ 317.002262][T13310] syzkaller1: entered allmulticast mode [ 317.173990][T13317] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1936'. [ 317.414773][T13333] bpq0: entered promiscuous mode [ 317.431649][T13333] bpq0: entered allmulticast mode [ 317.907073][T13326] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1938'. [ 317.980044][T13345] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1938'. [ 318.142490][T13354] netlink: 'syz.2.1944': attribute type 1 has an invalid length. [ 318.238673][T13354] bond7: entered promiscuous mode [ 318.282059][T13354] 8021q: adding VLAN 0 to HW filter on device bond7 [ 318.344648][T13354] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 318.352059][T13354] IPv6: NLM_F_CREATE should be set when creating new route [ 318.359426][T13354] IPv6: NLM_F_CREATE should be set when creating new route [ 318.395427][T13354] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 318.419924][T13357] 8021q: adding VLAN 0 to HW filter on device bond7 [ 318.427519][T13357] bond7: (slave wireguard0): The slave device specified does not support setting the MAC address [ 318.439196][T13357] bond7: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 318.456269][T13357] bond7: (slave wireguard0): making interface the new active one [ 318.465116][T13357] wireguard0: entered promiscuous mode [ 318.473619][T13357] bond7: (slave wireguard0): Enslaving as an active interface with an up link [ 318.550745][T13354] bond7: (slave wireguard1): The slave device specified does not support setting the MAC address [ 318.607385][T13354] bond7: (slave wireguard1): Enslaving as a backup interface with an up link [ 318.723814][T13379] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 319.056002][T13401] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1954'. [ 319.099156][T13401] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1954'. [ 319.137929][T13401] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1954'. [ 319.183523][T13410] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1958'. [ 319.292982][T13401] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1954'. [ 319.324872][T13401] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1954'. [ 319.538264][T13431] vxcan1 speed is unknown, defaulting to 1000 [ 319.538297][T13433] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1962'. [ 319.620984][T13437] netlink: 47 bytes leftover after parsing attributes in process `syz.2.1963'. [ 319.758047][T13446] netlink: 'syz.3.1964': attribute type 30 has an invalid length. [ 319.776961][T13446] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 319.922809][T13431] lo speed is unknown, defaulting to 1000 [ 320.227499][T13453] veth0_to_hsr: entered promiscuous mode [ 320.262026][T13453] veth0_to_hsr: left promiscuous mode [ 320.469553][T13466] syzkaller0: entered promiscuous mode [ 320.475151][T13466] syzkaller0: entered allmulticast mode [ 320.513890][T13470] smc: ib device syz1 ibport 1 applied user defined pnetid SYZ1 [ 320.929559][T13492] bond0: option mode: unable to set because the bond device has slaves [ 321.106329][T13489] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 321.984933][T13534] netlink: 'syz.1.1991': attribute type 12 has an invalid length. [ 322.115444][T13546] netlink: 'syz.2.1993': attribute type 5 has an invalid length. [ 322.170185][T13551] netlink: 'syz.2.1993': attribute type 5 has an invalid length. [ 322.248860][T13559] netlink: 'syz.0.1995': attribute type 10 has an invalid length. [ 322.275725][ T3079] ------------[ cut here ]------------ [ 322.281812][ T3079] RTNL: assertion failed at ./include/net/netdev_lock.h (72) [ 322.316870][ T3079] WARNING: CPU: 0 PID: 3079 at ./include/net/netdev_lock.h:72 __linkwatch_sync_dev+0x303/0x350 [ 322.327985][ T3079] Modules linked in: [ 322.333283][ T3079] CPU: 0 UID: 0 PID: 3079 Comm: kworker/u8:6 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 322.346363][ T3079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 322.359436][ T3079] Workqueue: bond0 bond_mii_monitor [ 322.365353][ T3079] RIP: 0010:__linkwatch_sync_dev+0x303/0x350 [ 322.372058][ T3079] Code: 7c fe ff ff e8 9e f9 60 f8 c6 05 66 bb 2c 06 01 90 48 c7 c7 60 a7 93 8c 48 c7 c6 56 17 9e 8d ba 48 00 00 00 e8 8e e7 24 f8 90 <0f> 0b 90 90 e9 4d fe ff ff 44 89 f1 80 e1 07 38 c1 0f 8c 22 fd ff [ 322.393073][ T3079] RSP: 0018:ffffc9000ba87670 EFLAGS: 00010246 [ 322.399351][ T3079] RAX: fe874133a1e8cb00 RBX: ffff888024eee000 RCX: ffff88802fbb8000 [ 322.408128][ T3079] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 322.416664][ T3079] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 322.425374][ T3079] R10: dffffc0000000000 R11: fffffbfff1bfaa6c R12: 1ffff110049ddc5d [ 322.434171][ T3079] R13: dffffc0000000000 R14: ffffffff8c1c5e08 R15: 0000000000000000 [ 322.442696][ T3079] FS: 0000000000000000(0000) GS:ffff888125c23000(0000) knlGS:0000000000000000 [ 322.452345][ T3079] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 322.458958][ T3079] CR2: 0000559555810008 CR3: 00000000764ec000 CR4: 00000000003526f0 [ 322.467537][ T3079] Call Trace: [ 322.470841][ T3079] [ 322.474398][ T3079] ? ethtool_op_get_link+0xd/0x70 [ 322.479456][ T3079] ethtool_op_get_link+0x15/0x70 [ 322.484979][ T3079] bond_check_dev_link+0x444/0x6c0 [ 322.490123][ T3079] ? __pfx_bond_check_dev_link+0x10/0x10 [ 322.496336][ T3079] ? netdev_lower_get_next_private_rcu+0x9f/0x100 [ 322.503471][ T3079] bond_mii_monitor+0x428/0x2e00 [ 322.508538][ T3079] ? bond_mii_monitor+0x153/0x2e00 [ 322.514268][ T3079] ? __lock_acquire+0xab9/0xd20 [ 322.519248][ T3079] ? __pfx_bond_mii_monitor+0x10/0x10 [ 322.525204][ T3079] ? register_lock_class+0x51/0x320 [ 322.530489][ T3079] ? __lock_acquire+0xab9/0xd20 [ 322.535975][ T3079] ? process_scheduled_works+0x9ef/0x17b0 [ 322.542391][ T3079] ? _raw_spin_unlock_irq+0x23/0x50 [ 322.547639][ T3079] ? process_scheduled_works+0x9ef/0x17b0 [ 322.553969][ T3079] ? process_scheduled_works+0x9ef/0x17b0 [ 322.559822][ T3079] process_scheduled_works+0xae1/0x17b0 [ 322.565947][ T3079] ? __pfx_process_scheduled_works+0x10/0x10 [ 322.572242][ T3079] worker_thread+0x8a0/0xda0 [ 322.577046][ T3079] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 322.583467][ T3079] ? __kthread_parkme+0x7b/0x200 [ 322.588526][ T3079] kthread+0x70e/0x8a0 [ 322.592829][ T3079] ? __pfx_worker_thread+0x10/0x10 [ 322.598053][ T3079] ? __pfx_kthread+0x10/0x10 [ 322.603354][ T3079] ? _raw_spin_unlock_irq+0x23/0x50 [ 322.608592][ T3079] ? lockdep_hardirqs_on+0x9c/0x150 [ 322.614190][ T3079] ? __pfx_kthread+0x10/0x10 [ 322.618895][ T3079] ret_from_fork+0x3fc/0x770 [ 322.623859][ T3079] ? __pfx_ret_from_fork+0x10/0x10 [ 322.629080][ T3079] ? __switch_to_asm+0x39/0x70 [ 322.634470][ T3079] ? __switch_to_asm+0x33/0x70 [ 322.639250][ T3079] ? __pfx_kthread+0x10/0x10 [ 322.644241][ T3079] ret_from_fork_asm+0x1a/0x30 [ 322.649030][ T3079] [ 322.652658][ T3079] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 322.659990][ T3079] CPU: 0 UID: 0 PID: 3079 Comm: kworker/u8:6 Not tainted 6.16.0-rc7-syzkaller-02024-gfa582ca7e187 #0 PREEMPT(full) [ 322.672235][ T3079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 322.682304][ T3079] Workqueue: bond0 bond_mii_monitor [ 322.687512][ T3079] Call Trace: [ 322.690782][ T3079] [ 322.693773][ T3079] dump_stack_lvl+0x99/0x250 [ 322.698427][ T3079] ? __asan_memcpy+0x40/0x70 [ 322.703086][ T3079] ? __pfx_dump_stack_lvl+0x10/0x10 [ 322.708307][ T3079] ? __pfx__printk+0x10/0x10 [ 322.713019][ T3079] panic+0x2db/0x790 [ 322.717027][ T3079] ? __pfx_panic+0x10/0x10 [ 322.721450][ T3079] ? ret_from_fork_asm+0x1a/0x30 [ 322.726388][ T3079] __warn+0x31b/0x4b0 [ 322.730453][ T3079] ? __linkwatch_sync_dev+0x303/0x350 [ 322.735916][ T3079] ? __linkwatch_sync_dev+0x303/0x350 [ 322.741317][ T3079] report_bug+0x2be/0x4f0 [ 322.745661][ T3079] ? __linkwatch_sync_dev+0x303/0x350 [ 322.751114][ T3079] ? __linkwatch_sync_dev+0x303/0x350 [ 322.756478][ T3079] ? __linkwatch_sync_dev+0x305/0x350 [ 322.761847][ T3079] handle_bug+0x84/0x160 [ 322.766117][ T3079] exc_invalid_op+0x1a/0x50 [ 322.770969][ T3079] asm_exc_invalid_op+0x1a/0x20 [ 322.775898][ T3079] RIP: 0010:__linkwatch_sync_dev+0x303/0x350 [ 322.781890][ T3079] Code: 7c fe ff ff e8 9e f9 60 f8 c6 05 66 bb 2c 06 01 90 48 c7 c7 60 a7 93 8c 48 c7 c6 56 17 9e 8d ba 48 00 00 00 e8 8e e7 24 f8 90 <0f> 0b 90 90 e9 4d fe ff ff 44 89 f1 80 e1 07 38 c1 0f 8c 22 fd ff [ 322.801592][ T3079] RSP: 0018:ffffc9000ba87670 EFLAGS: 00010246 [ 322.807661][ T3079] RAX: fe874133a1e8cb00 RBX: ffff888024eee000 RCX: ffff88802fbb8000 [ 322.815722][ T3079] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 322.823697][ T3079] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 322.831672][ T3079] R10: dffffc0000000000 R11: fffffbfff1bfaa6c R12: 1ffff110049ddc5d [ 322.839646][ T3079] R13: dffffc0000000000 R14: ffffffff8c1c5e08 R15: 0000000000000000 [ 322.847641][ T3079] ? ethtool_op_get_link+0xd/0x70 [ 322.852675][ T3079] ethtool_op_get_link+0x15/0x70 [ 322.857624][ T3079] bond_check_dev_link+0x444/0x6c0 [ 322.862840][ T3079] ? __pfx_bond_check_dev_link+0x10/0x10 [ 322.868477][ T3079] ? netdev_lower_get_next_private_rcu+0x9f/0x100 [ 322.874883][ T3079] bond_mii_monitor+0x428/0x2e00 [ 322.879829][ T3079] ? bond_mii_monitor+0x153/0x2e00 [ 322.884936][ T3079] ? __lock_acquire+0xab9/0xd20 [ 322.889899][ T3079] ? __pfx_bond_mii_monitor+0x10/0x10 [ 322.895257][ T3079] ? register_lock_class+0x51/0x320 [ 322.900475][ T3079] ? __lock_acquire+0xab9/0xd20 [ 322.905348][ T3079] ? process_scheduled_works+0x9ef/0x17b0 [ 322.911057][ T3079] ? _raw_spin_unlock_irq+0x23/0x50 [ 322.916329][ T3079] ? process_scheduled_works+0x9ef/0x17b0 [ 322.922124][ T3079] ? process_scheduled_works+0x9ef/0x17b0 [ 322.927865][ T3079] process_scheduled_works+0xae1/0x17b0 [ 322.933536][ T3079] ? __pfx_process_scheduled_works+0x10/0x10 [ 322.939527][ T3079] worker_thread+0x8a0/0xda0 [ 322.944191][ T3079] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 322.950690][ T3079] ? __kthread_parkme+0x7b/0x200 [ 322.955626][ T3079] kthread+0x70e/0x8a0 [ 322.959699][ T3079] ? __pfx_worker_thread+0x10/0x10 [ 322.964825][ T3079] ? __pfx_kthread+0x10/0x10 [ 322.969427][ T3079] ? _raw_spin_unlock_irq+0x23/0x50 [ 322.974623][ T3079] ? lockdep_hardirqs_on+0x9c/0x150 [ 322.979825][ T3079] ? __pfx_kthread+0x10/0x10 [ 322.984432][ T3079] ret_from_fork+0x3fc/0x770 [ 322.989043][ T3079] ? __pfx_ret_from_fork+0x10/0x10 [ 322.994271][ T3079] ? __switch_to_asm+0x39/0x70 [ 322.999052][ T3079] ? __switch_to_asm+0x33/0x70 [ 323.003843][ T3079] ? __pfx_kthread+0x10/0x10 [ 323.008459][ T3079] ret_from_fork_asm+0x1a/0x30 [ 323.013270][ T3079] [ 323.016661][ T3079] Kernel Offset: disabled [ 323.021006][ T3079] Rebooting in 86400 seconds..