last executing test programs: 5.628028282s ago: executing program 4 (id=3742): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x0, 0x3, 0x1, 0x0, 0xc}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r1) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x44, r2, 0x1, 0x70bd2d, 0x0, {0x36}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x73}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040811}, 0x20042840) r3 = syz_init_net_socket$ax25(0x3, 0x3, 0xc4) ioctl$SIOCAX25DELFWD(r3, 0x89eb, &(0x7f0000000180)={@default, @bcast}) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0xfc, r2, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x80}, 0x440) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32, @ANYBLOB="0200"/19, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000003800250825bd7000f9dbdf250f000000100007800c00028008003400", @ANYRES32=0x0, @ANYBLOB="6456b1e93d91d4adfb12527469862cd2185f1f5a72bec82ee8c8570fc63d19305bbc678a49e6"], 0x24}, 0x1, 0x0, 0x0, 0x4050}, 0x804c050) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0x2}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x8, 0x2, [@TCA_MATCHALL_ACT={0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000300)={'vxcan1\x00'}) r7 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r7, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bind$tipc(r7, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x2, 0xffffffff}}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xc15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) socket$nl_netfilter(0x10, 0x3, 0xc) 5.272130783s ago: executing program 4 (id=3746): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a58000000060a010400000000000000000a0000010900010073797a31000000000900020073797a32000000002c0004802800018007000100637400001c000280080004400000000f0800024000000004"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x24040840) socket$inet6(0x2d, 0x806, 0x0) 5.022407317s ago: executing program 4 (id=3749): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0000}, 0x50) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe0400010000000008001300040001"], 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$TUNSETLINK(r2, 0x400454cd, 0x305) 4.418145945s ago: executing program 4 (id=3753): socket$inet(0x2, 0x2, 0x0) recvfrom$l2tp(0xffffffffffffffff, 0x0, 0x0, 0x40000142, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x200, 0x248, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000000)={0x0, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0x6, @local}, 0xfffffeab) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x10, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xfffffffe}, [@exit]}, &(0x7f0000000000)='GPL\x00', 0x1, 0x7d, &(0x7f0000000180)=""/125, 0x41000, 0x4}, 0x94) setsockopt$packet_add_memb(r1, 0x107, 0x2, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={r3}, 0x4) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1f1c000002060101000000000000000000000001000000000a000000090002008d001f106f194eb3050001"], 0x30}, 0x1, 0x0, 0x0, 0x40840}, 0x40) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001d0001000000000004086aa42d"], 0x30}}, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001c40)={0xffffffffffffffff, 0x20, &(0x7f0000001c00)={&(0x7f0000000b40)=""/4096, 0x1000, 0x0, &(0x7f0000001b40)=""/164, 0xa4}}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xb, 0x5, &(0x7f0000000340)=ANY=[@ANYRES64=r3], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, r5, 0x0}, 0x94) syz_init_net_socket$llc(0x1a, 0x2, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sendmsg$kcm(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371c00000069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}], 0x1}, 0x0) 3.719800556s ago: executing program 4 (id=3761): bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x4}, 0x6) r0 = socket(0x10, 0x2, 0x0) close(0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) socket$inet6_sctp(0xa, 0x1, 0x84) recvmmsg(r2, &(0x7f0000007700), 0x4000267, 0xfc0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x28, r5, 0x1, 0x0, 0x4, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TX_RATES={0xc, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10000010}, 0x4040004) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000440)=@gcm_256={{0x303}, '\x00', "352bfc0f38345beb42380beb8a9b6220f956db553fc75817f69b4e4047aaa9e1", '\x00', '\x00\x00\x00@\x00'}, 0x38) sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4000010) recvmmsg(r0, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x800448f0, &(0x7f0000000000)={0x0, 0x9, "be5f21", 0x8, 0x80}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newlink={0x3c, 0x10, 0x403, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x88afa5b4, 0x40}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x3}]}, 0x3c}}, 0x0) 3.422609174s ago: executing program 0 (id=3765): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0), 0x0) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0xfff8}, 0x1, 0x0, 0x0, 0x24040004}, 0x20040055) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000140)={0x10000042, 0x0, 0x2}, 0x10) r7 = socket(0x10, 0x3, 0x8000000) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r8, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) unshare(0x20000400) r12 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r12, 0xff, 0x1, 0x0, &(0x7f0000000040)=0xfffffffffffffed0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="440000001000030428bd78000000000000000000", @ANYRES32=0x0, @ANYBLOB="46060900000000001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r11], 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4400000010001fff080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="00000000084400001c0012800b00010067656e65766500000c000280050004000100000008000a00", @ANYRES32=r8, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) write$cgroup_subtree(r2, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000800)={0xffffffffffffffff, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x1, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0], 0x0, 0x97, &(0x7f0000000600)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000640), &(0x7f0000000680), 0x8, 0x78, 0x8, 0x8, &(0x7f00000006c0)}}, 0x10) 2.56983894s ago: executing program 2 (id=3766): socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r1, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}], 0x1}}], 0x1, 0x4000000) syz_emit_ethernet(0x4a, &(0x7f00000000c0)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "e2fa08", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0) sendmmsg$sock(r0, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000280)="f8", 0x1}], 0x1}}], 0x1, 0x40440d1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f00000002c0)=[{&(0x7f0000000300)="4800000014001d1009074beafd0d8c560a84606080ffe020590000a2bc5603ca00000f7f8907000020008d42188fedc22e47ad8f75edc6d100000101ff0000000309ff5b00000000", 0x48}], 0x1) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01400010000600000000067400062c00070073797352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000e6ff05000700263a3a0914000600626f6e64300000000000000001000000080003"], 0x78}, 0x1, 0xffffffff00000003}, 0x4) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="030f00000000000000000700000030000280080002000000000007000400"], 0x44}, 0x1, 0x0, 0x0, 0x4040c40}, 0x0) r7 = accept4$tipc(0xffffffffffffffff, &(0x7f00000000c0)=@id, &(0x7f0000000100)=0x10, 0x80000) bind$tipc(r7, 0x0, 0x0) 2.432382686s ago: executing program 1 (id=3767): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010000104000000000000000000000086", @ANYRES32=0x0, @ANYBLOB="21000000000000002c001280080001006774700020000280050005000000000014000800"/52], 0x4c}}, 0x40) 2.429374544s ago: executing program 0 (id=3768): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000001100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x80000) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40810) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001180)=""/4096, 0x1059}], 0x1}, 0x0) getsockopt$inet6_int(r3, 0x29, 0x19, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r6 = socket$key(0xf, 0x3, 0x2) syz_emit_ethernet(0x36, &(0x7f0000000300)={@local, @random="4ef1adb02bd2", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6403a6", 0x0, 0x32, 0x0, @empty, @mcast2}}}}, 0x0) sendmsg$key(r6, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="02050000070000bd70000000000002001000000004d2000004d00000000003000700ff00000002004e23ac1414aa00000000000000003f32"], 0x38}, 0x1, 0x7}, 0x10) setsockopt$bt_rfcomm_RFCOMM_LM(r5, 0x12, 0x3, &(0x7f0000000000), 0x4) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, r4, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket(0x21, 0x5, 0x80000001) accept4$phonet_pipe(r7, 0x0, 0x0, 0x800) 2.405192178s ago: executing program 4 (id=3770): socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0x3, 0x300) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1e, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000001000000000000000000000089120e000000000095"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x63, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3fffffc}, 0x94) unshare(0x64000600) (async) unshare(0x64000600) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82100000000000a6020000f8ffffffb703000008000000b7030000000000000c0000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4e, &(0x7f00000001c0)=0x9, 0x4) socketpair(0x2a, 0x1, 0x7e, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006"], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006"], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001a00010029bd70000000000002202000000000000020000008001c00ff01000006001d"], 0x2c}}, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000080), &(0x7f0000000180)=0x4) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x40}}}, 0x1c) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000f, 0x10, r0, 0x26e7e000) 2.137852332s ago: executing program 1 (id=3771): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000200), 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)={0x24, 0x1, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0x7}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x7aa3b272}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004800}, 0x20000000) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x5, 0x603, 0x0, {r3, r4/1000+60000}, {0x77359400}, {0x0, 0x0, 0x1}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "94b1c39a3cc2fbfd"}}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x2, 0x4, 0x0, 0x3, 0xe, 0x0, 0x4070bd2c, 0x25dfdbfc, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x7, @mcast1, 0x80000001}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x3a, 0x1}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x101, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1ff}}]}, 0x70}, 0x1, 0x7}, 0x0) 1.985207819s ago: executing program 1 (id=3772): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000d80)={'veth0_to_bond\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}}, 0x20040084) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000001840)=@newqdisc={0x24, 0x28, 0x1, 0x4003, 0xfffffdf8, {0x0, 0x0, 0x0, r2, {0x2, 0xfff1}, {0xffff, 0xffff}, {0xc, 0x1}}}, 0x24}}, 0x4000080) r3 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1a, 0x5, 0x80) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)={0x24, 0x19, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x0, 0x0, 0x0, @str=':*b\xc3{\x00'}, @typed={0x8, 0x1f, 0x0, 0x0, @fd}]}, 0x24}], 0x1}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000100001006cbd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="4db20200305b0100140003006e657464657673696d30000000000000080016800400018008000400ff010000151798030519962a7165ed5873fec71c06a11fb252bd"], 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x40000) 1.947087983s ago: executing program 3 (id=3773): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000200001032dbd700001dcdf250a0000000000000100000000140003006c6f00"], 0x30}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 1.661406787s ago: executing program 3 (id=3774): syz_emit_ethernet(0x7e, &(0x7f0000000680)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0xc, 0x0, 0x0, @broadcast=0x1000000, {0x15, 0x4, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @multicast2, {[@lsrr={0x83, 0xb, 0xe5, [@remote, @loopback]}, @timestamp_addr={0x44, 0x34, 0x0, 0x1, 0x0, [{@multicast1}, {@remote}, {@dev}, {@private=0xfffffffe}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}}}}}}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x2c}, @initr0, @exit]}, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r0, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYRES16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) (async) r2 = socket$key(0xf, 0x3, 0x2) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x4, 0x4, 0x2}, 0x50) (async) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)=ANY=[@ANYBLOB="a0000000", @ANYRES16, @ANYBLOB="050424bd7000fedbdf250100000008000100", @ANYRES32=0x0, @ANYBLOB="84000280400001"], 0xa0}, 0x1, 0x0, 0x0, 0xaddf11c998560ddf}, 0x24040084) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0xd, 0x4, 0x4, 0xc, 0x15, r5}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xffffffff, r6}, 0x38) (async) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000390440a97000fbdbdf2500000000", @ANYRES32=0x0, @ANYRES32=r6], 0x48}, 0x1, 0x0, 0x0, 0x24000047}, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r4, 0x8982, &(0x7f0000000040)={0x7, 'wg1\x00', {0x1}, 0x47ab}) (async) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)=ANY=[@ANYBLOB="180100002f00010000000000fcdbdf2507"], 0x118}], 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000080000000700000000000000", @ANYRES32, @ANYBLOB="000000f300000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async, rerun: 32) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r9, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r10 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r10, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r10, 0x1) (async) accept4$unix(r10, 0x0, 0x0, 0x800) connect$inet6(r10, &(0x7f0000000300)={0xa, 0x4e21, 0x2, @empty, 0x5}, 0x1c) sendmsg$unix(r10, &(0x7f0000000a40)={&(0x7f0000000740)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000940)=[{&(0x7f0000000800)="71fb40a6809e33df3ba8a28d080a2bb3343e3dccda0b3ab624310cffe98e15fddd82bd83f91ca2ca5184a9d3481403fd1a3603938e04c3b764c3da128f4cacac14643f105814da254750bcd4991dd460567e56290c6a00a8e5d2698305b75aac36d3d04ebad32c867563238754", 0x6d}, {&(0x7f0000000880)="4729bde0e7036fe58763b74849017d4105485ac92f8019118a73048375dc2472b40f89c736279d02b45980cacd55d84b818169ed005af31caf43118fc7359cefb70a4e48c85a35e9ca336e42673e69b00e946b5ff2cfe27705fd79c673b388794d7022812a1ff6cb139642acf787c735b5977c8631ebf24c340ae475654743bbe3bffe1926999495dd2f721f9c8664fe79ab59cd7347f0cb018bb52a05f76a592f03a6da07343728e3bddfee3661d3d90e13e55c46", 0xb5}], 0x2, &(0x7f0000000980)=[@rights={{0x18, 0x1, 0x1, [r8, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [r1, r0]}}], 0x30, 0x4008004}, 0x20040011) sendmsg$key(r2, &(0x7f00000007c0)={0x400000000000000, 0x0, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="020f000015000000000000000000000002000500000000000a"], 0xa8}}, 0x40080) (async) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x7, 0xe, &(0x7f0000002180)=ANY=[@ANYBLOB="b700000002ed0a00bfa3000000000000250a000028feffff6203f0fff8ffffff61a4f0ff000000007c0400000000000077000000000000002604000001ed0a00550a020017ffff17bf400000000000007b1a00fe000000001d04000000000000c60000000000000095000000000000000f3bc065b7a379d17cf9333379fc9e84af69002435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91082050e420fe275d0002000001b6482a0800000098efefb202ee010400006e7a1d03001f379cbf01de00b1b564fef3bef7d90692a4380548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc4b6cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0f2ce39da8db04acd00009fbe4b61a615c6c57ac21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e791665858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7296e37c4f46010400000000c3d829faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b85d9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1ba7ec6667e699fdc9a1f5a7b3caae05f13792292cbb49b3aab06b1e042ff2164d80c605532908ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c1e3fcd7071b53ac29df826f8ae6d6e18c1eac7e9bb5a05d8edf808df932c19e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b308008931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000400000000001800010300000000000000407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668238e85c79eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c0230ddfc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb057253472f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f33400047445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faee0beac08dfb8d3682ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3816953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694cd5fe9d145906d410f58f1951405d10504efe402cae085afef5dbd616e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f024f8da775f71150212b84fc0456351e096f1e7e6133ae14d1429cd4905dabb52e43af0065acf97b49512d1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232c54226e24b6c38e70380bb2f57e8767dc811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed6caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb9517f787b0900278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e5343571a95b12aec06a9f581ea97c3f03add23f14c8db5555c62de4f626483632a2ab549000ccd3a3477f88dd6e66bbb6a8083432a94081f72ed7fec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e0df6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900662201ae21ef164437f7ecf8ed9a22da26ae804bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2bd16adae02c821b62428902aad499825ab85a348638384cd1f8bb72b3e5250b0d0a20b4e2a2328d53b5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717719ca77a4e0a97c1c6ca791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65246fec3c34e2de044cdaa70b8a67b33fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1deee15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba69060000008b4264eb6f5137bdaa075f1488d22230592a7900000000000037c8986c1c19100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b8697741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e029a210fa9274d4ad7c445e50f76419ab4f78f67a09e63dd4faa2e7b19399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e228cca07bab4770b4185de44db6bf21fef32a8d5b36d9016238fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd37220e31d4731614a50c16c6a417442ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffeac350a5c554a387de4ee7aac6478dd82bef044a6d33c789d566c90c46ad581ac62f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bdad938bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f9b180010000000000000c89f3fb2f951ae81d7fcc8bc0400000000000000000000000000000000009231feef311734493c9fd999c728e3e21bb4f2bafbcd197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e80b65a9201bc4b730500df5a0100363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe038c8348bcdd40a1792be952c17f56e5e2f73019352f1fb6822a99f933ee220d5233fa20595aa5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd957729d63dc1bfc7b772cb000000af22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce90146b444338c1f7a2e991888d64e861583f0e0022121248465d37e7c386f8c614dff95defb464172998a684e21ca960897c32a127453ffffffffffffffffbcfcd7e27e37ea9c80a5b073208d29f2e4ce9438bc39300bbcc27a457296cc27f224ef4ced0773ed6bdbe4c8965d7002fa8b4c1b11f3c5e74ecedeaf4221f17448241500000000b52ee61d77b0d5adb1ca7ab9c34e7d72738309da56d5fc96acb119283c534cd5b0429d3e923c4aba0000000000000000000000f30000c54e3614c328e472bbcab5010973f6887d602bbf2f090c8ca87e58621ed208b2c48e38d86b017657daa0371e96dee683d0ce64485c47d89b363dc2b5e3dc998181c150f1f963c52b8750d947448d29bfd944d350b83c2919b1eff72072a9e1e615f5ddd8cab9459689cf259acb61a73cfeffffffffffffff4a354904909e15a68b999a8b5e5f08fcdf295e6fb68fdba28e3c6f566246416b4cf698b6fc5e9e39eb4e15e2f74e76d40e8646f0bb5395c8e31f92ccb73ff45b2bef72b2ab4306708e8e2df01ee6eb2c61bca7a1c820b821e35ac210caa0e676ff182644678bf7c8fe554cf5b32c283b226b398e977d8455971bfa42bb733cd63123255acb793b35582ae61ca8834e9d6f0fd2c57a82c89bd2e6f8d3504135854c36179dc71eeeb7b89d697abe74bb0accb12cdb4e2b4666f0ab74f0bbec4deaf1ae8fb2f2666ca202a1547d3642046e3397617c3bc8c85616e1d0d45b08e5eea4962141ffcaadfeec7e7dda146b36e4f681e8318069e821dcbe9dd41c4fcf025402e38ad8dc5c9fb7329e3719ba226d58afbf1ab306a7b57740085a0df4a07346b75ba21f9513b269657b0483a4e7530db07e5b1354920153227389487b53b661033ff2c10ef982eeb7dafb460104ae0c779c521bfa7f9daf3d7085d7d80f279227aa4e8dbf672e0000000000000000000000000000000071b96aa2dcb74da616702edf6139d0ece1a10dc80bb31916cf3347e764a33fddeb5aba6e332a82117b7d3aa656455af4ed9fcc560645168173547a9d6efa2d167290c0e63e7b80a186cb34c18b422782ee5ec268c283231507ab4409442f5c125d97aae5a4c2960aab0c16ef54966d295f7e8db38d6e8200000000000000000000000024fbdc9c129b0861e0639f8237ee9b7ce67b1d4c786dad3685dc1c7cbf7a096dfa475303b606c5fc9e769122f41402b5976cf221af47eb9ceb279a08d8e084f4f808ad2ec841f86070eee32a4b4fbdc77f06fcdb3941aac633882c264a27e8784a9cc704939132e428317b68e80f805dbc19d6e09f1adb4fb706c5a280b1958800ef630517347fa2076a28081cca208a182efa4dbf9e7e6474ced53c36eefd000000000000000000000000000000000000000041bb141a12605fd0fe2534690caa2473d671911619a001462e0deb4e7b13b055f341af34d66f6501550206bad3d64eb498ba4070f8a5b1061d353bb74d521d52887c84c47fc8385e0590410203c3f13c53fd72c67d33b9aeeb1841bd2234efb055dc7c9031080cecc7ac4ff261d0810b67354f08fc2eada568ad49000000000000000000000000008210e99d338dbfc97441a9d7c5636616d31b5dc352adcbe84acf31652eec4ed2e1509232e23361548acf88e0333e2721d8f7fd1b3086b2dacd3624bec743821e9d39f6f5a5cd9b1483fdfec3412d0bfb18ca8df5d8904ec0f4c43c9348038c8b9d94b86025b46b96e825552880c94cb2bfecb6da827a56083923cd121d4b14df15b761028caab512f6bd749140a6639180a0172e0859ce1274afaacc997e2c468402c63c13decc3280955b92ef902274efd653eedc0bf3f066856bf5204036e0448a2f70d62c8467ee661b5fbc764f9c044eb14a4071078120d1b3ce85e955a3ffe48845af190ee8eceb97d22fa0829aa18042a450e73364c68f12e8c4821e5ba17d5d36847fa7516d511f92824f1d514847e34ce43cb2eec6a1dd3d16db2f7afad959b3777b6be9b18fed9d0ac9cd4f7fe97d38aef9bc4ad9a1bf9ec77c7a28d6bc6b14968c8f045bf81d3f8bbdd0d040c50dfc647307b1222b06439890ff618d2b2689ea4c5e4672b21726df2c2d69707def1fdd062fe49502064595d4854393f40444f80a7eb3eeb533b50aa4bcf563b4125219b9aa4f67830c7d475b99c07787fd286134d223d06eeb68b9a7bdf82c7bb7cf16e03d2313543e9f221a267808e0245500e4a712d25851697a939e097490d327e700a2a2674dc3867175f886c24791d3a100000000846e4eaa8631308dab74d0f45b4fb1081f753ae999241215627152f6a96a62250260255cb21181c53493419ecbf00c0a3c4fa674f744fcc020981e0896fd4d8199ef96cae461605ff2ca3e4c5db3de7eb1062a123650067cff0c7d433202249db2133781aac9c8a9815a4ef3805221219c3a9cd80c816cd83939bfddf17d8e99590b7387be9e440dc06d43ec40f0e8ab1ec008299f96ecc4b0e0e2e3d5e68b0686398e1197ed2c8ec536d4a62ba950e60ce28afe7296042e1a4c9c35b72e409e1a371b8ff9e3c972756b6c1685a6f9d9c97dde0d213c59068faf02f65943171bfb8cba50a2337ec4e51c2d75ee8fd76b0c0e39f2189a7a36a381ffea08e2feb64a3f37213292928c2db3353baafcadccc43a87e131cf88e801646ebffc99e7c2cc08cd30dd601c03da57a55ba661d9df114296b360f702179b16ac22f8e95621028b8747b7e68cae474ca00130f60fcb1a810a969329c9c5fa000000008313705e362202ccf47ef4fcb9045036095e7d7c0f240c858d565751c0b92d906100a04fc0cc40e4327c2798b85e416db5e8a64e7d81ebe888624f68ed3a0e138505c476941ae36a9373450d37b3bab73f8dd8e67c415805466724ebcc698a1876002f5b6a994e037c2991a0566dd92df6fcc9320feee693a80b4a18abce533b34a18e84f515217d"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x26}, 0x48) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x0) (async, rerun: 32) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r10) (rerun: 32) sendmsg$NL80211_CMD_TDLS_OPER(r10, &(0x7f0000000600)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x20, r11, 0x8, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5b}}}}}, 0x20}}, 0x40008b1) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) 1.657433181s ago: executing program 1 (id=3775): r0 = socket$packet(0x11, 0x2, 0x300) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x8044) r2 = socket(0x10, 0x803, 0x6) r3 = socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0xa, 0x300) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40080c4) (async) syz_emit_ethernet(0x32, &(0x7f0000000340)=ANY=[@ANYBLOB="0000000000000180c2000000080047f800240000e00002119078000000000000000089035544041a93000000000000009078"], 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000004c0)={r4, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, 0x10) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000000)={r4, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000100)={r6, 0x1, 0x6}, 0x10) (async) sendto$packet(r0, &(0x7f0000000000)="ea92d2c62f06af98e71261176511dcf7709bbb3a5a39d941a80a2a591af8233a90d53fd2179462db29467833ae0bb191be3e67ba1efa029d159e67a72536154d1efd482ead06ba4e3e881e43bd1274f831a670d6870d37034a097fcc2a7f20a8c1a9a1addcc623d86dfd4fee46a72afde3b0e0e2d635102c91ad6ef04735eee5f19ccda69bd54cd108bf7a020dc87f02c4851cd2ee6308ff97882e82d192be7d21", 0xa1, 0x20008080, &(0x7f00000001c0)={0x11, 0x3, r6, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r7 = socket$unix(0x1, 0x1, 0x0) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000001580)=@newtfilter={0x2354, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0xfff3, 0xfff3}, {0x0, 0x8}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x2320, 0x2, [@TCA_MATCHALL_ACT={0x1fe0, 0x2, [@m_pedit={0x1dec, 0x1, 0x0, 0x0, {{0xa}, {0x1cec, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe38, 0x4, {{{0x4, 0x7fffffff, 0x3, 0x1, 0x81}, 0x2, 0x1, [{0xfff, 0x1, 0xf0000000, 0x3ff, 0x5, 0xffff}]}, [{0x8, 0x1, 0xfffffffb, 0x4, 0x7, 0x5efc}, {0x3, 0x6, 0x3, 0x101, 0x81, 0x10001}, {0x6, 0xb64, 0xffffffff, 0x7, 0xb5e7, 0x6}, {0x5, 0x81, 0x28, 0x8, 0x3, 0x3}, {0xffffffda, 0x9, 0x3c8b, 0x4, 0x7fffffff, 0x90b}, {0xcb, 0x7fff, 0xfffffe75, 0x9, 0x1, 0x7}, {0x80, 0xffff48b2, 0x4, 0x5, 0x80, 0x2}, {0xd, 0xfffffff8, 0x200, 0x2, 0x5, 0x6}, {0x6, 0x7ff, 0x3ff, 0x2d35, 0x6, 0x3}, {0x1, 0x5, 0x9, 0x100, 0x2, 0x7ff}, {0x6, 0x1, 0x79000000, 0xffffffff, 0x1, 0x3}, {0x10000, 0x6, 0xea8, 0x4, 0x5, 0x24b}, {0x0, 0x0, 0xfff00000, 0x9, 0x3, 0xfffffffc}, {0x8, 0x6, 0xa, 0x9, 0x7fff, 0x40}, {0x80, 0x1, 0x40, 0xce44, 0x7, 0x1}, {0x6, 0xfffffff7, 0x7, 0x1, 0x4, 0x7}, {0x7, 0x9, 0x81, 0x5, 0x6b, 0x1}, {0x800, 0x0, 0x5, 0x2, 0x4, 0x7}, {0x4, 0x4, 0x800, 0x8000, 0x42f, 0x7}, {0x0, 0x9, 0x6, 0x6, 0x4d0, 0x7fffffff}, {0xffffffff, 0x2, 0x5, 0x4, 0x7fff, 0x7}, {0xff, 0x5, 0x800, 0x8c, 0x7}, {0x2, 0x5, 0x6, 0x7, 0x4, 0x9b92}, {0x9, 0x1, 0x2, 0x2, 0x7, 0x3}, {0x3ff, 0x4, 0x6, 0x1000, 0x963b, 0x1}, {0x1, 0x8, 0x5, 0x7c2, 0x200, 0x7ff}, {0xc, 0x7, 0x3, 0x98c, 0x1, 0x1d13}, {0x7e30, 0x40, 0x8, 0x2, 0xfb, 0x3}, {0x942d, 0x7f, 0x1, 0x8, 0x3, 0x101}, {0x1, 0x4, 0x9c, 0x6a4, 0x8000, 0x3}, {0x10000, 0x5, 0x3c05, 0xdec6, 0x0, 0x5}, {0x6, 0x6c, 0x3, 0x7, 0xe7, 0x7}, {0x4, 0x5, 0xfffffff7, 0x5, 0xc1a2, 0x4}, {0x7083c031, 0x3, 0x6, 0x1, 0x9bb3, 0x9}, {0x2, 0x6, 0x7, 0x7, 0x8000000, 0xae}, {0xe, 0x6, 0x1, 0x3, 0x401, 0x9}, {0x5, 0x9, 0x5, 0xd, 0xb, 0xc}, {0x8, 0x9, 0x1, 0x5, 0x7, 0xfffffffd}, {0x180, 0x5, 0x10000, 0x0, 0x7fff, 0x9}, {0x764, 0x67d72f1, 0xf, 0x2, 0x5}, {0x6fd, 0xfff, 0x7, 0x4, 0xfffffffa, 0x910}, {0xd21, 0xfffffff7, 0x1ff, 0x0, 0x8, 0x6}, {0x1, 0x5, 0xffff, 0xa0, 0x5, 0x2}, {0x7, 0xaf20, 0x0, 0x1, 0x0, 0x4}, {0x3ff, 0x0, 0x4, 0xfa280, 0x3, 0x80}, {0x9, 0x5, 0x5, 0xf0, 0x8, 0x4}, {0xd, 0x91fb, 0x7f, 0x9, 0x0, 0x6}, {0x5, 0x4, 0x2, 0x3, 0x9, 0x1}, {0x1, 0xc9af, 0x7f, 0x4, 0x80000000, 0x4}, {0x0, 0x7, 0xdc65, 0xa52, 0x7, 0x2}, {0x2, 0x1, 0x800, 0x3, 0x0, 0xd}, {0x28ca, 0xfffffbff, 0x6, 0xffff, 0x56cb, 0x7}, {0x1, 0x4, 0x2, 0x1, 0x0, 0x2}, {0x0, 0x9, 0xff, 0x7, 0x0, 0xd3}, {0x0, 0x8, 0x7fffffff, 0x2, 0x8000, 0x8}, {0xc0, 0x0, 0x5, 0x9, 0x2, 0x9}, {0x800000, 0x8, 0xdf, 0x2, 0x0, 0x6}, {0xff, 0x5, 0x6, 0xea7, 0x8, 0x2be}, {0x100, 0x2e25, 0x4, 0x3, 0x2, 0x80000000}, {0xfffffff8, 0x200, 0x3e, 0x603d, 0x2, 0x9}, {0xa, 0x5, 0x897, 0x0, 0x7, 0x1}, {0x4, 0x7, 0x1, 0x79fabc2a, 0x9, 0xffffff80}, {0x4, 0x9, 0x7, 0x86, 0x1000, 0x8}, {0x80000001, 0x2, 0x4, 0xfffffffc, 0x3, 0x8}, {0x402, 0xff, 0xfffff2de, 0x923, 0x2, 0x10001}, {0x5, 0x6, 0x8, 0x5762, 0x9, 0xcb9}, {0x6, 0x90, 0x0, 0x1, 0x9, 0x9}, {0x100, 0x2, 0x4, 0x0, 0x3ff6, 0x3f2b}, {0x30d08997, 0x78, 0x8, 0x1, 0x5, 0x1}, {0x440, 0x6cb6, 0x1, 0x2, 0xfffffffc, 0x4}, {0x6, 0x68f5029, 0x2, 0x401, 0x7, 0x8}, {0x2b879590, 0x7, 0x80000000, 0x3, 0x7fffffff, 0x7}, {0xc, 0x9, 0x75f4682c, 0xfff, 0x0, 0x7}, {0x5, 0x4, 0xffff, 0xff, 0x240}, {0x9, 0x1, 0x1, 0x2, 0x0, 0xff}, {0x5, 0x9, 0xb7d3, 0x80000000, 0x7fffffff, 0x1}, {0xc, 0xc, 0xfffffff4, 0x7, 0xffff, 0x3}, {0x859, 0x0, 0x7, 0xfffffffd, 0x9, 0x95}, {0x3, 0x3, 0x7fff, 0x9, 0x7fff, 0x1}, {0x5, 0x7, 0x2, 0x68, 0x100, 0x6}, {0x9, 0x5, 0x7f, 0x8, 0x83e, 0x9}, {0x100, 0x8, 0x100, 0x6, 0x6, 0x5}, {0x400, 0x9, 0x5, 0x3, 0x4, 0x2}, {0xf70, 0x3ff, 0x2, 0x5, 0xc, 0x5}, {0xb, 0x8, 0x2baa5938, 0x6, 0xff, 0xc197}, {0x2, 0x1, 0x7, 0x8, 0x4, 0x80}, {0x0, 0x9, 0x0, 0x5, 0x4, 0x7}, {0x9, 0x9, 0x1, 0x4, 0x3, 0x3ef1}, {0x0, 0x7, 0x1, 0x5, 0xfffffffc, 0x6}, {0xfffffff7, 0x401, 0x9, 0x196, 0x2, 0x9}, {0x3, 0x0, 0x40, 0x1, 0x6, 0x200}, {0x6, 0x100, 0xe17, 0x1, 0x2}, {0xa870, 0x5, 0x4, 0xcf4, 0x5, 0x1}, {0x10000, 0x4, 0x5bc09ecf, 0x40, 0x8, 0xfff}, {0x9, 0x5b9, 0x5, 0xb, 0xfff, 0x3}, {0x5, 0x0, 0x5, 0x8, 0xfff, 0x1}, {0x3, 0x0, 0x7, 0x7b1, 0x1, 0x6}, {0x5, 0x4c, 0x9, 0x2000000, 0x1, 0x40000}, {0x3, 0x78e, 0x0, 0x6, 0x7ff, 0xf1}, {0x0, 0x3, 0x4, 0xe, 0x4, 0x4}, {0x80000000, 0x2, 0x5, 0x3, 0xe8, 0x2}, {0x3, 0x9, 0x8, 0xfffffffd, 0x0, 0x80}, {0x8dd, 0x100, 0x0, 0x7, 0x8}, {0x9, 0xe, 0x8, 0x84, 0x9}, {0x28000000, 0x769, 0x9, 0x0, 0x1}, {0x7, 0x2, 0x5, 0x4, 0x10, 0x8}, {0x100, 0x1ff, 0x5, 0x1aa8, 0x40000000, 0x8}, {0x4, 0xcd4, 0x8100, 0x9, 0x7, 0x8}, {0x7fff, 0x7ff, 0x1b, 0x4, 0x1, 0x1}, {0x1, 0x1, 0x7, 0xffffffff, 0xfffffffa, 0x9}, {0xde, 0x9, 0x6, 0x3, 0xfffffff6, 0x4}, {0xf1, 0x1, 0x10001, 0xbb, 0x2, 0x7}, {0x0, 0xa, 0x7fffffff, 0x1, 0x5, 0x80}, {0xb4d, 0x671, 0x401, 0x8, 0x10, 0x8}, {0x81, 0xfffffffd, 0x5, 0xffffff7a, 0x5, 0x2}, {0x1000, 0x8, 0x1dd4, 0x8001, 0x8000, 0x8}, {0x2, 0xb, 0x9, 0x5, 0x5, 0xa1a6}, {0x6, 0x5, 0x2, 0x1, 0x7, 0x1}, {0xfffffff5, 0x401, 0x9, 0x0, 0x2, 0x3}, {0x0, 0x2, 0x1, 0x2, 0x7ff, 0x9}, {0x0, 0x6, 0x100, 0x71a4, 0x4, 0x401}, {0x4, 0x6, 0x1, 0xa5a, 0x555a4e6, 0x4}, {0x2, 0xb591, 0x10, 0x9, 0x7, 0x10}, {0x6, 0x1, 0x6, 0x3999, 0x4c4, 0x9}, {0x18, 0x80, 0x0, 0x8, 0x6, 0x1}, {0xc49, 0x6, 0x200, 0x539b, 0x9, 0x6}, {0xfffffffc, 0x3, 0x7, 0x9000, 0x5, 0x9}, {0x9, 0x8, 0x5, 0x5bf1, 0x428, 0x8}], [{0x2, 0x1}, {}, {0x5}, {0x5}, {0x1}, {0x5}, {0x2}, {0x5}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x3}, {0x2, 0x1}, {0x5}, {}, {0x4, 0x1}, {0x1, 0x1}, {0x2}, {0x4}, {}, {0x4}, {0x2, 0x1}, {0x2, 0x1}, {0x5}, {0x5, 0x1}, {0x1}, {}, {0x0, 0x1}, {0x2, 0x1}, {}, {0x1, 0x1}, {0x1747b1b96613e5e5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x6}, {0x4, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x5}, {0x3}, {0x2}, {0x5}, {}, {0x5, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x5}, {0x1, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x3}, {0x5, 0x1}, {0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x4}, {0x1}, {0x4}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {0x4, 0x1}, {0x8}, {0x5}, {0x0, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0xfee4c7e7927f35d1}, {0x4}, {0x3, 0x1}, {}, {0x1}, {0x6d3a62b1e567db33, 0x1}, {0x2, 0x1}, {0x2}, {0x0, 0x1}, {0x1}, {0x4}, {0x2}, {0x4, 0x1}, {0x3}, {0x4}, {0x0, 0x1}, {0x4}, {0x6}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {0x3, 0x1}, {0x3}, {0x1}, {0x1}, {0x4}, {0x4}, {0x5, 0x1}, {0x1}, {0x2}, {0x2}, {0x0, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x1}, {0x1}, {0x3}, {0x2, 0x1}, {0x9c72cefb3b4883fd}, {0x1}, {0x5}, {0x2}, {0x4}, {0x1, 0x1}, {}, {0x1}, {0x2}, {0x4, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x4}, {0x4}, {0x4, 0x1}, {0xb3ff0f7e3af53210}], 0x1}}, @TCA_PEDIT_PARMS_EX={0xeb0, 0x4, {{{0x8, 0x2, 0x2, 0xc00000, 0xf92c4f93}, 0x4, 0x8, [{0x401, 0x101, 0x0, 0x5, 0x7, 0x9}, {0x80000001, 0x1, 0x4, 0x8001, 0x0, 0x40}, {0x3, 0x3, 0x46c, 0x8, 0x101, 0x1}, {0xe36, 0x0, 0x0, 0x3, 0x81, 0x7}, {0xffff, 0x4, 0x5, 0x0, 0x7, 0x100}, {0x3, 0x10000, 0x2, 0x7, 0x0, 0x100}]}, [{0x899b, 0x9, 0x5, 0x100001f3, 0x2, 0x101}, {0x3a41, 0xffff, 0x0, 0xde59, 0x62, 0x8}, {0x0, 0x81, 0x200, 0x4, 0x4943, 0x7fff}, {0x85, 0xfff, 0xfffffff9, 0x6, 0x4, 0xca}, {0xffffffff, 0x5, 0x5, 0xfffffc97, 0x100, 0x7}, {0xc, 0x1, 0x2, 0x8, 0xfffffffd, 0x950}, {0x6, 0x2, 0x1cf2, 0x5, 0xcd, 0xb2}, {0x7, 0x0, 0x8001, 0x5, 0x101, 0x44}, {0x53, 0xf908, 0x1, 0x1ff, 0x7, 0x6}, {0x9, 0x9, 0xffff, 0x81, 0xb8, 0x10000}, {0x7, 0x9, 0x0, 0xffffffff, 0x7fffffff, 0x3}, {0x5, 0x5, 0x0, 0x1d24, 0x1, 0xda}, {0xffffffff, 0x0, 0x0, 0xffff419b, 0x400}, {0x2, 0x3ff, 0x6, 0x0, 0x7, 0x401}, {0x898, 0x1, 0x7, 0x7, 0x3, 0x7}, {0x2, 0x5700bdce, 0x28000000, 0x3, 0x3, 0x9}, {0x6, 0xffff, 0xee5, 0xc6d, 0x3, 0x9}, {0xc, 0x1d0, 0x2, 0x0, 0x8, 0x1}, {0x0, 0x7, 0x4, 0xfffffffd, 0x7, 0xe}, {0x7d67, 0x1, 0x7f, 0x3, 0x2, 0x3}, {0xfffffffe, 0x7, 0x5, 0x1, 0xf8, 0xff}, {0x0, 0x9, 0x7, 0x1000, 0x80000001, 0x7}, {0x9, 0x2, 0x62, 0x0, 0xa, 0xfff}, {0x6, 0xb, 0xc41, 0x1400, 0xab7, 0x4}, {0x3ff, 0x1, 0xff, 0x80000001, 0x7, 0x8}, {0x401, 0x6, 0x5, 0x1ff, 0x6, 0x80}, {0x731, 0x80000000, 0x6a5, 0x4, 0x4, 0x3ff}, {0x7, 0x40, 0x2, 0x2, 0x9, 0x7}, {0x3, 0x8, 0x4, 0x4c78, 0x10000, 0xfce}, {0xffffa43f, 0x100, 0x9, 0x10001, 0xd3, 0x9}, {0x7, 0x6, 0xfffffffb, 0x891, 0x6, 0x1}, {0xfff, 0x8, 0x413b145c, 0x80000000, 0xfffffffb, 0x101}, {0x4, 0x3, 0x3ff, 0x4e22f3da, 0x3, 0xfffffff8}, {0x9, 0x0, 0x0, 0x401, 0x1, 0x5}, {0x80000000, 0x40, 0x0, 0xe2, 0x1, 0x1}, {0x8000, 0x1, 0x77f, 0x101, 0x7fffffff, 0x6}, {0x6, 0x40, 0x4, 0x8, 0x94}, {0x29, 0xa03, 0xe30, 0xffffffff, 0x1aca, 0x200}, {0x5, 0xa, 0x0, 0x2, 0x8001, 0x4}, {0x5, 0x81, 0x3, 0x2b9, 0x4, 0x101}, {0x2, 0x1f4b, 0x1, 0x10001, 0x5, 0x2c}, {0xffff0001, 0xb, 0x2, 0x9, 0x4, 0x9b}, {0x3, 0x7, 0x6a84, 0x1, 0x5, 0x9}, {0x7, 0x7, 0x1ff, 0xdec, 0x5, 0xa919}, {0x2, 0x80, 0xfec, 0x2, 0x5, 0x1ff}, {0x200, 0x9, 0x1000, 0x4, 0x0, 0xcc}, {0x4, 0x9, 0x2, 0x3, 0x3, 0x1}, {0x7, 0x3, 0xc9, 0x400, 0x105, 0x9}, {0x7, 0x0, 0x1, 0x12f, 0x1, 0xb9f5}, {0xdc, 0x8, 0xd, 0xff, 0xbf5, 0x8000}, {0x40, 0x3f8f6dfd, 0x4, 0x7, 0x2, 0x2}, {0x10002000, 0x3, 0xfffffff7, 0xfffffffe, 0x4, 0x8001}, {0x9, 0x101, 0xd61, 0x51f, 0x1ff, 0x40}, {0x1ff, 0x80000000, 0x479, 0x200, 0x7cc, 0x7}, {0x3, 0x2, 0x9, 0x85a, 0x9, 0x7}, {0xc84, 0x2, 0x8001, 0x8, 0x3ff, 0x7ff}, {0xb08, 0x5, 0x8, 0x6, 0x3ff, 0xffffffff}, {0x9, 0x4, 0xffffffff, 0x99, 0x100, 0xf}, {0x3e, 0x28a3c05e, 0x7, 0xd, 0x0, 0x8000}, {0x6, 0x0, 0x1, 0x7, 0x5, 0x5}, {0x5, 0x8, 0x58b, 0x200, 0x2, 0x1}, {0x0, 0x123c, 0x8, 0x3ff, 0x10000, 0x6}, {0xfffffe00, 0x88, 0xffffffff, 0x4, 0x2, 0xf7}, {0x5, 0x3, 0x7, 0x2, 0xfffffffd, 0x7ff}, {0x8, 0xff, 0x80000000, 0x2, 0x5, 0xc}, {0x80000001, 0xa, 0x8, 0xf8, 0x800, 0x9}, {0x5, 0x2e61cb5e, 0x2, 0x10001, 0x5, 0xffffffff}, {0x8001, 0x1, 0x8, 0x80, 0x8001, 0x1}, {0xe68, 0x80, 0x44, 0x1, 0x80000001, 0xfffffffd}, {0x3, 0x7, 0x3, 0x0, 0x4, 0x2}, {0x0, 0x8, 0x7fffffff, 0x9, 0x5, 0x3}, {0x200, 0x5, 0x5, 0x2, 0x5, 0x8}, {0x8, 0xffff2681, 0x3ff00, 0x3, 0x7, 0x7}, {0x3ff00, 0xd, 0x3d6d4560, 0x0, 0x2, 0xe400}, {0x4, 0x10001, 0xcf, 0x81, 0x1000, 0x2}, {0x9, 0x2101, 0x9, 0xe, 0x9, 0x4}, {0x38fb, 0x80000001, 0xf8c, 0x1, 0x7, 0x9}, {0xcd70, 0x4, 0x5, 0x800, 0x644, 0xc80}, {0x2, 0x80000000, 0x6, 0xb, 0x80000000, 0x10001}, {0xfffff22f, 0x2, 0x500000, 0x1ff, 0x26f4, 0x10000}, {0x9, 0x2, 0x10001, 0x8, 0x99}, {0x3, 0x7, 0x9, 0x1, 0xf, 0x7}, {0x1, 0x3, 0xffff0378, 0x5, 0x100, 0x8000}, {0xb, 0xfffffffa, 0x4, 0x4, 0xffffff0e, 0x6}, {0x4824575a, 0x0, 0xf, 0xe81, 0xab, 0x9}, {0x101, 0x8, 0x4, 0x2, 0x2696e2f, 0x9}, {0xff, 0x4, 0x81, 0x800, 0x6, 0x401}, {0x3, 0x1, 0x2, 0x0, 0x7, 0x1}, {0xffffffff, 0x80000000, 0x8e, 0x0, 0xff7b, 0x9}, {0x8, 0xfffff800, 0x4, 0x7fff, 0x9, 0x7}, {0x3, 0xff, 0x3, 0x7, 0x5, 0x83b}, {0x9, 0xfffffff7, 0x7, 0x5, 0xff, 0x9}, {0x6a42, 0x101, 0x7, 0x7, 0x3ff, 0x9}, {0x4a, 0x32, 0x3, 0xd3fa, 0x26acbfce, 0x80}, {0x0, 0x3ff, 0x4, 0xfff, 0xbf4, 0x40}, {0x5, 0x96, 0x8, 0x401, 0x6, 0x6}, {0x4, 0x3d, 0x8, 0x80000001, 0x80000001, 0x9}, {0xd6b, 0x4, 0xbbd, 0x383, 0x2, 0x40}, {0x3, 0x3, 0x3, 0x254254bd, 0x840, 0x4}, {0x6, 0x1, 0xccc9, 0xf, 0x9, 0x7}, {0x8, 0x8, 0x6, 0x0, 0x2, 0x4}, {0x6, 0x9, 0x2, 0xc00, 0xfffffffb, 0x9}, {0x1ff, 0x3, 0xd, 0x3ff, 0x9, 0x14}, {0x3, 0x80000001, 0xee3, 0x9, 0x9, 0x111c2e1f}, {0xfff, 0xffff57c1, 0x699a, 0x8, 0xf, 0xde3}, {0x5, 0x2, 0x7, 0x6, 0x280, 0x5}, {0x8, 0x4, 0x8, 0x7, 0x1, 0x3}, {0xfffffffa, 0x0, 0x794, 0x9, 0xf89, 0x4}, {0xfffff000, 0x557, 0x2, 0x0, 0x5, 0x6}, {0x400, 0x1, 0x0, 0x7, 0x3, 0x1000}, {0x100, 0xd, 0x1ff, 0x4, 0x52, 0x8}, {0x0, 0x0, 0x4, 0x5, 0x3, 0x9}, {0x9, 0xdfc7, 0x1, 0x5, 0x1, 0x67}, {0x12, 0xa, 0x1, 0xbc5, 0x8, 0x543a}, {0x7, 0x18, 0x5, 0x3, 0x1, 0x3}, {0x138d0, 0x1, 0x5, 0x8, 0xfff, 0x6}, {0x4, 0x10, 0x0, 0x9, 0x9, 0x5b1a9781}, {0xb, 0x9, 0x2, 0x1, 0x3, 0x3}, {0xfffffffb, 0x4, 0x2, 0x4, 0x8, 0x40}, {0x3, 0x5b, 0x600000, 0xa6, 0x5, 0x5}, {0xc3, 0x2, 0x5, 0xfffff001, 0x402, 0x6}, {0xfffffffd, 0x2, 0x2, 0xfffffffe, 0x2, 0x5}, {0x800, 0x100, 0x7fffffff, 0x0, 0x6, 0x3ff}, {0x8, 0xa, 0x1000, 0x7, 0x10000, 0x9}, {0x80, 0x0, 0x0, 0xfffffffb, 0x2, 0x1}, {0xa9a, 0x40, 0x0, 0x4, 0xff, 0x4}, {0x8000, 0x8, 0xb, 0x3682, 0xe96, 0x23fc}, {0x7f, 0x7, 0x5, 0x5, 0x9, 0x2}], [{0x4, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3}, {0x0, 0x1}, {0x2}, {}, {0x4, 0x1}, {0x4, 0x1}, {0x3}, {0x4}, {0x1, 0x1}, {0x5, 0x1}, {0x4}, {0x3}, {}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {}, {0x3, 0x1}, {0x2}, {0x2, 0x1}, {0x3}, {0x4, 0x1}, {0x5}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {}, {0x5}, {0x7, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x2}, {0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x1, 0x47077798ca99b28d}, {0x0, 0x1}, {}, {0x3, 0x1}, {0x4}, {0x2}, {0x2}, {0x1}, {0x2}, {}, {0x5}, {0x3}, {0x7}, {0x4, 0x1}, {0x1, 0x1}, {}, {0x4}, {0x3, 0x1}, {}, {0x5}, {0x1, 0x1}, {0x5, 0x1}, {0x3}, {0x1, 0x1}, {0x3}, {0x2, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x5}, {0x5, 0x1}, {0x2}, {0x5}, {0x2}, {0x2}, {0x0, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x4}, {0x2, 0x1}, {0x2, 0x1}, {0x5}, {0x4, 0x1}, {0x2}, {0x4, 0x1}, {0x2}, {0x4, 0x1}, {0x5}, {0x1}, {0x4, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {0x4}, {0x3, 0x1}, {0x3}, {0x5, 0x1}, {0x4}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x2}, {0x5}, {0x5}, {0x5}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x4}, {0x4, 0x1}, {0x2}, {0x1}, {}, {0x5}, {}, {0x4}, {0x1, 0x1}]}}]}, {0xd8, 0x6, "8a32af15175941959aad2cb92e5688e9be2078f2b6df3cd675c3e0afc05b76e6aa734815b09a5982d3960b1cbe4bb8d8c8c26cb0b295518d3a613d6e998223997ca50bba7719124226bda1de6e5a753a56dc966b627e5ad861d6c4c0e02ceca872ecb1a8fec0aac7a132fe1ee6252fc7e814a98e3c899b6b8c42f97522c9918736c5604104b6ee1cb69d2bf4b00fac8f4e910504e59cd792a370b1a5d77d8dc593f31eeb8f47f56e33665d9825ae3d4386fa48672977e60596597f5ab2bd5be3c72a19a6ac74baedccf3ee6b3f3b5d34875346e0"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_mpls={0xac, 0x1d, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_MPLS_PROTO={0x6, 0x4, 0x6004}, @TCA_MPLS_TC={0x5}]}, {0x6e, 0x6, "1ccefbfdc9774ff8245fa520d145e9164af3e53e74f867948fd0c1de30b6602c1ed8bed877b87a953a4f9176e65e535513f1e45ff288aead1340101f083aedab719781d3ed31f6e7cb3bd8792db279a0ed926e9b4c7029a319860419e3a0d90e05e8794fe2dae6986174"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_nat={0x54, 0x8, 0x0, 0x0, {{0x8}, {0x4}, {0x2c, 0x6, "4d628c3f281b027478a8e7b2f7cca2f09a6d5bfbb83e9066698494af5a656ee66e24f0f14c74b9b7"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ctinfo={0xf0, 0x8, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_CPMARK_MASK={0x8}]}, {0xb9, 0x6, "c77a83c8f2dc5af381c37de89626e8bbb7afe57fd83fc7eb7ebfd02d28d8d8e8a7f7502dbe848f9cfd7a8e51e1bfbf0e11cb42178ead12a96f3dab8b66e5bc56fafac160331b74c43440597f5adaec5ab77fcdcc6934f6d276cac33b278044821aeeb6118fca501205b97927c1b6b59f404f03426f6c913a0b3d0770039cf9edfdcfef4773b07a67235de68110f6d8c85a9d4ae915c2d4807254f2f8ad403464b32e8dbda391e2c1e62a55d09799ae9482507a2a60"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff2, 0xa}}, @TCA_MATCHALL_ACT={0x334, 0x2, [@m_xt={0x184, 0x2, 0x0, 0x0, {{0x7}, {0xc0, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x9}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_TARG={0x8e, 0x6, {0x2, 'nat\x00', 0x3, 0x40, "2048ec8a666170ec49193abe54b9a2dd3ec8ac4787d5cffb961b32261a45fce7b93a4ac67a021e5922494d7a789e37c5cffb712cff981358f310754ab531677c7ea41f24b3d5d30ff6c9c6a497344b0a5c9bbe3d0489d10d5ed936cdf66526d96ce98157"}}]}, {0x9e, 0x6, "1a527cdd789bb1e57b35cb94b93ed97699856292297f6cc7223922372fe7ef434227e052e3b00636733e3974091e7e99b74b475beb556071b769a4a1b9d2025b4663d7c4e45ae04cc007c90df140dfc02f96194622403ff7d8e7a96355d1de80bc998afb724ec7ffe2e03c4006629c0ec199566d38bb6736eca7cf8e7132b4911642a4d50605ae053dd77a059ddcfd83ea534b7f02a2630b7d6a"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_connmark={0x1ac, 0x1c, 0x0, 0x0, {{0xd}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x40, 0x3, 0x20000000, 0x2, 0x9f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0x3, 0x5, 0x8, 0x7}, 0x6bec}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x757f, 0x4, 0x401, 0x2}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x8000, 0x20000000, 0x17, 0x3}, 0x1}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x800, 0x1, 0x10000, 0x80}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0xfff, 0x10000000, 0x9, 0x9}, 0xd}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x7, 0x4, 0x3, 0xffff}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3a, 0x2, 0x6, 0xeff, 0x3}, 0x6}}]}, {0x9c, 0x6, "1f5ab5aad66e9fb9c123a550aa18e6eb5b3bea1864ee655f2f73ae695e0d3a061229bc31176160687e8a91204a81806c9d2775b5d73b0d264015a400dbe96120e5926a95ec0ea18822a6b9bab6c1cc14dec518b7ee609a43c39c47c3169fcb5febce1d8c90dc3e10dcce340ad5122335234eb518f8ccf33548f9041245eaba2833d5df2ffc6059266e9425204c5eeb35ae0635c794706240"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x2354}, 0x1, 0x0, 0x0, 0x8044000}, 0x4000) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000007000000040000000000000e0400000000000000000000000100000d000000000400000004000000000000000000000404000000000000000000000a030000000000000061"], 0x0, 0x5b}, 0x28) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000240)={'geneve0\x00', 0x2}) (async) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000280)={0x5e, @empty, 0x4e22, 0x2, 'wlc\x00', 0x28, 0x2, 0x36}, 0x2c) 1.607972321s ago: executing program 2 (id=3776): unshare(0x20400) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000440)={0x2, 0xfffffffc, 0x6}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) r1 = socket$inet6(0x2d, 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x11d, 0x20, 0x0, 0x0) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NFQNL_MSG_VERDICT_BATCH(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, 0x3, 0x3, 0x5, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x7fff}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x342}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x8001}, @NFQA_VERDICT_HDR={0xc, 0x2, {0x0, 0x40b}}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0xc}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) 1.391270163s ago: executing program 2 (id=3777): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) (async, rerun: 64) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) (rerun: 64) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4041) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000240), r0) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, r4, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V6={0x14, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast1}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast1}, @FOU_ATTR_IFINDEX={0x8, 0xb, r2}]}, 0x68}, 0x1, 0x0, 0x0, 0x200040c0}, 0x20000040) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) (async) r5 = accept4(r0, 0x0, &(0x7f00000003c0), 0x80800) sendmsg$nl_route(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)=@RTM_NEWNSID={0x1c, 0x58, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@NETNSA_NSID={0x8, 0x1, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x100108d1}, 0x8000) (async) r6 = socket$unix(0x1, 0x1, 0x0) (async) ioctl$XFS_IOC_START_COMMIT(r5, 0x80585882, &(0x7f0000000500)={0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r5) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000600)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r7, &(0x7f0000000700)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x50, r8, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffff9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x50}, 0x1, 0x0, 0x0, 0x200000c5}, 0x0) pipe(&(0x7f0000000740)={0xffffffffffffffff}) ioctl$PPPIOCNEWUNIT(r10, 0xc004743e, &(0x7f0000000780)=0x4) (async, rerun: 32) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) syz_genetlink_get_family_id$nbd(&(0x7f00000007c0), r11) r12 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_route(r12, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)=@bridge_setlink={0x38, 0x13, 0x10, 0x70bd25, 0x25dfdbfd, {0x7, 0x0, 0x0, 0x0, 0x40000, 0x420a}, [@IFLA_LINK_NETNSID={0x8}, @IFLA_MTU={0x8, 0x4, 0x5}, @IFLA_MTU={0x8, 0x4, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0xc4}, 0x48000) (async, rerun: 32) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r5, 0xc0385868, &(0x7f0000000a00)={r10, &(0x7f0000000900)='#:#)\x00', 0x228000, &(0x7f0000000940)={@align=0x40, {0x8, 0x6, 0x272, 0xe}}, 0x5, &(0x7f0000000980)={@_ha_fsid}, &(0x7f00000009c0)=0x72fc}) (async, rerun: 32) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000a40)={"f467c4979436c972f06d43c7c6b94b1c", 0x0, 0x0, {0x9b3, 0x2}, {0x7, 0x7f}, 0x7ff, [0x8000, 0x5, 0x5, 0x97, 0x86d, 0x1, 0x4, 0x5, 0xbbfc, 0x8, 0xfbdd4b6, 0x7fffffffffffffff, 0xffffffffffff7656, 0x4, 0x8, 0x5]}) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000b40)={"6c182b14d9adaa95a7480013f3a3addb", 0x0, 0x0, {0x8, 0xe}, {0xffffffff, 0x1}, 0x100000000, [0x55b, 0xfffffffffffffff9, 0x8, 0x4, 0x6, 0x6800000000000000, 0x7, 0x100000001, 0xb, 0x76d, 0x4, 0x400, 0xffffffffffffffbd, 0x40, 0x4, 0x81]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r13, 0xc0c89425, &(0x7f0000000c40)={"a2b1da0f21ad13808f02a8b8899fd853", r14, r15, {0x1, 0x4}, {0x9b9, 0x2}, 0x800, [0x64, 0x74c9, 0x4, 0xfffffffffffffc01, 0x2, 0x7, 0xfffffffffffff363, 0x5, 0x4, 0x2, 0xc0, 0x8, 0x9, 0xdb3, 0xa, 0xfffffffffffffffb]}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r7, &(0x7f0000000ec0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000e80)={&(0x7f0000000d80)={0xe0, r1, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x88, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x4}]}, 0xe0}, 0x1, 0x0, 0x0, 0x40}, 0x20004002) (async) r16 = accept4$x25(r13, &(0x7f0000000f00), &(0x7f0000000f40)=0x12, 0x80000) getsockopt$sock_buf(r16, 0x1, 0x1f, &(0x7f0000000f80)=""/110, &(0x7f0000001000)=0x6e) ioctl$XFS_IOC_FSGEOMETRY_V1(r6, 0x80705864, &(0x7f0000001040)) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000011c0)={{}, &(0x7f0000001140), &(0x7f0000001180)='%pB \x00'}, 0x20) 1.201822001s ago: executing program 1 (id=3778): r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r0, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000001800"/198, @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) 1.170084128s ago: executing program 3 (id=3779): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0x5, @private1}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e20, 0xbe8, @empty, 0x7}, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x6, @loopback, 0xffffe000}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x9}], 0x90) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001380)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="31032abd7000fbdbdf250b00000008000300", @ANYRES64=r0], 0x1c}}, 0x0) 1.078236199s ago: executing program 0 (id=3780): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, 0x2, 0x9, 0x5, 0x0, 0x0, {0x3, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x24044081}, 0x20010010) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r1, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000280)=""/143, 0x8f}], 0x1}}], 0x2, 0x0, 0x0) clock_gettime(0x7, 0xfffffffffffffffc) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="580000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009000100697069700000000014000280080013ffe400400005000900890000001400030074756e6c30"], 0x58}}, 0x1020) r3 = socket(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000140)="7800000018002507b9409b14ffff00000204be04020b06050e020909430009003f00064c0a0000000d0085a168d0bf46d32345653600648d0a000500eb16000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160004000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x24040000, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) splice(r5, &(0x7f0000000040), r4, 0x0, 0x800000000ff, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000640)={r5, 0x20, &(0x7f0000000600)={&(0x7f0000000500)=""/98, 0x62, 0x0, &(0x7f0000000580)=""/119, 0x77}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x13, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@func, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @map_val={0x18, 0x7, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x7}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="8500000031000000760000000000000027000000002cde009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8}, 0x23) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r7, 0x8010661b, &(0x7f0000000200)) unshare(0x26020480) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) tee(r11, r10, 0x100000000, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_NODELAY(r12, 0x84, 0x3, &(0x7f0000000180)=0x7a65, 0x4) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000140)=r9, 0x4) sendmsg$IPSET_CMD_SWAP(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x6, 0x6, 0x401, 0x0, 0x0, {0x3, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x800) sendmsg$IPVS_CMD_ZERO(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x41c6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x22000000}, 0x4001) 990.020551ms ago: executing program 2 (id=3781): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4) (async, rerun: 64) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) (async, rerun: 64) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x488c4}, 0x40) 887.649827ms ago: executing program 1 (id=3782): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000019c0)=@bpf_ext={0x1c, 0x4, &(0x7f00000005c0)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], &(0x7f0000000980)='syzkaller\x00', 0x0, 0x9d, &(0x7f0000000a40)=""/157, 0x41100, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000b40)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000000580)={0x7, 0x5, 0x20000400, 0x3}, 0x10, 0x28deb, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000001980), 0x10, 0x6}, 0x94) r1 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0x14, &(0x7f0000000000), 0x4) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x978, 0x438, 0x368, 0x8a8, 0x228, 0x228, 0x8a8, 0x8a8, 0x8a8, 0x8a8, 0x8a8, 0x6, &(0x7f0000000280), {[{{@uncond, 0x0, 0x1e0, 0x228, 0x0, {}, [@common=@rt={{0x138}, {0xfe7f, [0x460, 0x1], 0xf220, 0x61, 0x7, [@loopback, @dev={0xfe, 0x80, '\x00', 0x3d}, @private0, @mcast2, @private0, @ipv4={'\x00', '\xff\xff', @local}, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, @empty, @mcast1, @private2, @private0={0xfc, 0x0, '\x00', 0x1}, @remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @mcast1], 0xe}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x14, 0x35}, @ipv4=@multicast1, 0x10, 0x1a, 0xf5f6}}}, {{@ipv6={@mcast2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xff, 0x0, 0xffffff00, 0xff000000], [0xffffff00, 0xff000000, 0xffffff00, 0xff000000], 'batadv_slave_0\x00', 'nicvf0\x00', {}, {0xff}, 0xe3, 0x80, 0x4, 0x71}, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@mcast1, 0xc, 0x37, 0x6}}}, {{@ipv6={@empty, @local, [0xff, 0x0, 0xffffffff, 0xffffff00], [0xffffffff, 0xffffff00, 0xff000000, 0xff], 'veth0_to_batadv\x00', '\x00', {}, {}, 0xba, 0x5, 0x4, 0x8}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0x9d}}}, {{@uncond, 0x0, 0x208, 0x330, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x9}}, @common=@rt={{0x138}, {0x9, [0x2, 0x7], 0x4, 0x30, 0x2, [@dev={0xfe, 0x80, '\x00', 0x14}, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @remote, @rand_addr=' \x01\x00', @mcast1, @private2, @private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, @private2, @remote, @ipv4={'\x00', '\xff\xff', @empty}, @dev={0xfe, 0x80, '\x00', 0x1d}], 0x10}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x5, 'system_u:object_r:mouse_device_t:s0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}, @ipv6=@private0, 0x2, 0x33, 0x9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9d8) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f00000003c0)=@caif, 0x80, 0x0}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1b, 0xc, &(0x7f0000000300)=ANY=[@ANYRESOCT, @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x40000, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000200)='./file0\x00', 0x0, 0x10}, 0x18) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000006c0)={'syztnl0\x00', &(0x7f0000000640)={'ip6gre0\x00', 0x0, 0x4, 0x8, 0x2, 0x4072, 0x7555cddfe2bef9bc, @mcast1, @mcast1, 0x7800, 0x40, 0xc, 0x3e000000}}) ioctl$FIONCLEX(r0, 0x5450) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x6, 0x8, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0), &(0x7f00000004c0), 0xce, r4}, 0x38) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r5, 0x0, 0x0}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='net_prio.prioidx\x00', 0x275a, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz2\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "8c"}]}], {0x14}}, 0x88}}, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r8, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x1000002, 0x28011, r8, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r8, 0x2000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000007c0)={0x1}, 0x4) 825.50741ms ago: executing program 3 (id=3783): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000500)=ANY=[], 0x32600) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x3, 0x0, r0, 0x7b0, '\x00', 0x0, r0, 0x3, 0x1, 0x4}, 0x50) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000040)={0x10000, 0x9, 0x4, 0x5}) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x12, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6e, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}}}, &(0x7f0000000380)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @fallback=0xb, r0, 0x8, &(0x7f0000000500)={0x8, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000700)=[r0], 0x0, 0x10, 0x7fff}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f00000000c0)=@ethtool_stats}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'wlan0\x00', 0x0}) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r8, 0x0, 0x80, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x7fffffe, 0x0, [0x0, 0x200000000300, 0x200000000330, 0x200000000360], 0x0, 0x0, 0x0}, 0x108) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000440)=[{0x30, 0xfe, 0x0, 0xfffff02c}, {0x6, 0x0, 0x0, 0x40}]}, 0x10) 773.608498ms ago: executing program 2 (id=3784): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000000)=0x4, 0x4) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000, 0x80}, 0x50) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e24, 0x4d, @mcast1, 0x81}}, 0xaf, 0x9}, &(0x7f0000000300)=0x90) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000340)={r2, 0x9a, "288b7423d2b43d1dffbef335aca6f8cc28a2c020390c7ce9f866823d456938fdeadef79cd305986c686c07a8fc661b2c18bf025f32075717509f17758b6307104ea814088bcfce34e6215c58c65664bcfc14941e4f3f44c8821f676a64281586804ba10f02e1ac7799598e8f80233671183162fe8fb74b4066c76fc1ce02303d11cc3a220d0608abc5c041c3369a4773534bf0fb63669f0b1553"}, &(0x7f0000000400)=0xa2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, &(0x7f0000001540)=ANY=[@ANYBLOB="18030000f000000000000000ff00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b5020000140000008500000083000000bc0900000000000055090100240000009500000000002fa86e4e000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x6, 0x1006, &(0x7f0000000500)=""/4102, 0x40f00, 0x9, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f00000004c0)=0x7, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000015c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xfff1, 0xa}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x60, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x6}]}}, @TCA_BPF_POLICE={0x40, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x80000001, 0x4, 0x1, 0x5, 0x5, {0xfd, 0x1, 0xfffc, 0xd, 0x2, 0xa}, {0x2, 0x0, 0xdef8, 0xfe4a, 0x3c}, 0x8, 0x8000, 0x3}}]}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004000) sendmsg$nl_route(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000001c0)=@RTM_GETMDB={0x18, 0x56, 0x4, 0x70bd2d, 0x25dfdbfd, {0x7, r5}, ["", "", "", "", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4001}, 0x1) 772.589833ms ago: executing program 0 (id=3785): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000200001032dbd700001dcdf250a0000000000000001000000140003006c6f00"], 0x30}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 349.435435ms ago: executing program 0 (id=3786): r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) pwritev(r0, &(0x7f0000000000)=[{&(0x7f0000000180)="10", 0x1}], 0x1, 0x2, 0x80) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) sendfile(r0, r2, 0x0, 0x20000f2) 328.268064ms ago: executing program 2 (id=3787): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge0\x00'}) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) ioctl$BTRFS_IOC_DEFRAG(r1, 0x50009402, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) unshare(0x40000480) connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000000)=0x7b, 0x4) recvfrom$inet(r3, 0x0, 0x0, 0x2043, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r5, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x10, 0xfffffffe, @mcast2, 0xfffffffe}, @in6={0xa, 0x0, 0x7b6, @private0}], 0x38) getsockopt$IP_VS_SO_GET_DAEMON(r4, 0x0, 0x487, &(0x7f0000002100), &(0x7f0000000000)=0x30) connect$inet6(r2, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7}, 0x1c) socketpair(0x21, 0x2, 0x45, &(0x7f0000000000)) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000010701020000000000000000030000080900010073797a31000000000c00024000000000949abe131cedc6975c63a900000001080005400000000039d46b012dba706734c66463b914fb83170407163ef3c3ed268343da9d3b2969d1054dc7b26a8942cbe4535ccf7044ddfbf776ddf35c1a03a4a08cef6c05d1c2d0ae4fa6307b17e1d23391a49e774def27d6c15da493c13388add763b51b5449038658cd77e4dc2b1f1b208cedc8941ce546b3d99f68317e47284dc003703f4ae46efec58e8cf93fe2417c525fd2fc62be1559730bb8b2c034a98987a6f54576d0585da064512dd42b16ffb621ac54bb21e80804"], 0x34}}, 0x20000884) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x29, 0x4, 0xf, 0x7, 0x64, @local, @mcast1, 0x80, 0x10, 0x1, 0xee}}) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000500)={'erspan0\x00', 0x0, 0x7800, 0x1, 0xfffffffc, 0x8, {{0x36, 0x4, 0x1, 0x0, 0xd8, 0x64, 0x0, 0xc, 0x29, 0x0, @remote, @multicast1, {[@ssrr={0x89, 0x37, 0x63, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102, @multicast2, @empty, @broadcast, @multicast2, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @broadcast, @multicast2, @broadcast]}, @timestamp_addr={0x44, 0x34, 0x83, 0x1, 0x6, [{@local, 0x6}, {@dev={0xac, 0x14, 0x14, 0x1c}, 0xc8f}, {@multicast1, 0xff}, {@broadcast, 0x4}, {@remote, 0xc}, {@multicast2, 0x8}]}, @noop, @timestamp={0x44, 0x4, 0x68, 0x0, 0x2}, @timestamp={0x44, 0x24, 0x88, 0x0, 0x0, [0x9, 0x1000, 0x876, 0x8, 0x8, 0x3c, 0x6, 0x90e]}, @generic={0x44, 0x12, "a263b6b846a853be6683647bdc8903b4"}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x4, 0xaf, 0x1, 0x8}, @ssrr={0x89, 0x13, 0xc8, [@private=0xa010101, @multicast1, @loopback, @remote]}]}}}}}) sendmsg$nl_route(r7, 0x0, 0x0) 150.389839ms ago: executing program 3 (id=3788): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x80, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x54, 0x3, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x44, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000000}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}]}}}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xe4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(0x3) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB="50000000010801040000000000000000030000000900010073797a30000000000900010073797a31"], 0x50}, 0x1, 0x0, 0x0, 0x40020}, 0x20000000) 139.12944ms ago: executing program 0 (id=3789): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001f80)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x3f, 0x0, 0x0, 0x0, 0x97ab}, {0x2, 0x0, 0x3, 0x57, 0x8, 0x3}, 0x1, 0x2, 0xa2d}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f0000000200)="2478546ca4fa3b0bfe4ddf30cc5a", 0xe, 0x4000050, &(0x7f00000001c0)={0x11, 0xf7, r7, 0x1, 0xd8, 0x6, @broadcast}, 0x14) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x1, 0x8000004) 0s ago: executing program 3 (id=3790): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r2 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000040)={@loopback, @local, 0x1, "d2c079f7b595150f6610f4fe1de350f6de8db1ff5f33269dea822492773c55b4", 0x5, 0x9, 0x0, 0x8001}, 0x3c) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newlink={0xb0, 0x10, 0x401, 0x5, 0x3, {0x0, 0x0, 0x0, 0x0, 0x503}, [@IFLA_LINKINFO={0x88, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x78, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x308, {0x10005, 0xb}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x3}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x2, 0xe}}, @IFLA_VLAN_EGRESS_QOS={0x1c, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xfffffffffffffc5d, 0x1, {0xfffffffa}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x2, 0x49b}}]}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x8, 0xf}}, @IFLA_VLAN_INGRESS_QOS={0x28, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x6}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x3}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4590, 0x6}}]}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x90, 0x13, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_USERDATA={0x29, 0x8, "07aa3cabf2f48c52bdae1a420863b279a2de321bd1f798280c199cf1987ba2b879e64ec062"}, @NFTA_OBJ_USERDATA={0x30, 0x8, "b86a58a327926cbce961ad4659680c5d3af17b9fb6e10bbc6f084a4083f031e1b9529cd34503de9bdd146598"}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x90}, 0x1, 0x0, 0x0, 0x40005}, 0x1) kernel console output (not intermixed with test programs): yzkaller0: entered allmulticast mode [ 361.987190][T16250] vlan2: entered promiscuous mode [ 362.018728][T16250] erspan0: entered promiscuous mode [ 362.165386][T16264] netlink: 'syz.3.2667': attribute type 1 has an invalid length. [ 363.437823][T16279] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 363.462717][T16279] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 363.626975][T16289] netlink: 'syz.1.2674': attribute type 10 has an invalid length. [ 363.658447][T16289] veth0_vlan: left promiscuous mode [ 363.670525][T16292] netlink: 'syz.2.2675': attribute type 1 has an invalid length. [ 363.678318][T16289] veth0_vlan: entered promiscuous mode [ 363.686473][T16289] team0: Device veth0_vlan failed to register rx_handler [ 363.712848][T16286] netlink: 'syz.1.2674': attribute type 3 has an invalid length. [ 363.741167][T16286] x_tables: duplicate underflow at hook 1 [ 363.773986][T16297] bond6: entered promiscuous mode [ 363.779056][T16297] bond6: entered allmulticast mode [ 363.839791][T16297] 8021q: adding VLAN 0 to HW filter on device bond6 [ 363.994134][T16292] bridge6: entered promiscuous mode [ 364.000076][T16292] bridge6: entered allmulticast mode [ 364.020279][T16292] bond6: (slave bridge6): Enslaving as a backup interface with an up link [ 364.097929][ T6375] lo speed is unknown, defaulting to 1000 [ 364.103900][ T146] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 364.119433][ T6375] syz0: Port: 1 Link DOWN [ 364.170262][T16321] __nla_validate_parse: 1 callbacks suppressed [ 364.170281][T16321] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2679'. [ 364.219589][T16297] bridge7: entered promiscuous mode [ 364.236072][T16297] bridge7: entered allmulticast mode [ 364.254129][ T48] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 364.264522][T16297] bond6: (slave bridge7): Enslaving as a backup interface with a down link [ 364.282383][ T6362] lo speed is unknown, defaulting to 1000 [ 364.641971][T16348] netlink: 'syz.2.2688': attribute type 1 has an invalid length. [ 364.650557][T16348] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 364.681954][T16348] netlink: 'syz.2.2688': attribute type 2 has an invalid length. [ 364.689774][T16348] netlink: 164 bytes leftover after parsing attributes in process `syz.2.2688'. [ 364.725714][T16350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2690'. [ 364.747328][T16350] netlink: 'syz.0.2690': attribute type 13 has an invalid length. [ 364.770879][T16350] netlink: 'syz.0.2690': attribute type 17 has an invalid length. [ 364.832236][T16350] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 364.871938][ T24] lo speed is unknown, defaulting to 1000 [ 364.878088][ T24] syz0: Port: 1 Link ACTIVE [ 364.891962][ T24] lo speed is unknown, defaulting to 1000 [ 364.997141][T16350] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2690'. [ 365.120472][T16365] bond16: option packets_per_slave: invalid value (1048582) [ 365.128061][T16365] bond16: option packets_per_slave: allowed values 0 - 65535 [ 365.139018][T16365] bond16 (unregistering): Released all slaves [ 365.176032][T16347] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2689'. [ 365.230969][T16369] lo speed is unknown, defaulting to 1000 [ 365.660401][T16382] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2697'. [ 365.872172][T16393] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 366.019608][T16398] netlink: 'syz.3.2702': attribute type 1 has an invalid length. [ 366.335610][T16414] dvmrp1: tun_chr_ioctl cmd 2147767507 [ 366.416514][ T5837] Bluetooth: hci4: link tx timeout [ 366.422483][ T5837] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 366.432320][ T5837] Bluetooth: hci4: link tx timeout [ 366.437498][ T5837] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 366.446305][ T5837] Bluetooth: hci4: link tx timeout [ 366.454522][ T5837] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 366.578192][T16429] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2708'. [ 366.821766][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 366.829871][ C1] lec:lec_tx_timeout: lec0 [ 366.834904][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 367.124191][T16443] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2712'. [ 367.387850][T16424] netlink: 'syz.2.2709': attribute type 13 has an invalid length. [ 367.536302][ T48] bond6: (slave bridge6): link status up again after 0 ms [ 367.571482][ T48] bond6: (slave bridge6): link status up again after 0 ms [ 367.578675][ T48] bond6: (slave bridge6): failed to get link speed/duplex [ 367.741514][ T84] bond6: (slave bridge6): failed to get link speed/duplex [ 367.872796][ T84] bond6: (slave bridge6): failed to get link speed/duplex [ 368.027994][T16479] lo speed is unknown, defaulting to 1000 [ 368.492984][ T5830] Bluetooth: hci4: command 0x0405 tx timeout [ 368.722076][T16511] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2725'. [ 368.830166][T16517] netlink: 'syz.3.2727': attribute type 5 has an invalid length. [ 368.908507][T16520] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2726'. [ 368.964029][T16520] pimreg0: tun_chr_ioctl cmd 1074025681 [ 368.971909][T16523] netlink: 'syz.1.2728': attribute type 4 has an invalid length. [ 369.139660][ T8305] net_ratelimit: 8 callbacks suppressed [ 369.139679][ T8305] bond6: (slave bridge6): failed to get link speed/duplex [ 369.244124][T16523] nbd2: detected capacity change from 0 to 63 [ 369.257750][ T51] block nbd2: Receive control failed (result -32) [ 369.266800][ T5830] block nbd2: Receive control failed (result -32) [ 369.271144][ T146] bond6: (slave bridge6): failed to get link speed/duplex [ 369.283150][ T5956] block nbd2: Dead connection, failed to find a fallback [ 369.294722][ T5956] block nbd2: shutting down sockets [ 369.300532][ T5956] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.311210][ T5956] Buffer I/O error on dev nbd2, logical block 0, async page read [ 369.319280][ T5956] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.325117][T16539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 369.330655][ T5956] Buffer I/O error on dev nbd2, logical block 1, async page read [ 369.346634][ T5956] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.357185][ T5956] Buffer I/O error on dev nbd2, logical block 2, async page read [ 369.365231][ T5956] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.375030][ T5956] Buffer I/O error on dev nbd2, logical block 3, async page read [ 369.384602][ T5956] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.391949][ T8305] bond6: (slave bridge6): failed to get link speed/duplex [ 369.395777][ T5956] Buffer I/O error on dev nbd2, logical block 0, async page read [ 369.409871][T16541] __nla_validate_parse: 1 callbacks suppressed [ 369.409889][T16541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2734'. [ 369.426007][T16529] netlink: 'syz.3.2730': attribute type 10 has an invalid length. [ 369.451122][ T5956] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.471062][ T5956] Buffer I/O error on dev nbd2, logical block 1, async page read [ 369.485437][ T5956] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.521335][ T5956] Buffer I/O error on dev nbd2, logical block 2, async page read [ 369.549824][ T84] bond6: (slave bridge6): failed to get link speed/duplex [ 369.554344][ T5956] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.580992][ T5956] Buffer I/O error on dev nbd2, logical block 3, async page read [ 369.599752][ T5956] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.651521][ T5956] Buffer I/O error on dev nbd2, logical block 0, async page read [ 369.659371][ T5956] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.675600][ T146] bond6: (slave bridge6): failed to get link speed/duplex [ 369.720971][ T5956] Buffer I/O error on dev nbd2, logical block 1, async page read [ 369.729415][ T5956] ldm_validate_partition_table(): Disk read failed. [ 369.752901][ T5956] Dev nbd2: unable to read RDB block 0 [ 369.759766][ T5956] nbd2: unable to read partition table [ 369.782711][ T5956] ldm_validate_partition_table(): Disk read failed. [ 369.789865][ T5956] Dev nbd2: unable to read RDB block 0 [ 369.798491][ T5956] nbd2: unable to read partition table [ 369.850912][ T146] bond6: (slave bridge6): failed to get link speed/duplex [ 369.910610][T16566] netlink: 'syz.0.2740': attribute type 10 has an invalid length. [ 369.936361][T16566] bond0: (slave wlan1): Opening slave failed [ 369.944458][T16566] netlink: 'syz.0.2740': attribute type 10 has an invalid length. [ 369.960926][ T48] bond6: (slave bridge6): failed to get link speed/duplex [ 369.976657][T16566] bond0: (slave wlan1): Opening slave failed [ 370.012683][T16565] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 370.072067][ T146] bond6: (slave bridge6): failed to get link speed/duplex [ 370.133006][T16583] netlink: 'syz.3.2746': attribute type 5 has an invalid length. [ 370.202090][ T146] bond6: (slave bridge6): failed to get link speed/duplex [ 370.295054][T16591] netlink: 'syz.2.2749': attribute type 1 has an invalid length. [ 370.303104][T16591] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2749'. [ 370.312795][ T48] bond6: (slave bridge6): failed to get link speed/duplex [ 370.324844][T16591] netlink: 'syz.2.2749': attribute type 1 has an invalid length. [ 370.345797][T16591] syzkaller1: entered promiscuous mode [ 370.351440][T16591] syzkaller1: entered allmulticast mode [ 370.737035][T16615] netem: incorrect ge model size [ 370.744878][T16615] netem: change failed [ 371.069664][T16631] lo speed is unknown, defaulting to 1000 [ 371.412433][T16644] pim6reg1: entered allmulticast mode [ 371.448179][T16647] lo: left allmulticast mode [ 371.639425][T16663] netlink: 'syz.3.2769': attribute type 1 has an invalid length. [ 371.647667][T16663] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2769'. [ 371.709300][T16667] netlink: 'syz.1.2770': attribute type 31 has an invalid length. [ 371.720915][T16666] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2771'. [ 371.733318][T16666] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2771'. [ 371.850854][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 371.858981][ C1] lec:lec_tx_timeout: lec0 [ 371.863681][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 371.884525][T16670] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2772'. [ 371.908307][T16670] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2772'. [ 371.986622][T16673] netlink: 33 bytes leftover after parsing attributes in process `syz.2.2774'. [ 372.016525][T16673] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2774'. [ 372.039997][T16673] netlink: 33 bytes leftover after parsing attributes in process `syz.2.2774'. [ 372.318702][T16686] tipc: Enabled bearer , priority 0 [ 372.346463][T16686] syzkaller0: entered promiscuous mode [ 372.355543][T16686] syzkaller0: entered allmulticast mode [ 372.442401][T16686] tipc: Resetting bearer [ 372.522078][T16685] tipc: Resetting bearer [ 372.555942][T16685] tipc: Disabling bearer [ 372.629847][T16699] netlink: 'syz.0.2781': attribute type 58 has an invalid length. [ 373.403967][T16724] x_tables: duplicate underflow at hook 2 [ 373.410751][T16723] xt_hashlimit: size too large, truncated to 1048576 [ 373.443112][T16716] lo speed is unknown, defaulting to 1000 [ 374.270887][ T13] net_ratelimit: 29 callbacks suppressed [ 374.270906][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 374.412037][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 374.469444][T16764] __nla_validate_parse: 12 callbacks suppressed [ 374.469462][T16764] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2795'. [ 374.532082][T16764] syzkaller0: mtu less than device minimum [ 374.541979][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 374.542116][T16766] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 374.571821][T16766] mac80211_hwsim hwsim9 syzkaller0: Caught tx_queue_len zero misconfig [ 374.676955][ T146] bond6: (slave bridge6): failed to get link speed/duplex [ 374.737723][T16769] netlink: 'syz.3.2796': attribute type 1 has an invalid length. [ 374.803729][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 374.820377][T16771] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2797'. [ 374.921473][ T146] bond6: (slave bridge6): failed to get link speed/duplex [ 375.031464][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 375.140912][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 375.245960][T16805] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2805'. [ 375.255105][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 375.291602][T16808] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2809'. [ 375.312722][T16810] netlink: 'syz.4.2811': attribute type 1 has an invalid length. [ 375.330758][T16810] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2811'. [ 375.485444][T16820] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2813'. [ 376.141655][T16840] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2818'. [ 376.171050][T16842] netlink: 332 bytes leftover after parsing attributes in process `syz.4.2819'. [ 376.190942][T16842] netlink: 'syz.4.2819': attribute type 9 has an invalid length. [ 376.198717][T16842] netlink: 108 bytes leftover after parsing attributes in process `syz.4.2819'. [ 376.233034][T16842] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2819'. [ 376.259224][T16845] vlan2: entered promiscuous mode [ 376.870836][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 376.878932][ C1] lec:lec_tx_timeout: lec0 [ 376.883592][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 377.019272][T16885] pim6reg1: entered promiscuous mode [ 377.032773][T16885] pim6reg1: entered allmulticast mode [ 377.046735][T16885] netlink: 'syz.0.2830': attribute type 19 has an invalid length. [ 377.059484][T16885] netlink: 'syz.0.2830': attribute type 20 has an invalid length. [ 377.209142][T16893] netlink: 'syz.0.2833': attribute type 14 has an invalid length. [ 377.246812][T16894] hsr_slave_0: left promiscuous mode [ 377.262116][T16894] hsr_slave_1: left promiscuous mode [ 377.826952][T16907] Bluetooth: MGMT ver 1.23 [ 377.846027][T16907] netlink: 'syz.1.2837': attribute type 1 has an invalid length. [ 377.891699][T16907] netlink: 'syz.1.2837': attribute type 3 has an invalid length. [ 377.933031][T16910] netlink: 'syz.1.2837': attribute type 4 has an invalid length. [ 377.972113][T16907] netlink: 'syz.1.2837': attribute type 4 has an invalid length. [ 377.998892][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 378.012664][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 378.020367][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 378.028441][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 378.037674][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 378.195072][T16911] lo speed is unknown, defaulting to 1000 [ 378.337262][T16922] netlink: 'syz.1.2841': attribute type 21 has an invalid length. [ 378.434782][T16922] netlink: 'syz.1.2841': attribute type 1 has an invalid length. [ 378.518270][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.644945][T16931] netlink: 'syz.2.2842': attribute type 3 has an invalid length. [ 379.301737][ T8305] net_ratelimit: 32 callbacks suppressed [ 379.301758][ T8305] bond6: (slave bridge6): failed to get link speed/duplex [ 379.527290][T16911] chnl_net:caif_netlink_parms(): no params data found [ 379.846271][T16965] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 379.869246][T16965] batadv0: entered promiscuous mode [ 379.877853][T16968] xt_hashlimit: size too large, truncated to 1048576 [ 379.912292][T16970] __nla_validate_parse: 10 callbacks suppressed [ 379.912309][T16970] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2854'. [ 379.931779][T16965] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 379.946265][ T12] bond6: (slave bridge6): failed to get link speed/duplex [ 379.981056][T16911] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.991677][T16911] bridge0: port 1(bridge_slave_0) entered disabled state [ 380.011198][T16911] bridge_slave_0: entered allmulticast mode [ 380.051164][T16911] bridge_slave_0: entered promiscuous mode [ 380.084206][ T51] Bluetooth: hci5: command tx timeout [ 380.093590][T16911] bridge0: port 2(bridge_slave_1) entered blocking state [ 380.126916][T16911] bridge0: port 2(bridge_slave_1) entered disabled state [ 380.181143][T16911] bridge_slave_1: entered allmulticast mode [ 380.213163][T16911] bridge_slave_1: entered promiscuous mode [ 380.274710][T16970] batadv0: entered allmulticast mode [ 380.298594][T16970] bond0: (slave batadv0): Releasing backup interface [ 380.364737][T16970] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 380.572453][T16965] veth15: entered promiscuous mode [ 380.636097][T16974] bond16: entered promiscuous mode [ 380.642399][T16974] bond16: entered allmulticast mode [ 380.648068][T16974] 8021q: adding VLAN 0 to HW filter on device bond16 [ 380.781689][ T12] bond6: (slave bridge6): failed to get link speed/duplex [ 380.852221][T16994] workqueue: Failed to create a rescuer kthread for wq "bond14": -EINTR [ 380.865574][T16911] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 380.944607][T16911] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 381.004418][T16993] workqueue: Failed to create a rescuer kthread for wq "bond14": -EINTR [ 381.081210][ T12] bond6: (slave bridge6): failed to get link speed/duplex [ 381.145079][T17005] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2858'. [ 381.156271][T16911] team0: Port device team_slave_0 added [ 381.193474][T16911] team0: Port device team_slave_1 added [ 381.221211][T17006] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2858'. [ 381.374359][T16911] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 381.411763][T16911] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 381.531564][T16911] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 381.782035][ T8305] bond6: (slave bridge6): failed to get link speed/duplex [ 381.790037][T16911] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 381.809805][T16911] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 381.890961][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 381.898994][ C1] lec:lec_tx_timeout: lec0 [ 381.903651][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 381.920365][T16911] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 381.981004][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 382.160948][ T51] Bluetooth: hci5: command tx timeout [ 382.172755][T16911] hsr_slave_0: entered promiscuous mode [ 382.212052][T16911] hsr_slave_1: entered promiscuous mode [ 382.218440][T16911] debugfs: 'hsr0' already exists in 'hsr' [ 382.261899][T16911] Cannot create hsr debugfs directory [ 382.362394][T17040] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2864'. [ 382.424125][T17040] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2864'. [ 382.442381][T17042] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2865'. [ 382.662202][T17040] bond17: entered promiscuous mode [ 382.711345][T17040] 8021q: adding VLAN 0 to HW filter on device bond17 [ 382.745334][T17042] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 382.865482][T17048] 8021q: adding VLAN 0 to HW filter on device bond17 [ 382.901494][T17048] bond17: (slave vcan1): The slave device specified does not support setting the MAC address [ 382.953288][T17048] bond17: (slave vcan1): Error -95 calling set_mac_address [ 383.224652][T10054] bond6: (slave bridge6): failed to get link speed/duplex [ 383.274064][T17060] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 383.369228][T16911] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 383.405487][T17062] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 383.432233][T17064] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2871'. [ 383.441550][T10054] bond6: (slave bridge6): failed to get link speed/duplex [ 383.456961][T17064] validate_nla: 6 callbacks suppressed [ 383.456975][T17064] netlink: 'syz.4.2871': attribute type 7 has an invalid length. [ 383.491717][T17064] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2871'. [ 383.502570][T16911] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 383.518881][T17064] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2871'. [ 383.528733][T17064] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2871'. [ 383.559740][T17071] netlink: 'syz.4.2871': attribute type 7 has an invalid length. [ 383.622234][T16911] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 383.766852][T16911] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 384.049615][T17087] netlink: 'syz.0.2877': attribute type 13 has an invalid length. [ 384.077901][T17087] netlink: 'syz.0.2877': attribute type 17 has an invalid length. [ 384.133764][T16911] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 384.155348][T16911] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 384.176633][T16911] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 384.198410][T16911] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 384.242481][ T51] Bluetooth: hci5: command tx timeout [ 384.412771][ T13] net_ratelimit: 7 callbacks suppressed [ 384.412789][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 384.527292][T16911] 8021q: adding VLAN 0 to HW filter on device bond0 [ 384.561758][ T13] bond6: (slave bridge6): failed to get link speed/duplex [ 384.643599][T16911] 8021q: adding VLAN 0 to HW filter on device team0 [ 384.676256][T17114] tipc: Enabling of bearer rejected, failed to enable media [ 384.723336][ T8307] bond6: (slave bridge6): failed to get link speed/duplex [ 384.828987][ T8305] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.836172][ T8305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 384.936041][ T8305] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.943334][ T8305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 385.101120][ T48] bond6: (slave bridge6): failed to get link speed/duplex [ 385.222269][ T1099] bond6: (slave bridge6): failed to get link speed/duplex [ 385.491116][ T48] bond6: (slave bridge6): failed to get link speed/duplex [ 385.650527][T10054] bond6: (slave bridge6): failed to get link speed/duplex [ 385.763132][T10054] bond6: (slave bridge6): failed to get link speed/duplex [ 385.831872][T17156] netlink: zone id is out of range [ 385.847615][T17156] netlink: del zone limit has 8 unknown bytes [ 385.878470][T16911] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 385.881679][T17156] netlink: 'syz.2.2889': attribute type 12 has an invalid length. [ 386.044157][T16911] veth0_vlan: entered promiscuous mode [ 386.064156][T16911] veth1_vlan: entered promiscuous mode [ 386.112105][T16911] veth0_macvtap: entered promiscuous mode [ 386.124528][T16911] veth1_macvtap: entered promiscuous mode [ 386.139100][T17162] __nla_validate_parse: 11 callbacks suppressed [ 386.139117][T17162] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2890'. [ 386.156043][T17162] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2890'. [ 386.198166][T16911] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 386.229697][T16911] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 386.257339][ T8307] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.275320][ T8307] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.286975][ T8307] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.305559][T17166] lo speed is unknown, defaulting to 1000 [ 386.311768][ T8307] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.321342][ T51] Bluetooth: hci5: command tx timeout [ 386.550464][ T8305] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.577800][ T8305] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.649991][T10054] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.659231][T17168] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2892'. [ 386.661555][T10054] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.862965][T17175] netlink: 'syz.3.2836': attribute type 9 has an invalid length. [ 386.871364][T17171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2892'. [ 386.893638][T17171] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2892'. [ 386.910899][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 386.918947][ C1] lec:lec_tx_timeout: lec0 [ 386.925252][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 387.426475][T17189] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2895'. [ 387.456633][T17189] netlink: 19 bytes leftover after parsing attributes in process `syz.3.2895'. [ 387.471949][T17189] netlink: 19 bytes leftover after parsing attributes in process `syz.3.2895'. [ 387.510241][T17187] netlink: 'syz.4.2894': attribute type 3 has an invalid length. [ 387.518616][T17187] netlink: 'syz.4.2894': attribute type 3 has an invalid length. [ 388.328468][T17224] x_tables: ip_tables: osf match: only valid for protocol 6 [ 388.818547][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 388.828101][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 388.848326][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 388.864785][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 388.873023][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 388.883341][T17248] syzkaller1: entered promiscuous mode [ 388.888908][T17248] syzkaller1: entered allmulticast mode [ 388.938888][T17248] dummy0: entered promiscuous mode [ 388.963933][T17248] vlan2: entered promiscuous mode [ 389.169842][T17250] lo speed is unknown, defaulting to 1000 [ 389.265901][ T8305] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 389.357030][ T8305] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 389.367534][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 389.407028][T17269] : renamed from bond_slave_0 [ 389.451515][ T8307] net_ratelimit: 23 callbacks suppressed [ 389.451534][ T8307] bond6: (slave bridge6): failed to get link speed/duplex [ 389.482946][ T8305] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 389.547358][T17276] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2921'. [ 389.618403][ T8305] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 389.628915][T17276] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2921'. [ 389.668929][T17280] : entered promiscuous mode [ 389.718440][T17277] erspan0: entered promiscuous mode [ 389.834015][T10054] bond6: (slave bridge6): failed to get link speed/duplex [ 389.986574][T17293] netlink: 'syz.1.2926': attribute type 14 has an invalid length. [ 390.060587][T17293] netlink: 'syz.1.2926': attribute type 14 has an invalid length. [ 390.261364][T17312] netlink: 'syz.1.2931': attribute type 1 has an invalid length. [ 390.795027][ T8305] bond2 (unregistering): (slave gretap1): Releasing active interface [ 390.961434][ T51] Bluetooth: hci2: command tx timeout [ 391.145762][ T8305] bond6 (unregistering): (slave bridge6): Removing an active aggregator [ 391.155241][ T8305] bond6 (unregistering): (slave bridge6): Releasing backup interface [ 391.163516][ T8305] bond6 (unregistering): (slave bridge6): the permanent HWaddr of slave - de:48:a4:2b:3d:1a - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 391.182427][ T8305] bridge6 (unregistering): left promiscuous mode [ 391.188812][ T8305] bridge6 (unregistering): left allmulticast mode [ 391.234335][ T8305] bond6 (unregistering): (slave bridge7): Releasing backup interface [ 391.243063][ T8305] bridge7 (unregistering): left promiscuous mode [ 391.249427][ T8305] bridge7 (unregistering): left allmulticast mode [ 391.374471][ T8305] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 391.383498][ T8305] bond_slave_0: left promiscuous mode [ 391.390042][ T8305] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 391.399176][ T8305] bond_slave_1: left promiscuous mode [ 391.405927][ T8305] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 391.416775][ T8305] dummy0: left promiscuous mode [ 391.425170][ T8305] bond0 (unregistering): Released all slaves [ 391.436492][ T8305] bond1 (unregistering): Released all slaves [ 391.452476][ T8305] bond2 (unregistering): Released all slaves [ 391.467254][ T8305] bond3 (unregistering): Released all slaves [ 391.491405][ T8305] bond4 (unregistering): (slave veth3): Releasing active interface [ 391.500652][ T8305] bond4 (unregistering): (slave veth5): Releasing active interface [ 391.509668][ T8305] bond4 (unregistering): Released all slaves [ 391.529259][ T8305] bond5 (unregistering): Released all slaves [ 391.548993][ T8305] bond6 (unregistering): Released all slaves [ 391.748101][ T8305] tipc: Left network mode [ 391.940816][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 391.948889][ C1] lec:lec_tx_timeout: lec0 [ 391.953720][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 392.006177][T17250] chnl_net:caif_netlink_parms(): no params data found [ 392.019830][T17366] lo speed is unknown, defaulting to 1000 [ 392.577255][T17387] syzkaller1: entered promiscuous mode [ 392.610959][T17387] syzkaller1: entered allmulticast mode [ 392.745128][T17412] __nla_validate_parse: 3 callbacks suppressed [ 392.745147][T17412] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2945'. [ 392.894878][T17250] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.920521][T17250] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.932512][T17250] bridge_slave_0: entered allmulticast mode [ 392.944204][T17250] bridge_slave_0: entered promiscuous mode [ 393.050953][ T51] Bluetooth: hci2: command tx timeout [ 393.086619][T17250] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.115062][T17427] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2948'. [ 393.124734][T17250] bridge0: port 2(bridge_slave_1) entered disabled state [ 393.132662][T17250] bridge_slave_1: entered allmulticast mode [ 393.140528][T17250] bridge_slave_1: entered promiscuous mode [ 393.253410][T17433] netlink: 'syz.3.2950': attribute type 29 has an invalid length. [ 393.448748][T17438] workqueue: Failed to create a rescuer kthread for wq "bond17": -EINTR [ 393.449595][T17439] workqueue: Failed to create a rescuer kthread for wq "bond17": -EINTR [ 393.488642][T17429] tipc: Enabled bearer , priority 0 [ 393.517251][T17250] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 393.534479][T17250] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 393.545190][T17437] syzkaller0: entered promiscuous mode [ 393.551301][T17437] syzkaller0: entered allmulticast mode [ 393.576219][T17429] tipc: Resetting bearer [ 393.583978][T17451] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2953'. [ 393.636740][T17453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2953'. [ 393.649603][T17428] tipc: Resetting bearer [ 393.667196][T17428] tipc: Disabling bearer [ 393.680010][T17445] syzkaller0: entered promiscuous mode [ 393.686703][T17445] syzkaller0: entered allmulticast mode [ 393.697296][T17250] team0: Port device team_slave_0 added [ 393.717508][T17250] team0: Port device team_slave_1 added [ 393.972894][T17250] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 393.980701][T17250] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 394.027583][T17250] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 394.093175][T17250] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 394.106679][T17250] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 394.134306][T17250] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 394.158067][T17468] netlink: 'syz.0.2956': attribute type 21 has an invalid length. [ 394.187422][T17468] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 394.445444][T17467] syzkaller0: entered promiscuous mode [ 394.473056][T17467] syzkaller0: entered allmulticast mode [ 394.546972][T17483] xt_hashlimit: overflow, rate too high: 0 [ 395.122796][ T51] Bluetooth: hci2: command tx timeout [ 395.812142][T17499] delete_channel: no stack [ 396.270019][T17250] hsr_slave_0: entered promiscuous mode [ 396.276896][T17250] hsr_slave_1: entered promiscuous mode [ 396.302512][T17250] debugfs: 'hsr0' already exists in 'hsr' [ 396.320878][T17250] Cannot create hsr debugfs directory [ 396.425500][T17519] netlink: 'syz.3.2965': attribute type 2 has an invalid length. [ 396.996168][ T8305] hsr_slave_0: left promiscuous mode [ 397.018678][ T8305] hsr_slave_1: left promiscuous mode [ 397.032556][ T8305] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 397.201068][ T51] Bluetooth: hci2: command tx timeout [ 397.327419][T17572] netlink: 'syz.1.2977': attribute type 1 has an invalid length. [ 397.537659][ T8305] žÿ (unregistering): left promiscuous mode [ 397.545715][ T8305] team0 (unregistering): Port device 76žÿ removed [ 397.570217][ T8305] team_slave_0 (unregistering): left promiscuous mode [ 397.577896][ T8305] team0 (unregistering): Port device team_slave_0 removed [ 397.832057][ T6362] IPVS: starting estimator thread 0... [ 397.952677][T17584] IPVS: using max 29 ests per chain, 69600 per kthread [ 397.965709][T17589] netlink: 'syz.0.2978': attribute type 39 has an invalid length. [ 398.107073][T17597] syzkaller0: entered promiscuous mode [ 398.141544][T17597] syzkaller0: entered allmulticast mode [ 398.320811][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6370 ms [ 398.328907][ C1] lec:lec_tx_timeout: lec0 [ 398.335292][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 398.367005][T17609] syzkaller0: entered promiscuous mode [ 398.376606][T17609] syzkaller0: entered allmulticast mode [ 398.388480][T17603] openvswitch: netlink: nsh attr 1647 is out of range max 3 [ 398.477341][ T8305] IPVS: stop unused estimator thread 0... [ 398.708137][T17250] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 398.789850][T17250] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 398.815490][T17630] netlink: 'syz.0.2987': attribute type 11 has an invalid length. [ 398.827017][T17630] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.2987'. [ 398.839246][T17632] netlink: 'syz.0.2987': attribute type 11 has an invalid length. [ 398.847702][T17632] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.2987'. [ 398.861256][T17250] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 398.963397][T17250] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 399.020693][T17642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2989'. [ 399.035318][T17642] block nbd0: Unsupported socket: should be TCP or UNIX. [ 399.059671][T17641] dummy0: entered allmulticast mode [ 399.068011][T17640] netlink: 'syz.0.2988': attribute type 30 has an invalid length. [ 399.410479][T17250] 8021q: adding VLAN 0 to HW filter on device bond0 [ 399.424983][T17663] lo speed is unknown, defaulting to 1000 [ 399.477165][T17250] 8021q: adding VLAN 0 to HW filter on device team0 [ 399.532978][T17669] geneve1: entered promiscuous mode [ 399.542918][T17673] xt_hashlimit: size too large, truncated to 1048576 [ 399.563552][ T8305] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.570746][ T8305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 399.603523][ T146] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.610720][ T146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 399.849674][T17639] dummy0: left allmulticast mode [ 400.336372][T17698] syzkaller0: entered promiscuous mode [ 400.374097][T17698] syzkaller0: entered allmulticast mode [ 400.443279][T17698] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2999'. [ 400.525192][T17698] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 400.553275][T17698] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 400.577331][T17698] bond0 (unregistering): Released all slaves [ 400.794690][T17712] netlink: 'syz.4.3001': attribute type 16 has an invalid length. [ 400.818117][T17250] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 400.965562][T17250] veth0_vlan: entered promiscuous mode [ 401.015792][T17250] veth1_vlan: entered promiscuous mode [ 401.094298][T17250] veth0_macvtap: entered promiscuous mode [ 401.118681][T17250] veth1_macvtap: entered promiscuous mode [ 401.185500][T17730] IPVS: set_ctl: invalid protocol: 29 10.1.1.2:20000 [ 401.247934][T17728] lo speed is unknown, defaulting to 1000 [ 401.258699][T17250] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 401.304506][T17250] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 401.345968][T10054] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.359695][T10054] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.406975][T10054] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.417316][T10054] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.731912][ T8305] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.760223][ T8305] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.924496][ T8305] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.949060][ T8305] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.987172][T17759] xt_hashlimit: size too large, truncated to 1048576 [ 402.439899][T17782] syzkaller0: entered promiscuous mode [ 402.500718][T17782] syzkaller0: entered allmulticast mode [ 402.770574][T17779] syzkaller0: entered promiscuous mode [ 402.778655][T17779] syzkaller0: entered allmulticast mode [ 402.871954][T17793] lo speed is unknown, defaulting to 1000 [ 403.407102][ T5830] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 403.422779][ T5830] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 403.432114][ T5830] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 403.449542][ T5830] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 403.468929][ T5830] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 404.080851][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 404.088954][ C1] lec:lec_tx_timeout: lec0 [ 404.094385][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 404.705930][T17771] lo speed is unknown, defaulting to 1000 [ 405.268024][T17809] lo speed is unknown, defaulting to 1000 [ 405.523728][ T51] Bluetooth: hci3: command tx timeout [ 405.685917][ T30] audit: type=1800 audit(1775896471.571:13): pid=17846 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3021" name="memory.events" dev="tmpfs" ino=24 res=0 errno=0 [ 405.902518][T17858] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3023'. [ 406.303139][T17865] Cannot find del_set index 0 as target [ 406.497405][T17884] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 406.895319][T17809] chnl_net:caif_netlink_parms(): no params data found [ 407.293121][T17809] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.303406][T17809] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.309537][T17908] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3033'. [ 407.312521][T17809] bridge_slave_0: entered allmulticast mode [ 407.327665][T17809] bridge_slave_0: entered promiscuous mode [ 407.337902][T17809] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.346467][T17809] bridge0: port 2(bridge_slave_1) entered disabled state [ 407.352945][T17908] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3033'. [ 407.368496][T17809] bridge_slave_1: entered allmulticast mode [ 407.384973][T17809] bridge_slave_1: entered promiscuous mode [ 407.485191][T17809] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 407.536525][T17809] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 407.602238][ T51] Bluetooth: hci3: command tx timeout [ 407.659936][T17809] team0: Port device team_slave_0 added [ 407.666244][T17925] netlink: 'syz.1.3036': attribute type 8 has an invalid length. [ 407.672568][T17809] team0: Port device team_slave_1 added [ 407.712640][T17809] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 407.719622][T17809] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.770817][T17809] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 407.794012][T17809] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 407.812985][T17809] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.859827][T17809] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 408.010102][T17932] netlink: 65051 bytes leftover after parsing attributes in process `syz.4.3037'. [ 408.080111][T17809] hsr_slave_0: entered promiscuous mode [ 408.094079][T17809] hsr_slave_1: entered promiscuous mode [ 408.121274][T17809] debugfs: 'hsr0' already exists in 'hsr' [ 408.130062][T17809] Cannot create hsr debugfs directory [ 408.264793][T17955] xt_connbytes: Forcing CT accounting to be enabled [ 408.308010][T17955] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 408.339942][T17941] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.3039'. [ 408.364597][ T6376] IPVS: starting estimator thread 0... [ 408.442790][T17960] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3042'. [ 408.462647][T17957] IPVS: using max 28 ests per chain, 67200 per kthread [ 408.472672][T17956] tipc: Enabling not permitted [ 408.478286][T17956] tipc: Enabling of bearer rejected, failed to enable media [ 408.518876][T17960] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3042'. [ 408.667038][T17971] gre0: left promiscuous mode [ 408.704842][T17971] gre0: left allmulticast mode [ 408.807828][T17971] 8021q: adding VLAN 0 to HW filter on device team0 [ 408.852867][T17971] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 409.036819][T17974] lo speed is unknown, defaulting to 1000 [ 409.180275][T17997] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3047'. [ 409.685486][ T51] Bluetooth: hci3: command tx timeout [ 409.840835][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 409.849044][ C1] lec:lec_tx_timeout: lec0 [ 409.854779][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 410.482892][T17971] syzkaller1: entered promiscuous mode [ 410.488505][T17971] syzkaller1: entered allmulticast mode [ 410.966927][T18022] gretap1: entered promiscuous mode [ 410.973634][T18022] batman_adv: batadv0: Adding interface: gretap1 [ 410.985608][T18022] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 411.011742][T18022] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 411.024254][T18020] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3052'. [ 411.101250][T18030] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3053'. [ 411.269553][T18035] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 411.423875][T18040] netlink: 'syz.1.3057': attribute type 12 has an invalid length. [ 411.594442][T17809] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 411.646503][T17809] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 411.664756][T17809] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 411.701409][T17809] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 411.763811][ T51] Bluetooth: hci3: command tx timeout [ 411.930350][T17809] 8021q: adding VLAN 0 to HW filter on device bond0 [ 411.989097][T18080] netlink: 'syz.4.3066': attribute type 1 has an invalid length. [ 412.023804][T17809] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.043703][ T1099] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.050949][ T1099] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.066406][ T1099] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.073633][ T1099] bridge0: port 2(bridge_slave_1) entered forwarding state [ 412.092135][T18081] syzkaller1: entered promiscuous mode [ 412.097639][T18081] syzkaller1: entered allmulticast mode [ 412.282120][T18087] syzkaller0: entered promiscuous mode [ 412.287765][T18087] syzkaller0: entered allmulticast mode [ 412.311370][T18092] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3067'. [ 412.313845][T18089] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3068'. [ 412.475506][T18097] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3071'. [ 412.515253][T18099] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3072'. [ 412.604976][T18103] Bluetooth: MGMT ver 1.23 [ 413.970026][T17809] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 414.107744][T17809] veth0_vlan: entered promiscuous mode [ 414.143657][T17809] veth1_vlan: entered promiscuous mode [ 414.202401][T18118] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 414.255896][T17809] veth0_macvtap: entered promiscuous mode [ 414.280027][T17809] veth1_macvtap: entered promiscuous mode [ 414.322259][T17809] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 414.350457][T17809] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 414.393827][ T1099] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.410501][ T1099] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.434255][ T1099] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.448257][ T1099] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.628075][T18147] lo speed is unknown, defaulting to 1000 [ 414.654876][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.666185][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.718457][T18155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3085'. [ 414.774337][T18155] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3085'. [ 414.808125][ T146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.818785][ T146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.826322][T18155] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3085'. [ 414.871452][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 414.879520][ C1] lec:lec_tx_timeout: lec0 [ 414.884805][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 414.979135][T18162] x_tables: duplicate underflow at hook 2 [ 415.745316][T18188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3092'. [ 415.825016][ T5830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 415.839761][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 415.850636][ T5830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 415.862970][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 415.872108][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 416.087262][T18198] xt_hashlimit: size too large, truncated to 1048576 [ 416.110131][T18189] lo speed is unknown, defaulting to 1000 [ 416.558261][T18204] lo speed is unknown, defaulting to 1000 [ 416.583123][T18204] lo speed is unknown, defaulting to 1000 [ 416.597953][T18204] lo speed is unknown, defaulting to 1000 [ 416.619933][T18204] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 416.662763][T18204] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 416.736096][T18204] lo speed is unknown, defaulting to 1000 [ 416.769563][T18204] lo speed is unknown, defaulting to 1000 [ 416.792559][T18204] lo speed is unknown, defaulting to 1000 [ 416.831849][T18204] lo speed is unknown, defaulting to 1000 [ 416.839343][T18204] lo speed is unknown, defaulting to 1000 [ 416.897810][T18224] netlink: 'syz.4.3100': attribute type 14 has an invalid length. [ 416.921004][T18204] lo speed is unknown, defaulting to 1000 [ 416.943125][T18204] lo speed is unknown, defaulting to 1000 [ 416.951952][T18204] lo speed is unknown, defaulting to 1000 [ 416.982074][ T30] audit: type=1800 audit(1775896482.881:14): pid=18217 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3098" name="memory.events" dev="tmpfs" ino=262 res=0 errno=0 [ 417.031807][T18189] chnl_net:caif_netlink_parms(): no params data found [ 417.276460][T18189] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.284227][T18189] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.291635][T18189] bridge_slave_0: entered allmulticast mode [ 417.299290][T18189] bridge_slave_0: entered promiscuous mode [ 417.308402][T18189] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.317765][T18189] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.326189][T18189] bridge_slave_1: entered allmulticast mode [ 417.334501][T18189] bridge_slave_1: entered promiscuous mode [ 417.418884][T18241] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3104'. [ 417.436079][T18189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 417.477188][T18189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 417.541088][T18248] netlink: 'syz.2.3106': attribute type 62 has an invalid length. [ 417.552673][T18241] team0: Port device team_slave_0 removed [ 417.672506][T18246] bond0: entered allmulticast mode [ 417.678167][T18246] 8021q: adding VLAN 0 to HW filter on device bond0 [ 417.694531][T18260] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3108'. [ 417.777299][T18258] syzkaller0: entered promiscuous mode [ 417.783719][T18258] syzkaller0: entered allmulticast mode [ 417.802964][T18189] team0: Port device team_slave_0 added [ 417.812597][T18243] netlink: 'syz.4.3105': attribute type 1 has an invalid length. [ 417.824947][T18189] team0: Port device team_slave_1 added [ 417.926344][ T51] Bluetooth: hci0: command tx timeout [ 418.021799][T18270] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3110'. [ 419.369863][T18189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 419.378388][T18189] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.405352][T18189] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 419.500399][T18278] netlink: 'syz.2.3113': attribute type 4 has an invalid length. [ 419.528642][T18278] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3113'. [ 419.544783][T18189] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 419.560903][T18189] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.589128][T18189] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 419.634649][T18278] .`: renamed from bond0 (while UP) [ 419.765233][T18189] hsr_slave_0: entered promiscuous mode [ 419.785235][T18189] hsr_slave_1: entered promiscuous mode [ 419.795032][T18189] debugfs: 'hsr0' already exists in 'hsr' [ 419.801238][T18189] Cannot create hsr debugfs directory [ 419.900919][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 419.909019][ C1] lec:lec_tx_timeout: lec0 [ 419.914209][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 420.006358][ T51] Bluetooth: hci0: command tx timeout [ 420.101659][T18309] nbd: socks must be embedded in a SOCK_ITEM attr [ 420.102981][T18312] netlink: 'syz.2.3120': attribute type 6 has an invalid length. [ 420.141405][T18309] block nbd3: shutting down sockets [ 420.148365][T18189] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 420.170752][T18315] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 420.194946][T18312] IPv6: NLM_F_CREATE should be specified when creating new route [ 420.263677][T18189] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 420.357619][T18189] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 420.472477][T18189] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 420.762907][T18353] netlink: 'syz.0.3130': attribute type 322 has an invalid length. [ 420.793035][T18350] lo speed is unknown, defaulting to 1000 [ 420.819726][T18357] openvswitch: netlink: Tunnel attr 4 has unexpected len 0 expected 1 [ 421.365997][T18189] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 421.387447][T18189] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 421.423932][T18189] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 421.463555][T18189] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 421.487265][T18390] tipc: Enabling of bearer rejected, failed to enable media [ 421.621513][T18350] lo speed is unknown, defaulting to 1000 [ 422.088497][ T51] Bluetooth: hci0: command tx timeout [ 422.137579][T18189] 8021q: adding VLAN 0 to HW filter on device bond0 [ 422.182303][T18189] 8021q: adding VLAN 0 to HW filter on device team0 [ 422.208990][T18413] netlink: 'syz.3.3143': attribute type 1 has an invalid length. [ 422.359758][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.366957][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 422.453803][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.461024][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 423.013723][T18438] netlink: 'syz.2.3149': attribute type 46 has an invalid length. [ 423.044976][T18438] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3149'. [ 423.077580][T18189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 423.193819][T18189] veth0_vlan: entered promiscuous mode [ 423.252622][T18189] veth1_vlan: entered promiscuous mode [ 423.357197][T18189] veth0_macvtap: entered promiscuous mode [ 423.382564][T18189] veth1_macvtap: entered promiscuous mode [ 423.388801][T18447] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3153'. [ 423.482829][T18189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 423.504750][T18449] team_slave_0: entered promiscuous mode [ 423.510500][T18449] team_slave_1: entered promiscuous mode [ 423.519134][T18451] netlink: 'syz.0.3154': attribute type 2 has an invalid length. [ 423.533923][T18449] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 423.553664][T18454] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3155'. [ 423.575814][T18451] !©9: entered promiscuous mode [ 423.604494][T18189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 423.637343][ T1099] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.677775][ T1099] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.686784][T18455] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3154'. [ 423.701449][T18455] netlink: 'syz.0.3154': attribute type 4 has an invalid length. [ 423.709228][T18455] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3154'. [ 423.732828][ T1099] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.754281][T18451] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3154'. [ 423.759618][T18455] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 423.794340][T18451] netlink: 'syz.0.3154': attribute type 7 has an invalid length. [ 423.815252][ T8305] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.882481][T18462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3157'. [ 423.997767][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.018399][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.126832][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.151138][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.169723][ T51] Bluetooth: hci0: command tx timeout [ 424.239974][T18469] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3088'. [ 424.303703][T18470] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3158'. [ 424.338877][T18470] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 424.346309][T18470] IPv6: NLM_F_CREATE should be set when creating new route [ 424.353681][T18470] IPv6: NLM_F_CREATE should be set when creating new route [ 424.920833][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 424.928917][ C1] lec:lec_tx_timeout: lec0 [ 424.935269][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 425.386907][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 425.407099][ T5830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 425.415603][T18490] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3167'. [ 425.424989][ T5830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 425.442684][T18494] lo speed is unknown, defaulting to 1000 [ 425.443021][ T5830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 425.461545][ T5830] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 425.811713][T18505] nbd: socks must be embedded in a SOCK_ITEM attr [ 425.819499][T18505] block nbd3: shutting down sockets [ 425.973161][ T5915] lo speed is unknown, defaulting to 1000 [ 426.033708][T18496] lo speed is unknown, defaulting to 1000 [ 426.039609][T18494] lo speed is unknown, defaulting to 1000 [ 426.279316][T18519] netlink: 'syz.2.3176': attribute type 4 has an invalid length. [ 426.375333][T18520] netlink: 'syz.2.3176': attribute type 4 has an invalid length. [ 426.678025][T18496] lo speed is unknown, defaulting to 1000 [ 426.740277][T18526] lo speed is unknown, defaulting to 1000 [ 426.891634][T18534] xt_TCPMSS: Only works on TCP SYN packets [ 427.444702][T18496] chnl_net:caif_netlink_parms(): no params data found [ 427.514651][T18546] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input6 [ 427.523821][ T51] Bluetooth: hci1: command tx timeout [ 427.850734][T18496] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.866950][T18496] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.878604][T18496] bridge_slave_0: entered allmulticast mode [ 427.886826][T18496] bridge_slave_0: entered promiscuous mode [ 427.895022][T18526] lo speed is unknown, defaulting to 1000 [ 427.902178][T18496] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.910515][T18496] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.918619][T18496] bridge_slave_1: entered allmulticast mode [ 427.926928][T18496] bridge_slave_1: entered promiscuous mode [ 428.043866][T18496] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 428.107505][T18496] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 428.275503][T18496] team0: Port device team_slave_0 added [ 428.302759][T18496] team0: Port device team_slave_1 added [ 428.384127][T18570] __nla_validate_parse: 4 callbacks suppressed [ 428.384146][T18570] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3186'. [ 428.434600][T18496] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 428.448834][T18570] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3186'. [ 428.459939][T18496] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 428.491875][T18496] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 428.505097][T18496] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 428.526373][T18496] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 428.560325][T18496] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 428.837804][T18496] hsr_slave_0: entered promiscuous mode [ 428.853709][T18496] hsr_slave_1: entered promiscuous mode [ 428.860123][T18496] debugfs: 'hsr0' already exists in 'hsr' [ 428.869502][T18496] Cannot create hsr debugfs directory [ 429.136309][T18496] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.219654][T18496] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.295482][T18496] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.380185][T18496] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.423278][T18587] netlink: 'syz.1.3190': attribute type 1 has an invalid length. [ 429.601468][ T51] Bluetooth: hci1: command tx timeout [ 430.720832][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5780 ms [ 430.728940][ C1] lec:lec_tx_timeout: lec0 [ 430.734245][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 431.039329][T18562] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 431.063727][T18496] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 431.147747][T18496] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 431.177610][T18496] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 431.206169][T18496] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 431.306008][T18604] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3195'. [ 431.354677][T18604] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3195'. [ 431.382402][T18604] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3195'. [ 431.392485][T18604] netlink: 580 bytes leftover after parsing attributes in process `syz.1.3195'. [ 431.405123][T18496] 8021q: adding VLAN 0 to HW filter on device bond0 [ 431.425677][T18496] 8021q: adding VLAN 0 to HW filter on device team0 [ 431.440226][T18615] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3196'. [ 431.461711][T18616] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3194'. [ 431.478690][T10054] bridge0: port 1(bridge_slave_0) entered blocking state [ 431.485954][T10054] bridge0: port 1(bridge_slave_0) entered forwarding state [ 431.543142][T10054] bridge0: port 2(bridge_slave_1) entered blocking state [ 431.550323][T10054] bridge0: port 2(bridge_slave_1) entered forwarding state [ 431.563418][T18626] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3198'. [ 431.572718][T18626] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3198'. [ 431.681385][ T51] Bluetooth: hci1: command tx timeout [ 431.942910][T18496] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 432.038434][T18661] FAULT_INJECTION: forcing a failure. [ 432.038434][T18661] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 432.053015][T18661] CPU: 1 UID: 0 PID: 18661 Comm: syz.3.3207 Not tainted syzkaller #0 PREEMPT(full) [ 432.053041][T18661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 432.053064][T18661] Call Trace: [ 432.053072][T18661] [ 432.053081][T18661] dump_stack_lvl+0xe8/0x150 [ 432.053115][T18661] should_fail_ex+0x412/0x560 [ 432.053151][T18661] _copy_from_user+0x2d/0xb0 [ 432.053177][T18661] ___sys_sendmsg+0x1c6/0x360 [ 432.053213][T18661] ? __pfx____sys_sendmsg+0x10/0x10 [ 432.053277][T18661] ? __fget_files+0x2a/0x420 [ 432.053294][T18661] ? __fget_files+0x3a0/0x420 [ 432.053322][T18661] __x64_sys_sendmsg+0x1bd/0x2a0 [ 432.053354][T18661] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 432.053406][T18661] ? __pfx_ksys_write+0x10/0x10 [ 432.053440][T18661] do_syscall_64+0x14d/0xf80 [ 432.053459][T18661] ? trace_irq_disable+0x3b/0x150 [ 432.053477][T18661] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.053497][T18661] ? clear_bhb_loop+0x40/0x90 [ 432.053521][T18661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.053544][T18661] RIP: 0033:0x7f39ced9c819 [ 432.053562][T18661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 432.053579][T18661] RSP: 002b:00007f39cfc8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 432.053599][T18661] RAX: ffffffffffffffda RBX: 00007f39cf015fa0 RCX: 00007f39ced9c819 [ 432.053614][T18661] RDX: 0000000000000010 RSI: 0000200000000140 RDI: 0000000000000003 [ 432.053626][T18661] RBP: 00007f39cfc8d090 R08: 0000000000000000 R09: 0000000000000000 [ 432.053637][T18661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 432.053649][T18661] R13: 00007f39cf016038 R14: 00007f39cf015fa0 R15: 00007fff641bc628 [ 432.053680][T18661] [ 432.296850][T18666] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 432.375162][T18671] netlink: 'syz.1.3210': attribute type 10 has an invalid length. [ 432.422479][T18671] team0: Port device dummy0 added [ 432.619947][T18679] bond0: entered promiscuous mode [ 432.662215][T18679] bond_slave_0: entered promiscuous mode [ 432.668180][T18679] bond_slave_1: entered promiscuous mode [ 433.085260][T18681] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.093151][T18681] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.255046][T18701] netlink: 'syz.2.3215': attribute type 11 has an invalid length. [ 433.274263][T18681] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 433.293215][T18681] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 433.426210][ T5897] lo speed is unknown, defaulting to 1000 [ 433.432188][ T5897] syz2: Port: 1 Link DOWN [ 433.477622][T18687] syzkaller1: entered promiscuous mode [ 433.491580][T18687] syzkaller1: entered allmulticast mode [ 433.516553][ T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.635975][ T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.646776][ T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.656084][ T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.695476][T18668] bond0: left promiscuous mode [ 433.700304][T18668] bond_slave_0: left promiscuous mode [ 433.709707][T18668] bond_slave_1: left promiscuous mode [ 433.721896][ T13] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 433.747328][ T13] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 433.773758][ T51] Bluetooth: hci1: command tx timeout [ 433.790000][ T13] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 433.800231][ T13] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 433.827127][T18496] veth0_vlan: entered promiscuous mode [ 433.846611][T18496] veth1_vlan: entered promiscuous mode [ 433.888481][T18496] veth0_macvtap: entered promiscuous mode [ 433.926470][T18710] FAULT_INJECTION: forcing a failure. [ 433.926470][T18710] name failslab, interval 1, probability 0, space 0, times 1 [ 433.941481][T18496] veth1_macvtap: entered promiscuous mode [ 433.956351][T18710] CPU: 0 UID: 0 PID: 18710 Comm: syz.2.3218 Not tainted syzkaller #0 PREEMPT(full) [ 433.956374][T18710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 433.956386][T18710] Call Trace: [ 433.956393][T18710] [ 433.956400][T18710] dump_stack_lvl+0xe8/0x150 [ 433.956430][T18710] should_fail_ex+0x412/0x560 [ 433.956463][T18710] should_failslab+0xa8/0x100 [ 433.956488][T18710] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 433.956519][T18710] ? __alloc_skb+0x186/0x7d0 [ 433.956543][T18710] ? __alloc_skb+0x1d0/0x7d0 [ 433.956563][T18710] ? __local_bh_enable_ip+0xd0/0x130 [ 433.956592][T18710] __alloc_skb+0x1d0/0x7d0 [ 433.956640][T18710] netlink_sendmsg+0x5d4/0xb40 [ 433.956676][T18710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 433.956705][T18710] ? aa_sock_msg_perm+0xf1/0x1b0 [ 433.956726][T18710] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 433.956756][T18710] ____sys_sendmsg+0x972/0x9f0 [ 433.956794][T18710] ? __pfx_____sys_sendmsg+0x10/0x10 [ 433.956832][T18710] ? import_iovec+0x73/0xa0 [ 433.956861][T18710] ___sys_sendmsg+0x2a5/0x360 [ 433.956896][T18710] ? __pfx____sys_sendmsg+0x10/0x10 [ 433.956958][T18710] ? __fget_files+0x2a/0x420 [ 433.956977][T18710] ? __fget_files+0x3a0/0x420 [ 433.957006][T18710] __x64_sys_sendmsg+0x1bd/0x2a0 [ 433.957039][T18710] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 433.957078][T18710] ? __pfx_ksys_write+0x10/0x10 [ 433.957112][T18710] do_syscall_64+0x14d/0xf80 [ 433.957132][T18710] ? trace_irq_disable+0x3b/0x150 [ 433.957149][T18710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.957169][T18710] ? clear_bhb_loop+0x40/0x90 [ 433.957193][T18710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.957213][T18710] RIP: 0033:0x7fdc6159c819 [ 433.957232][T18710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.957248][T18710] RSP: 002b:00007fdc62453028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 433.957269][T18710] RAX: ffffffffffffffda RBX: 00007fdc61815fa0 RCX: 00007fdc6159c819 [ 433.957284][T18710] RDX: 0000000000000010 RSI: 0000200000000140 RDI: 0000000000000003 [ 433.957297][T18710] RBP: 00007fdc62453090 R08: 0000000000000000 R09: 0000000000000000 [ 433.957310][T18710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.957322][T18710] R13: 00007fdc61816038 R14: 00007fdc61815fa0 R15: 00007ffd9ebcbcb8 [ 433.957353][T18710] [ 434.212931][T18496] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 434.224735][T18496] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 434.339625][ T8305] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.348865][ T8305] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.413835][ T8305] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.433871][ T8305] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.461706][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 434.488782][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 434.608507][ T8305] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 434.637573][ T8305] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 434.693715][T18735] __nla_validate_parse: 7 callbacks suppressed [ 434.693735][T18735] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3223'. [ 434.823642][T18721] lo speed is unknown, defaulting to 1000 [ 434.942443][T18739] netlink: 'syz.4.3165': attribute type 12 has an invalid length. [ 435.103480][T18745] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3224'. [ 435.397610][T18721] lo speed is unknown, defaulting to 1000 [ 435.757534][T18764] sch_fq: defrate 4294967293 ignored. [ 435.763335][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 435.771394][ C1] lec:lec_tx_timeout: lec0 [ 435.776675][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 435.848174][T18763] pimreg: entered allmulticast mode [ 435.976626][T18763] pimreg: left allmulticast mode [ 436.003560][T18747] lo speed is unknown, defaulting to 1000 [ 436.011700][T18768] netlink: 'syz.0.3230': attribute type 1 has an invalid length. [ 436.792142][T18747] lo speed is unknown, defaulting to 1000 [ 436.796916][T18800] netlink: 'syz.3.3237': attribute type 3 has an invalid length. [ 436.875941][T18800] block nbd3: NBD_DISCONNECT [ 436.915121][T18804] xt_hashlimit: size too large, truncated to 1048576 [ 437.007520][T18800] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 437.330501][T18808] bridge_slave_0 (unregistering): left allmulticast mode [ 437.345944][T18808] bridge_slave_0 (unregistering): left promiscuous mode [ 437.364383][T18808] bridge0: port 1(bridge_slave_0) entered disabled state [ 437.912369][T18826] netlink: 'syz.1.3242': attribute type 9 has an invalid length. [ 438.137179][T18834] ipip0: entered promiscuous mode [ 438.346223][T18838] netlink: 'syz.3.3247': attribute type 4 has an invalid length. [ 438.367967][T18839] netlink: 'syz.3.3247': attribute type 4 has an invalid length. [ 438.686672][T18851] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3250'. [ 438.884893][T18859] bond0: entered promiscuous mode [ 438.910947][T18859] bond_slave_0: entered promiscuous mode [ 438.923362][T18859] bond_slave_1: entered promiscuous mode [ 438.953975][T18859] batadv0: entered promiscuous mode [ 438.992556][T18859] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 439.101814][T18859] bond0: left promiscuous mode [ 439.131534][T18859] bond_slave_0: left promiscuous mode [ 439.156985][T18859] bond_slave_1: left promiscuous mode [ 439.172778][T18859] batadv0: left promiscuous mode [ 439.229289][T18863] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 439.240290][T18863] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 439.567552][T18874] netlink: 'syz.4.3255': attribute type 1 has an invalid length. [ 439.575641][T18874] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3255'. [ 439.916053][T18887] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3259'. [ 439.929423][T18889] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3261'. [ 440.045062][T18896] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3259'. [ 440.188534][T18903] tipc: Enabling of bearer rejected, failed to enable media [ 440.265847][T18912] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3263'. [ 440.357598][T18913] netlink: 'syz.1.3265': attribute type 13 has an invalid length. [ 440.396081][T18915] FAULT_INJECTION: forcing a failure. [ 440.396081][T18915] name failslab, interval 1, probability 0, space 0, times 0 [ 440.448890][T18915] CPU: 0 UID: 0 PID: 18915 Comm: syz.3.3267 Not tainted syzkaller #0 PREEMPT(full) [ 440.448917][T18915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 440.448930][T18915] Call Trace: [ 440.448938][T18915] [ 440.448946][T18915] dump_stack_lvl+0xe8/0x150 [ 440.448979][T18915] should_fail_ex+0x412/0x560 [ 440.449016][T18915] should_failslab+0xa8/0x100 [ 440.449045][T18915] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 440.449069][T18915] ? __alloc_skb+0x186/0x7d0 [ 440.449095][T18915] ? __alloc_skb+0x1d0/0x7d0 [ 440.449118][T18915] ? __local_bh_enable_ip+0xd0/0x130 [ 440.449156][T18915] __alloc_skb+0x1d0/0x7d0 [ 440.449182][T18915] ? ip6_route_output_flags+0x2e/0x5d0 [ 440.449208][T18915] inet6_rtm_getroute+0xd77/0x1840 [ 440.449228][T18915] ? kmem_cache_free+0x187/0x630 [ 440.449257][T18915] ? __pfx_inet6_rtm_getroute+0x10/0x10 [ 440.449300][T18915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.449343][T18915] ? __pfx_inet6_rtm_getroute+0x10/0x10 [ 440.449363][T18915] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 440.449393][T18915] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 440.449418][T18915] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 440.449441][T18915] ? ref_tracker_free+0x693/0x840 [ 440.449460][T18915] ? __copy_skb_header+0xa3/0x4a0 [ 440.449491][T18915] ? __pfx_ref_tracker_free+0x10/0x10 [ 440.449522][T18915] netlink_rcv_skb+0x232/0x4b0 [ 440.449550][T18915] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 440.449577][T18915] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 440.449615][T18915] ? netlink_deliver_tap+0x2e/0x1b0 [ 440.449649][T18915] netlink_unicast+0x80f/0x9b0 [ 440.449692][T18915] ? __pfx_netlink_unicast+0x10/0x10 [ 440.449717][T18915] ? netlink_sendmsg+0x650/0xb40 [ 440.449741][T18915] ? skb_put+0x11b/0x210 [ 440.449769][T18915] netlink_sendmsg+0x813/0xb40 [ 440.449810][T18915] ? __pfx_netlink_sendmsg+0x10/0x10 [ 440.449839][T18915] ? aa_sock_msg_perm+0xf1/0x1b0 [ 440.449859][T18915] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 440.449884][T18915] ____sys_sendmsg+0x972/0x9f0 [ 440.449924][T18915] ? __pfx_____sys_sendmsg+0x10/0x10 [ 440.449960][T18915] ? import_iovec+0x73/0xa0 [ 440.449986][T18915] ___sys_sendmsg+0x2a5/0x360 [ 440.450018][T18915] ? __pfx____sys_sendmsg+0x10/0x10 [ 440.450079][T18915] ? __fget_files+0x2a/0x420 [ 440.450096][T18915] ? __fget_files+0x3a0/0x420 [ 440.450122][T18915] __x64_sys_sendmsg+0x1bd/0x2a0 [ 440.450153][T18915] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 440.450190][T18915] ? __pfx_ksys_write+0x10/0x10 [ 440.450222][T18915] do_syscall_64+0x14d/0xf80 [ 440.450240][T18915] ? trace_irq_disable+0x3b/0x150 [ 440.450255][T18915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.450275][T18915] ? clear_bhb_loop+0x40/0x90 [ 440.450297][T18915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.450314][T18915] RIP: 0033:0x7f39ced9c819 [ 440.450331][T18915] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 440.450346][T18915] RSP: 002b:00007f39cfc8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 440.450365][T18915] RAX: ffffffffffffffda RBX: 00007f39cf015fa0 RCX: 00007f39ced9c819 [ 440.450378][T18915] RDX: 0000000000000010 RSI: 0000200000000140 RDI: 0000000000000003 [ 440.450390][T18915] RBP: 00007f39cfc8d090 R08: 0000000000000000 R09: 0000000000000000 [ 440.450401][T18915] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 440.450412][T18915] R13: 00007f39cf016038 R14: 00007f39cf015fa0 R15: 00007fff641bc628 [ 440.450440][T18915] [ 440.791116][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 440.799164][ C1] lec:lec_tx_timeout: lec0 [ 440.804160][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 441.361599][T18923] bond2: entered promiscuous mode [ 441.371359][T18923] 8021q: adding VLAN 0 to HW filter on device bond2 [ 441.492435][T18919] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3268'. [ 441.510967][T18936] tipc: Enabling of bearer rejected, failed to enable media [ 441.707133][T18939] syzkaller0: entered promiscuous mode [ 441.713508][T18939] syzkaller0: entered allmulticast mode [ 442.008297][T18960] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3279'. [ 442.059238][T18962] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3279'. [ 442.099685][T18960] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3279'. [ 442.130687][T18960] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3279'. [ 442.185530][T18960] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3279'. [ 442.272169][T18973] vlan2: entered promiscuous mode [ 442.277270][T18973] geneve1: entered promiscuous mode [ 442.323931][T18973] vlan2: entered allmulticast mode [ 442.330347][T18973] geneve1: entered allmulticast mode [ 442.451990][T18983] netlink: 'syz.1.3286': attribute type 10 has an invalid length. [ 442.516682][T18983] 8021q: adding VLAN 0 to HW filter on device team0 [ 442.545637][T18991] xt_time: unknown flags 0xf4 [ 442.557836][T18983] bond0: (slave team0): Enslaving as an active interface with an up link [ 442.637414][T18991] vlan3: entered promiscuous mode [ 443.855751][T19047] netlink: 'syz.2.3302': attribute type 1 has an invalid length. [ 444.942526][T19082] netlink: 'syz.1.3311': attribute type 29 has an invalid length. [ 445.041063][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 445.167219][T19089] sch_tbf: burst 0 is lower than device tunl0 mtu (68) ! [ 445.306579][T19091] geneve2: entered promiscuous mode [ 445.327509][T19094] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 445.345237][T19094] openvswitch: netlink: Message has 16 unknown bytes. [ 445.361772][T19091] __nla_validate_parse: 66 callbacks suppressed [ 445.361789][T19091] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3315'. [ 445.391887][T19091] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3315'. [ 445.404768][T19094] syzkaller0: entered promiscuous mode [ 445.410621][T19094] syzkaller0: entered allmulticast mode [ 445.424947][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.432128][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.438926][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.445765][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.452578][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.459366][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.466213][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.473048][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.479860][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.486683][T19094] tc action pedit offset must be on 32 bit boundaries [ 445.493536][T19094] TC_ACT_REPEAT abuse ? [ 445.562422][T19103] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3318'. [ 445.752730][T19115] FAULT_INJECTION: forcing a failure. [ 445.752730][T19115] name failslab, interval 1, probability 0, space 0, times 0 [ 445.780986][T19113] netlink: 'syz.3.3320': attribute type 2 has an invalid length. [ 445.800937][T19115] CPU: 0 UID: 0 PID: 19115 Comm: syz.4.3322 Not tainted syzkaller #0 PREEMPT(full) [ 445.800962][T19115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 445.800973][T19115] Call Trace: [ 445.800980][T19115] [ 445.800995][T19115] dump_stack_lvl+0xe8/0x150 [ 445.801028][T19115] should_fail_ex+0x412/0x560 [ 445.801065][T19115] should_failslab+0xa8/0x100 [ 445.801091][T19115] ? skb_clone+0x212/0x3a0 [ 445.801109][T19115] kmem_cache_alloc_noprof+0x87/0x650 [ 445.801138][T19115] skb_clone+0x212/0x3a0 [ 445.801160][T19115] __netlink_deliver_tap+0x404/0x850 [ 445.801197][T19115] ? netlink_deliver_tap+0x2e/0x1b0 [ 445.801222][T19115] netlink_deliver_tap+0x19c/0x1b0 [ 445.801267][T19115] netlink_sendskb+0x68/0x140 [ 445.801293][T19115] netlink_unicast+0x3a3/0x9b0 [ 445.801324][T19115] ? __pfx_netlink_unicast+0x10/0x10 [ 445.801352][T19115] ? rcu_read_unlock+0x87/0xa0 [ 445.801379][T19115] rtnl_unicast+0x4e/0x60 [ 445.801399][T19115] inet6_rtm_getroute+0x10ff/0x1840 [ 445.801418][T19115] ? kmem_cache_free+0x187/0x630 [ 445.801446][T19115] ? __pfx_inet6_rtm_getroute+0x10/0x10 [ 445.801488][T19115] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.801531][T19115] ? __pfx_inet6_rtm_getroute+0x10/0x10 [ 445.801553][T19115] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 445.801585][T19115] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 445.801609][T19115] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 445.801636][T19115] ? ref_tracker_free+0x693/0x840 [ 445.801657][T19115] ? __copy_skb_header+0xa3/0x4a0 [ 445.801692][T19115] ? __pfx_ref_tracker_free+0x10/0x10 [ 445.801725][T19115] netlink_rcv_skb+0x232/0x4b0 [ 445.801754][T19115] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 445.801784][T19115] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 445.801824][T19115] ? netlink_deliver_tap+0x2e/0x1b0 [ 445.801863][T19115] netlink_unicast+0x80f/0x9b0 [ 445.801898][T19115] ? __pfx_netlink_unicast+0x10/0x10 [ 445.801926][T19115] ? netlink_sendmsg+0x650/0xb40 [ 445.801953][T19115] ? skb_put+0x11b/0x210 [ 445.801994][T19115] netlink_sendmsg+0x813/0xb40 [ 445.802033][T19115] ? __pfx_netlink_sendmsg+0x10/0x10 [ 445.802065][T19115] ? aa_sock_msg_perm+0xf1/0x1b0 [ 445.802088][T19115] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 445.802118][T19115] ____sys_sendmsg+0x972/0x9f0 [ 445.802160][T19115] ? __pfx_____sys_sendmsg+0x10/0x10 [ 445.802202][T19115] ? import_iovec+0x73/0xa0 [ 445.802233][T19115] ___sys_sendmsg+0x2a5/0x360 [ 445.802273][T19115] ? __pfx____sys_sendmsg+0x10/0x10 [ 445.802340][T19115] ? __fget_files+0x2a/0x420 [ 445.802359][T19115] ? __fget_files+0x3a0/0x420 [ 445.802390][T19115] __x64_sys_sendmsg+0x1bd/0x2a0 [ 445.802438][T19115] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 445.802492][T19115] ? __pfx_ksys_write+0x10/0x10 [ 445.802525][T19115] do_syscall_64+0x14d/0xf80 [ 445.802543][T19115] ? trace_irq_disable+0x3b/0x150 [ 445.802561][T19115] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.802581][T19115] ? clear_bhb_loop+0x40/0x90 [ 445.802605][T19115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.802625][T19115] RIP: 0033:0x7ffa4e99c819 [ 445.802644][T19115] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.802660][T19115] RSP: 002b:00007ffa4f8bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 445.802680][T19115] RAX: ffffffffffffffda RBX: 00007ffa4ec15fa0 RCX: 00007ffa4e99c819 [ 445.802694][T19115] RDX: 0000000000000010 RSI: 0000200000000140 RDI: 0000000000000003 [ 445.802706][T19115] RBP: 00007ffa4f8bb090 R08: 0000000000000000 R09: 0000000000000000 [ 445.802719][T19115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 445.802729][T19115] R13: 00007ffa4ec16038 R14: 00007ffa4ec15fa0 R15: 00007ffeb28cddc8 [ 445.802759][T19115] [ 445.810964][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 446.183074][ C1] lec:lec_tx_timeout: lec0 [ 446.190868][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 446.287498][T19123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3325'. [ 446.345459][T19123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3325'. [ 446.437216][T19133] tipc: Enabling of bearer rejected, failed to enable media [ 446.449143][T19134] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3324'. [ 446.539170][T19136] rdma_rxe: rxe_newlink: failed to add wg1 [ 447.391175][T19138] ip6t_srh: unknown srh invflags 4000 [ 447.853960][T19178] lo speed is unknown, defaulting to 1000 [ 448.409647][T19180] lo speed is unknown, defaulting to 1000 [ 448.442406][T19178] lo speed is unknown, defaulting to 1000 [ 448.873749][T19192] netlink: 'syz.3.3342': attribute type 1 has an invalid length. [ 448.964228][T19196] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3342'. [ 449.050517][T19192] 8021q: adding VLAN 0 to HW filter on device bond3 [ 449.174743][T19180] lo speed is unknown, defaulting to 1000 [ 449.607531][T19211] sctp: [Deprecated]: syz.3.3349 (pid 19211) Use of int in maxseg socket option. [ 449.607531][T19211] Use struct sctp_assoc_value instead [ 449.719156][T19221] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3348'. [ 450.093347][T19234] syzkaller0: entered promiscuous mode [ 450.111574][T19234] syzkaller0: entered allmulticast mode [ 450.210258][T19238] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3355'. [ 450.518866][T19256] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3358'. [ 450.684857][T19260] tipc: Enabling of bearer rejected, failed to enable media [ 450.709001][T19261] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 450.739548][T19263] netlink: 'syz.2.3361': attribute type 3 has an invalid length. [ 450.766213][T19263] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3361'. [ 451.069248][T19286] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3367'. [ 451.138389][T19287] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3368'. [ 451.175910][T19287] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3368'. [ 451.233555][T19287] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 451.266557][T19287] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 451.303859][T19287] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 451.326857][T19287] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 451.353486][T19287] batman_adv: batadv0: Removing interface: gretap1 [ 451.760799][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5570 ms [ 451.768855][ C1] lec:lec_tx_timeout: lec0 [ 451.774604][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 451.807388][T19312] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3371'. [ 451.819005][T19312] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 452.012424][T19324] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.3374'. [ 452.074870][T19328] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3375'. [ 452.101992][T19333] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3376'. [ 452.249006][T19338] xt_hashlimit: size too large, truncated to 1048576 [ 452.500135][T19351] netlink: 'syz.3.3380': attribute type 30 has an invalid length. [ 452.607893][T19351] netlink: 'syz.3.3380': attribute type 13 has an invalid length. [ 452.784306][T19360] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 452.817353][T19360] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 453.193683][T19372] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3386'. [ 453.231393][T19378] dummy0: Caught tx_queue_len zero misconfig [ 453.617472][T19389] bond0: entered promiscuous mode [ 453.628190][T19389] bond_slave_0: entered promiscuous mode [ 453.649868][T19389] bond_slave_1: entered promiscuous mode [ 453.674204][T19389] team0: entered promiscuous mode [ 453.724761][T19389] team_slave_0: entered promiscuous mode [ 453.736760][T19389] team_slave_1: entered promiscuous mode [ 453.781955][T19389] dummy0: entered promiscuous mode [ 453.794326][T19389] gretap0: entered promiscuous mode [ 453.808447][T19389] hsr1: entered promiscuous mode [ 454.158825][T19413] netdevsim netdevsim1: Direct firmware load for  failed with error -2 [ 454.171287][T19413] netdevsim netdevsim1: Falling back to sysfs fallback for:  [ 454.562055][T19436] tipc: Started in network mode [ 454.573807][T19436] tipc: Node identity faac48e3ac89, cluster identity 4711 [ 454.590619][T19436] tipc: Enabled bearer , priority 0 [ 454.615490][T19436] syzkaller0: entered promiscuous mode [ 454.645571][T19436] syzkaller0: entered allmulticast mode [ 454.724097][T19436] tipc: Resetting bearer [ 454.831764][T19433] tipc: Resetting bearer [ 454.892154][T19433] tipc: Disabling bearer [ 455.165148][T19455] tipc: Enabling of bearer rejected, failed to enable media [ 455.261526][T19456] lo speed is unknown, defaulting to 1000 [ 455.338966][ T24] IPVS: starting estimator thread 0... [ 455.460516][T19469] IPVS: using max 27 ests per chain, 64800 per kthread [ 455.812485][T19489] __nla_validate_parse: 6 callbacks suppressed [ 455.812506][T19489] netlink: 21 bytes leftover after parsing attributes in process `syz.4.3414'. [ 455.923499][T19489] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 456.012555][T19456] lo speed is unknown, defaulting to 1000 [ 456.020124][T19464] lo speed is unknown, defaulting to 1000 [ 456.652019][T19464] lo speed is unknown, defaulting to 1000 [ 456.781470][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 456.789565][ C1] lec:lec_tx_timeout: lec0 [ 456.794408][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 457.328731][T19510] netlink: 212336 bytes leftover after parsing attributes in process `syz.0.3417'. [ 457.623816][T19515] lo speed is unknown, defaulting to 1000 [ 457.890727][T19515] lo speed is unknown, defaulting to 1000 [ 458.720069][T19519] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 458.778983][T19491] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 459.080921][ T30] audit: type=1107 audit(1775896524.971:15): pid=19531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 459.261807][T19539] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3426'. [ 459.268840][T19537] syzkaller0: entered promiscuous mode [ 459.284884][T19537] syzkaller0: entered allmulticast mode [ 459.385539][T19549] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3429'. [ 459.444430][T19549] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3429'. [ 459.484091][T19549] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3429'. [ 459.900567][T19574] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 459.980733][T19561] lo speed is unknown, defaulting to 1000 [ 460.219412][T19585] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 460.255283][T19585] netlink: 'syz.3.3436': attribute type 10 has an invalid length. [ 460.301481][T19585] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3436'. [ 460.559431][T19561] lo speed is unknown, defaulting to 1000 [ 460.574177][T19589] netlink: 'syz.2.3439': attribute type 142 has an invalid length. [ 461.083831][T19608] 8021q: VLANs not supported on lo [ 461.366119][T19620] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3446'. [ 461.389281][T19621] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3446'. [ 461.442528][T19624] netlink: 'syz.0.3447': attribute type 4 has an invalid length. [ 461.474076][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 461.492291][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 461.541420][T19624] tipc: New replicast peer: 255.255.255.255 [ 461.578591][T19624] tipc: Enabled bearer , priority 10 [ 461.741470][T19636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3451'. [ 461.794380][T19633] netlink: 'syz.4.3450': attribute type 3 has an invalid length. [ 461.802271][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 461.802306][ C1] lec:lec_tx_timeout: lec0 [ 461.815044][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 461.860907][T19633] netlink: 16154 bytes leftover after parsing attributes in process `syz.4.3450'. [ 461.925505][T19643] bond1: Unable to set down delay as MII monitoring is disabled [ 461.945520][T19643] bond1 (unregistering): Released all slaves [ 461.988481][T19641] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 462.414489][T19669] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3460'. [ 462.469145][T19671] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3460'. [ 462.578253][T19669] team1: entered promiscuous mode [ 462.583843][T19669] team1: entered allmulticast mode [ 462.592007][T19669] 8021q: adding VLAN 0 to HW filter on device team1 [ 462.716184][T19671] team2: entered promiscuous mode [ 462.729403][T19671] team2: entered allmulticast mode [ 462.735641][T19671] 8021q: adding VLAN 0 to HW filter on device team2 [ 462.743677][ T5915] tipc: Node number set to 1445284067 [ 462.877317][T19679] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3463'. [ 463.125937][T19692] lo speed is unknown, defaulting to 1000 [ 463.142057][T19691] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3467'. [ 463.167901][T19691] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3467'. [ 463.963886][T19722] tipc: Started in network mode [ 463.980052][T19722] tipc: Node identity 080211, cluster identity 4711 [ 464.009534][T19722] tipc: Enabled bearer , priority 0 [ 464.088806][T19723] lo: entered allmulticast mode [ 464.094198][T19725] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3475'. [ 464.515243][T19692] lo speed is unknown, defaulting to 1000 [ 464.601650][T19741] openvswitch: netlink: IP tunnel TTL not specified. [ 464.819338][T19748] team0 (unregistering): Port device team_slave_0 removed [ 464.859108][T19748] team0 (unregistering): Port device team_slave_1 removed [ 464.902806][T19754] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 465.155019][T14287] tipc: Node number set to 134353152 [ 465.197726][T19759] tipc: Enabling of bearer rejected, failed to enable media [ 465.261423][T19762] xt_hashlimit: size too large, truncated to 1048576 [ 465.790247][T19767] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.062192][T19780] openvswitch: netlink: Flow actions attr not present in new flow. [ 466.127670][T19767] bridge_slave_0 (unregistering): left allmulticast mode [ 466.176147][T19767] bridge_slave_0 (unregistering): left promiscuous mode [ 466.244061][T19767] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.820831][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 466.828946][ C1] lec:lec_tx_timeout: lec0 [ 466.834275][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 466.898029][T19783] bond1: option updelay: invalid value (18446744073709493611) [ 466.906105][T19783] bond1: option updelay: allowed values 0 - 2147483647 [ 466.963768][T19783] bond1 (unregistering): Released all slaves [ 467.270070][T19790] __nla_validate_parse: 3 callbacks suppressed [ 467.270089][T19790] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3493'. [ 467.385418][T19800] xt_hashlimit: size too large, truncated to 1048576 [ 468.572892][T19824] mac80211_hwsim hwsim53 syzkaller0: entered promiscuous mode [ 468.580475][T19824] mac80211_hwsim hwsim53 syzkaller0: entered allmulticast mode [ 468.815512][T19830] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.828943][T19835] openvswitch: netlink: Actions may not be safe on all matching packets [ 469.342741][T19859] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3508'. [ 469.381280][T19863] xt_hashlimit: size too large, truncated to 1048576 [ 469.632672][T19873] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.758344][T19873] bridge_slave_0 (unregistering): left allmulticast mode [ 469.801772][T19873] bridge_slave_0 (unregistering): left promiscuous mode [ 469.873300][T19873] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.296706][T19893] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3517'. [ 470.357368][T19893] 8021q: adding VLAN 0 to HW filter on device bond1 [ 470.422577][T19898] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 470.484288][T19893] team0: No ports can be present during mode change [ 470.505005][T19890] lo speed is unknown, defaulting to 1000 [ 470.763233][T19915] netlink: 'syz.1.3522': attribute type 21 has an invalid length. [ 470.780618][T19917] tipc: Started in network mode [ 470.791997][T19917] tipc: Node identity ac14140f, cluster identity 4711 [ 470.809265][T19917] tipc: New replicast peer: 255.255.255.255 [ 470.820619][T19917] tipc: Enabled bearer , priority 10 [ 470.841084][T19919] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3523'. [ 470.865115][T19915] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3522'. [ 470.885253][T19915] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3522'. [ 471.158184][T19935] 8021q: adding VLAN 0 to HW filter on device .` [ 471.186234][T19935] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 471.233756][T19938] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3529'. [ 471.273196][T19938] nbd: illegal input index -1113835520 [ 471.565965][T19890] lo speed is unknown, defaulting to 1000 [ 471.565976][T19933] lo speed is unknown, defaulting to 1000 [ 471.807153][T19933] lo speed is unknown, defaulting to 1000 [ 471.841552][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 471.849728][ C1] lec:lec_tx_timeout: lec0 [ 471.855451][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 472.461143][ T6375] tipc: Node number set to 2886997007 [ 472.510229][T19966] bond2: invalid ARP target 0.0.0.0 specified for addition [ 472.540912][T19966] bond2: option arp_ip_target: invalid value (0) [ 472.568831][T19966] bond2 (unregistering): Released all slaves [ 472.744614][T19968] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3538'. [ 473.671451][T19999] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3545'. [ 473.733876][T20005] veth1_to_team: Caught tx_queue_len zero misconfig [ 473.740599][T20005] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3545'. [ 473.779146][T20007] xt_hashlimit: size too large, truncated to 1048576 [ 474.004945][T20014] netlink: 'syz.4.3549': attribute type 10 has an invalid length. [ 474.090091][T20021] 5nè‹Ò: entered promiscuous mode [ 474.105311][T20021] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3552'. [ 474.360685][T20015] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.469011][T20015] bridge_slave_0 (unregistering): left allmulticast mode [ 474.548882][T20015] bridge_slave_0 (unregistering): left promiscuous mode [ 474.560229][T20015] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.667701][T20038] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3556'. [ 474.887346][T20032] batadv0: entered promiscuous mode [ 474.903683][T20034] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3555'. [ 474.920960][T20034] batadv0: left promiscuous mode [ 474.927634][T20042] tipc: Enabling of bearer rejected, failed to enable media [ 475.413807][T20047] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3560'. [ 476.014268][ T30] audit: type=1800 audit(1775896541.911:16): pid=20073 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3567" name="regulatory.db.p7s" dev="sda1" ino=449 res=0 errno=0 [ 476.014641][T20073] faux_driver regulatory: loading /lib/firmware/regulatory.db.p7s failed with error -4 [ 476.119209][T20073] faux_driver regulatory: Direct firmware load for regulatory.db.p7s failed with error -4 [ 476.193176][T20073] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db.p7s [ 476.253137][T20088] netlink: 4456 bytes leftover after parsing attributes in process `syz.3.3571'. [ 476.357703][T20091] lo speed is unknown, defaulting to 1000 [ 476.678080][T20101] Cannot find add_set index 3 as target [ 476.695295][T20101] Cannot find add_set index 3 as target [ 476.742297][T20101] Cannot find add_set index 3 as target [ 476.789796][T20101] Cannot find add_set index 3 as target [ 476.821853][T20101] Cannot find add_set index 3 as target [ 476.827800][T20101] Cannot find add_set index 3 as target [ 476.834656][T20101] Cannot find add_set index 3 as target [ 476.848102][T20101] Cannot find add_set index 3 as target [ 476.870826][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 476.878932][ C1] lec:lec_tx_timeout: lec0 [ 476.888439][T20101] Cannot find add_set index 3 as target [ 476.912796][T20101] Cannot find add_set index 3 as target [ 477.173162][T20108] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3576'. [ 477.182421][T20108] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3576'. [ 477.210847][T20108] netlink: 'syz.3.3576': attribute type 18 has an invalid length. [ 477.253434][T20091] lo speed is unknown, defaulting to 1000 [ 477.587139][T20128] openvswitch: netlink: Actions may not be safe on all matching packets [ 478.032181][T20117] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.931431][T20117] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 479.003975][T20117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 479.412497][T20155] __nla_validate_parse: 3 callbacks suppressed [ 479.412517][T20155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3584'. [ 480.132955][T10054] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.151809][T10054] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.178393][T10054] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.220050][T20162] vlan3: entered promiscuous mode [ 480.244027][T20162] bridge0: entered promiscuous mode [ 480.289806][T10054] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.456665][T20176] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3591'. [ 480.488488][T20183] netlink: 'syz.3.3590': attribute type 5 has an invalid length. [ 480.657463][T20193] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3592'. [ 481.041588][T20193] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 481.326906][T20208] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3596'. [ 481.355172][T20208] netlink: 'syz.4.3596': attribute type 1 has an invalid length. [ 481.376051][T20208] netlink: 'syz.4.3596': attribute type 7 has an invalid length. [ 481.401238][T20208] netlink: 'syz.4.3596': attribute type 8 has an invalid length. [ 481.429229][T20208] netlink: 208 bytes leftover after parsing attributes in process `syz.4.3596'. [ 481.476275][T20208] NCSI netlink: No device for ifindex 1073545264 [ 482.030962][T20241] delete_channel: no stack [ 482.231449][T20252] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3610'. [ 482.387582][T20268] tipc: Enabling of bearer rejected, already enabled [ 482.410187][T20262] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 482.510350][T20262] tipc: Resetting bearer [ 483.015463][T20300] netlink: 92 bytes leftover after parsing attributes in process `syz.1.3620'. [ 483.040068][T20300] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3620'. [ 483.051110][T20300] tc_dump_action: action bad kind [ 483.326252][T20318] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3625'. [ 483.382193][T20318] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3625'. [ 483.839275][T20345] syzkaller0: entered promiscuous mode [ 483.888544][T20347] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 483.906254][T20345] syzkaller0: entered allmulticast mode [ 484.394437][T20379] rdma_op ffff88801afd51f0 conn xmit_rdma 0000000000000000 [ 484.546872][T20386] __nla_validate_parse: 2 callbacks suppressed [ 484.546890][T20386] netlink: 1692 bytes leftover after parsing attributes in process `syz.3.3644'. [ 485.033148][T20412] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3646'. [ 485.303929][T20425] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3648'. [ 486.919162][T20497] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 486.967728][T20496] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 487.881493][T20527] netlink: zone id is out of range [ 487.886983][T20527] netlink: del zone limit has 8 unknown bytes [ 488.146492][T20535] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3671'. [ 488.345928][T20547] netlink: 'syz.1.3674': attribute type 13 has an invalid length. [ 488.368724][T20552] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3672'. [ 488.502925][T20535] macvlan3: entered allmulticast mode [ 488.517376][T20535] hsr0: entered allmulticast mode [ 488.530139][T20535] hsr_slave_0: entered allmulticast mode [ 488.542644][T20535] hsr_slave_1: entered allmulticast mode [ 488.609083][T20547] mac80211_hwsim hwsim0 wlan0: entered promiscuous mode [ 488.637227][T20547] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 489.232110][T20570] netlink: 'syz.1.3678': attribute type 1 has an invalid length. [ 489.282159][T20574] netlink: 'syz.3.3679': attribute type 1 has an invalid length. [ 489.305289][T20570] 8021q: adding VLAN 0 to HW filter on device bond2 [ 489.315894][T20574] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3679'. [ 490.043953][T20603] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.097451][T20614] batadv_slave_0: Caught tx_queue_len zero misconfig [ 490.200627][T20603] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.289241][T20603] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.386648][T20603] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.563292][T10054] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.575960][T20610] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3688'. [ 490.607971][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880a8b80000: rx timeout, send abort [ 490.618085][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880a8b80000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 490.687746][ T146] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.707053][ T146] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.944837][ T8305] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.128221][T20647] netlink: 'syz.4.3695': attribute type 1 has an invalid length. [ 491.216890][T20647] bond1: entered promiscuous mode [ 491.223018][T20647] 8021q: adding VLAN 0 to HW filter on device bond1 [ 491.237389][T20653] FAULT_INJECTION: forcing a failure. [ 491.237389][T20653] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 491.254318][T20650] ip6tnl1: entered allmulticast mode [ 491.267270][T10054] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 491.292587][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 491.300430][T10054] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 491.326387][T20653] CPU: 0 UID: 0 PID: 20653 Comm: syz.0.3697 Not tainted syzkaller #0 PREEMPT(full) [ 491.326428][T20653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 491.326454][T20653] Call Trace: [ 491.326462][T20653] [ 491.326470][T20653] dump_stack_lvl+0xe8/0x150 [ 491.326503][T20653] should_fail_ex+0x412/0x560 [ 491.326540][T20653] _copy_from_user+0x2d/0xb0 [ 491.326565][T20653] ___sys_sendmsg+0x1c6/0x360 [ 491.326602][T20653] ? __pfx____sys_sendmsg+0x10/0x10 [ 491.326666][T20653] ? __fget_files+0x2a/0x420 [ 491.326684][T20653] ? __fget_files+0x3a0/0x420 [ 491.326712][T20653] __x64_sys_sendmsg+0x1bd/0x2a0 [ 491.326745][T20653] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 491.326792][T20653] ? __pfx_ksys_write+0x10/0x10 [ 491.326826][T20653] do_syscall_64+0x14d/0xf80 [ 491.326846][T20653] ? trace_irq_disable+0x3b/0x150 [ 491.326863][T20653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.326884][T20653] ? clear_bhb_loop+0x40/0x90 [ 491.326908][T20653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.326928][T20653] RIP: 0033:0x7f0c0459c819 [ 491.326946][T20653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.326964][T20653] RSP: 002b:00007f0c05495028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 491.326985][T20653] RAX: ffffffffffffffda RBX: 00007f0c04815fa0 RCX: 00007f0c0459c819 [ 491.327000][T20653] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 491.327013][T20653] RBP: 00007f0c05495090 R08: 0000000000000000 R09: 0000000000000000 [ 491.327025][T20653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.327037][T20653] R13: 00007f0c04816038 R14: 00007f0c04815fa0 R15: 00007fffe5580688 [ 491.327069][T20653] [ 491.638248][T20660] bridge0: port 3(ip6gretap0) entered blocking state [ 491.647595][T20660] bridge0: port 3(ip6gretap0) entered disabled state [ 491.655318][T20660] ip6gretap0: entered allmulticast mode [ 491.664058][T20660] ip6gretap0: entered promiscuous mode [ 491.670314][T20660] bridge0: port 3(ip6gretap0) entered blocking state [ 491.677827][T20660] bridge0: port 3(ip6gretap0) entered forwarding state [ 491.731015][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 491.851445][T20666] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3702'. [ 491.861446][T14287] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 491.873955][T20672] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3704'. [ 491.902105][T20672] netlink: 261 bytes leftover after parsing attributes in process `syz.2.3704'. [ 491.988119][T20666] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3702'. [ 492.255902][T11429] lec:lec_start_xmit: lec0:No lecd attached [ 492.278911][T20680] syzkaller0: entered promiscuous mode [ 492.302822][T20680] syzkaller0: entered allmulticast mode [ 492.335551][T20695] FAULT_INJECTION: forcing a failure. [ 492.335551][T20695] name failslab, interval 1, probability 0, space 0, times 0 [ 492.348722][T20695] CPU: 0 UID: 0 PID: 20695 Comm: syz.4.3710 Not tainted syzkaller #0 PREEMPT(full) [ 492.348750][T20695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 492.348764][T20695] Call Trace: [ 492.348772][T20695] [ 492.348782][T20695] dump_stack_lvl+0xe8/0x150 [ 492.348816][T20695] should_fail_ex+0x412/0x560 [ 492.348855][T20695] should_failslab+0xa8/0x100 [ 492.348886][T20695] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 492.348912][T20695] ? __alloc_skb+0x186/0x7d0 [ 492.348939][T20695] ? __alloc_skb+0x1d0/0x7d0 [ 492.348964][T20695] ? __local_bh_enable_ip+0xd0/0x130 [ 492.348997][T20695] __alloc_skb+0x1d0/0x7d0 [ 492.349028][T20695] netlink_sendmsg+0x5d4/0xb40 [ 492.349066][T20695] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.349098][T20695] ? aa_sock_msg_perm+0xf1/0x1b0 [ 492.349120][T20695] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 492.349148][T20695] ____sys_sendmsg+0x972/0x9f0 [ 492.349189][T20695] ? __pfx_____sys_sendmsg+0x10/0x10 [ 492.349227][T20695] ? import_iovec+0x73/0xa0 [ 492.349256][T20695] ___sys_sendmsg+0x2a5/0x360 [ 492.349292][T20695] ? __pfx____sys_sendmsg+0x10/0x10 [ 492.349368][T20695] ? __fget_files+0x2a/0x420 [ 492.349387][T20695] ? __fget_files+0x3a0/0x420 [ 492.349415][T20695] __x64_sys_sendmsg+0x1bd/0x2a0 [ 492.349449][T20695] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 492.349490][T20695] ? __pfx_ksys_write+0x10/0x10 [ 492.349526][T20695] do_syscall_64+0x14d/0xf80 [ 492.349545][T20695] ? trace_irq_disable+0x3b/0x150 [ 492.349563][T20695] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.349584][T20695] ? clear_bhb_loop+0x40/0x90 [ 492.349609][T20695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.349629][T20695] RIP: 0033:0x7ffa4e99c819 [ 492.349648][T20695] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.349665][T20695] RSP: 002b:00007ffa4f8bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.349687][T20695] RAX: ffffffffffffffda RBX: 00007ffa4ec15fa0 RCX: 00007ffa4e99c819 [ 492.349707][T20695] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 492.349720][T20695] RBP: 00007ffa4f8bb090 R08: 0000000000000000 R09: 0000000000000000 [ 492.349733][T20695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.349745][T20695] R13: 00007ffa4ec16038 R14: 00007ffa4ec15fa0 R15: 00007ffeb28cddc8 [ 492.349777][T20695] [ 492.862153][T20706] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3713'. [ 493.065903][T20713] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3716'. [ 493.179842][T20716] erspan0: entered promiscuous mode [ 493.202775][T20716] macsec2: entered promiscuous mode [ 493.223777][T20716] erspan0: left promiscuous mode [ 493.240398][T20723] openvswitch: netlink: Actions may not be safe on all matching packets [ 493.278776][T20719] netlink: 'syz.3.3719': attribute type 39 has an invalid length. [ 493.756400][T20735] syzkaller0: entered promiscuous mode [ 493.762320][T20735] syzkaller0: entered allmulticast mode [ 493.943412][T20743] netem: change failed [ 493.963762][T20747] veth0_virt_wifi: Caught tx_queue_len zero misconfig [ 494.025457][T20747] netem: incorrect ge model size [ 494.060787][T20747] netem: change failed [ 494.224053][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.233640][ T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.275708][ T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.330967][ T8305] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.352230][T20754] syzkaller0: entered promiscuous mode [ 494.382770][T20754] syzkaller0: entered allmulticast mode [ 494.408572][T20754] xt_hashlimit: overflow, try lower: 0/0 [ 494.440854][T20769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3730'. [ 494.524892][T20769] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 494.796744][T20780] syzkaller1: entered promiscuous mode [ 494.827951][T20780] syzkaller1: entered allmulticast mode [ 494.848136][T20784] netlink: 'syz.2.3732': attribute type 13 has an invalid length. [ 494.876859][T20785] IPv6: addrconf: prefix option has invalid lifetime [ 494.907792][T20784] netlink: 24859 bytes leftover after parsing attributes in process `syz.2.3732'. [ 495.359386][T20796] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3737'. [ 495.761019][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 496.355433][T20815] netlink: 'syz.4.3742': attribute type 2 has an invalid length. [ 496.550956][T20826] netlink: 'syz.3.3743': attribute type 2 has an invalid length. [ 496.567063][T20830] __nla_validate_parse: 1 callbacks suppressed [ 496.567088][T20830] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3746'. [ 496.608505][T20826] !: entered promiscuous mode [ 496.660362][T20831] geneve2: entered promiscuous mode [ 496.670104][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 496.720818][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 496.809719][T20838] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3743'. [ 497.180332][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.193831][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.398670][T20860] dvmrp2: entered allmulticast mode [ 497.760798][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5500 ms [ 497.768919][ C1] lec:lec_tx_timeout: lec0 [ 497.876069][T20882] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3759'. [ 498.045041][T20885] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3760'. [ 498.067956][T20885] netlink: 'syz.3.3760': attribute type 13 has an invalid length. [ 498.075973][T20885] netlink: 168 bytes leftover after parsing attributes in process `syz.3.3760'. [ 498.139493][T20887] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3762'. [ 498.253937][T20893] --map-set only usable from mangle table [ 498.322756][T20898] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3762'. [ 498.373859][T20893] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3764'. [ 498.602961][T20901] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 498.648889][T20900] netlink: 'syz.0.3765': attribute type 1 has an invalid length. [ 498.938538][T20900] 8021q: adding VLAN 0 to HW filter on device bond1 [ 498.994474][T20905] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3761'. [ 499.035107][T20912] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 499.058158][T20906] bridge_slave_1: left allmulticast mode [ 499.075573][T20906] bridge_slave_1: left promiscuous mode [ 499.098113][T20906] bridge0: port 2(bridge_slave_1) entered disabled state [ 499.232604][T20915] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3766'. [ 499.501950][T20922] lo speed is unknown, defaulting to 1000 [ 499.849438][T20942] veth0_to_bond: Caught tx_queue_len zero misconfig [ 499.876855][T20942] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 499.905191][T20942] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 500.161752][T20949] netlink: 'syz.3.3774': attribute type 1 has an invalid length. [ 500.186267][T20954] netlink: 'syz.1.3775': attribute type 10 has an invalid length. [ 500.249668][T20954] veth0: entered promiscuous mode [ 500.302500][T20921] lo speed is unknown, defaulting to 1000 [ 500.337360][T20922] lo speed is unknown, defaulting to 1000 [ 500.379416][T20954] veth0: left promiscuous mode [ 500.828997][T21002] netlink: 'syz.0.3780': attribute type 4 has an invalid length. [ 501.036564][T21008] x_tables: duplicate underflow at hook 1 [ 501.392548][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 501.398981][ T5837] block nbd0: Receive control failed (result -110) [ 501.478227][T20921] lo speed is unknown, defaulting to 1000 [ 501.642964][T21039] __nla_validate_parse: 4 callbacks suppressed [ 501.642985][T21039] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3788'. [ 501.849744][T21047] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3790'. [ 501.878395][T21049] [ 501.880801][T21049] ====================================================== [ 501.887856][T21049] WARNING: possible circular locking dependency detected [ 501.894909][T21049] syzkaller #0 Not tainted [ 501.899349][T21049] ------------------------------------------------------ [ 501.906390][T21049] syz.2.3787/21049 is trying to acquire lock: [ 501.912489][T21049] ffffffff8e883760 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x152/0x650 [ 501.921689][T21049] [ 501.921689][T21049] but task is already holding lock: [ 501.929078][T21049] ffff88813fe3a800 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 501.938613][T21049] [ 501.938613][T21049] which lock already depends on the new lock. [ 501.938613][T21049] [ 501.949040][T21049] [ 501.949040][T21049] the existing dependency chain (in reverse order) is: [ 501.958080][T21049] [ 501.958080][T21049] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 501.965684][T21049] __might_fault+0xcb/0x130 [ 501.970748][T21049] _copy_from_user+0x28/0xb0 [ 501.975889][T21049] csum_and_copy_from_iter_full+0x1e7/0x1f00 [ 501.982442][T21049] ip_generic_getfrag+0x149/0x2d0 [ 501.988015][T21049] __ip6_append_data+0x39e4/0x3f70 [ 501.993676][T21049] ip6_append_data+0x10f/0x280 [ 501.998987][T21049] rawv6_sendmsg+0x12d3/0x18e0 [ 502.004287][T21049] ____sys_sendmsg+0x80a/0x9f0 [ 502.009608][T21049] ___sys_sendmsg+0x2a5/0x360 [ 502.014847][T21049] __x64_sys_sendmsg+0x1bd/0x2a0 [ 502.020345][T21049] do_syscall_64+0x14d/0xf80 [ 502.025470][T21049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.031898][T21049] [ 502.031898][T21049] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 502.039671][T21049] lock_sock_nested+0x41/0x100 [ 502.044987][T21049] inet_shutdown+0x6a/0x390 [ 502.050118][T21049] nbd_mark_nsock_dead+0x2e9/0x560 [ 502.055770][T21049] recv_work+0x1c7f/0x1d90 [ 502.060755][T21049] process_scheduled_works+0xb6e/0x18c0 [ 502.066853][T21049] worker_thread+0xa53/0xfc0 [ 502.071986][T21049] kthread+0x388/0x470 [ 502.076591][T21049] ret_from_fork+0x51e/0xb90 [ 502.081736][T21049] ret_from_fork_asm+0x1a/0x30 [ 502.087051][T21049] [ 502.087051][T21049] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 502.094744][T21049] __mutex_lock+0x19f/0x1300 [ 502.099873][T21049] nbd_queue_rq+0x37b/0x1100 [ 502.105013][T21049] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 502.111096][T21049] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 502.117961][T21049] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 502.124470][T21049] blk_mq_run_hw_queue+0x348/0x4f0 [ 502.130111][T21049] blk_mq_dispatch_list+0xd16/0xe10 [ 502.135934][T21049] blk_mq_flush_plug_list+0x48d/0x570 [ 502.141857][T21049] __blk_flush_plug+0x3ed/0x4d0 [ 502.147255][T21049] __submit_bio+0x28d/0x580 [ 502.152325][T21049] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 502.158509][T21049] block_read_full_folio+0x599/0x830 [ 502.164337][T21049] filemap_read_folio+0x137/0x3b0 [ 502.170079][T21049] do_read_cache_folio+0x358/0x590 [ 502.175725][T21049] read_part_sector+0xb6/0x2b0 [ 502.181024][T21049] adfspart_check_ICS+0xa5/0xa40 [ 502.186519][T21049] bdev_disk_changed+0x7ba/0x1550 [ 502.192174][T21049] blkdev_get_whole+0x380/0x510 [ 502.197584][T21049] bdev_open+0x31e/0xd30 [ 502.202378][T21049] blkdev_open+0x470/0x610 [ 502.207341][T21049] do_dentry_open+0x785/0x14e0 [ 502.212660][T21049] vfs_open+0x3b/0x340 [ 502.217273][T21049] path_openat+0x2e08/0x3860 [ 502.222414][T21049] do_file_open+0x23e/0x4a0 [ 502.227470][T21049] do_sys_openat2+0x113/0x200 [ 502.232697][T21049] __x64_sys_openat+0x138/0x170 [ 502.238101][T21049] do_syscall_64+0x14d/0xf80 [ 502.243224][T21049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.249663][T21049] [ 502.249663][T21049] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 502.256913][T21049] __mutex_lock+0x19f/0x1300 [ 502.262056][T21049] nbd_queue_rq+0xc6/0x1100 [ 502.267110][T21049] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 502.273208][T21049] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 502.280081][T21049] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 502.286632][T21049] blk_mq_run_hw_queue+0x348/0x4f0 [ 502.292286][T21049] blk_mq_dispatch_list+0xd16/0xe10 [ 502.298041][T21049] blk_mq_flush_plug_list+0x48d/0x570 [ 502.303953][T21049] __blk_flush_plug+0x3ed/0x4d0 [ 502.309373][T21049] __submit_bio+0x28d/0x580 [ 502.314436][T21049] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 502.320621][T21049] block_read_full_folio+0x599/0x830 [ 502.326456][T21049] filemap_read_folio+0x137/0x3b0 [ 502.332037][T21049] do_read_cache_folio+0x358/0x590 [ 502.337711][T21049] read_part_sector+0xb6/0x2b0 [ 502.343193][T21049] adfspart_check_ICS+0xa5/0xa40 [ 502.348672][T21049] bdev_disk_changed+0x7ba/0x1550 [ 502.354241][T21049] blkdev_get_whole+0x380/0x510 [ 502.359629][T21049] bdev_open+0x31e/0xd30 [ 502.364408][T21049] blkdev_open+0x470/0x610 [ 502.369364][T21049] do_dentry_open+0x785/0x14e0 [ 502.374700][T21049] vfs_open+0x3b/0x340 [ 502.379313][T21049] path_openat+0x2e08/0x3860 [ 502.384442][T21049] do_file_open+0x23e/0x4a0 [ 502.389482][T21049] do_sys_openat2+0x113/0x200 [ 502.394715][T21049] __x64_sys_openat+0x138/0x170 [ 502.400129][T21049] do_syscall_64+0x14d/0xf80 [ 502.405258][T21049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.411702][T21049] [ 502.411702][T21049] -> #3 (set->srcu){.+.+}-{0:0}: [ 502.418858][T21049] __synchronize_srcu+0xca/0x300 [ 502.424348][T21049] elevator_switch+0x1e8/0x7a0 [ 502.429658][T21049] elevator_change+0x2cc/0x450 [ 502.434963][T21049] elevator_set_default+0x36c/0x430 [ 502.440704][T21049] blk_register_queue+0x366/0x430 [ 502.446406][T21049] __add_disk+0x677/0xd50 [ 502.451458][T21049] add_disk_fwnode+0xfb/0x480 [ 502.456695][T21049] nbd_dev_add+0x72c/0xb50 [ 502.461653][T21049] nbd_init+0x168/0x1f0 [ 502.466523][T21049] do_one_initcall+0x250/0x8d0 [ 502.471832][T21049] do_initcall_level+0x104/0x190 [ 502.477327][T21049] do_initcalls+0x59/0xa0 [ 502.482386][T21049] kernel_init_freeable+0x2a6/0x3e0 [ 502.488150][T21049] kernel_init+0x1d/0x1d0 [ 502.493026][T21049] ret_from_fork+0x51e/0xb90 [ 502.498184][T21049] ret_from_fork_asm+0x1a/0x30 [ 502.503489][T21049] [ 502.503489][T21049] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 502.511353][T21049] __mutex_lock+0x19f/0x1300 [ 502.516490][T21049] elevator_change+0x1b3/0x450 [ 502.521884][T21049] elevator_set_none+0xb5/0x140 [ 502.527279][T21049] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 502.533631][T21049] nbd_start_device+0x17f/0xb10 [ 502.539023][T21049] nbd_genl_connect+0x165b/0x1cf0 [ 502.544581][T21049] genl_family_rcv_msg_doit+0x22a/0x330 [ 502.550674][T21049] genl_rcv_msg+0x61c/0x7a0 [ 502.555716][T21049] netlink_rcv_skb+0x232/0x4b0 [ 502.561048][T21049] genl_rcv+0x28/0x40 [ 502.565565][T21049] netlink_unicast+0x80f/0x9b0 [ 502.570875][T21049] netlink_sendmsg+0x813/0xb40 [ 502.576366][T21049] ____sys_sendmsg+0x972/0x9f0 [ 502.581681][T21049] ___sys_sendmsg+0x2a5/0x360 [ 502.586926][T21049] __x64_sys_sendmsg+0x1bd/0x2a0 [ 502.592431][T21049] do_syscall_64+0x14d/0xf80 [ 502.597685][T21049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.604131][T21049] [ 502.604131][T21049] -> #1 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 502.612757][T21049] blk_alloc_queue+0x546/0x680 [ 502.618070][T21049] __blk_mq_alloc_disk+0x197/0x390 [ 502.623726][T21049] nbd_dev_add+0x499/0xb50 [ 502.628696][T21049] nbd_init+0x168/0x1f0 [ 502.633393][T21049] do_one_initcall+0x250/0x8d0 [ 502.638709][T21049] do_initcall_level+0x104/0x190 [ 502.644194][T21049] do_initcalls+0x59/0xa0 [ 502.649064][T21049] kernel_init_freeable+0x2a6/0x3e0 [ 502.654807][T21049] kernel_init+0x1d/0x1d0 [ 502.659674][T21049] ret_from_fork+0x51e/0xb90 [ 502.664799][T21049] ret_from_fork_asm+0x1a/0x30 [ 502.670106][T21049] [ 502.670106][T21049] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 502.677327][T21049] __lock_acquire+0x15a5/0x2cf0 [ 502.682732][T21049] lock_acquire+0xf0/0x2e0 [ 502.687699][T21049] fs_reclaim_acquire+0x71/0x100 [ 502.693182][T21049] prepare_alloc_pages+0x152/0x650 [ 502.698839][T21049] __alloc_frozen_pages_noprof+0x12f/0x380 [ 502.705192][T21049] alloc_pages_mpol+0x232/0x4a0 [ 502.710587][T21049] vma_alloc_folio_noprof+0xea/0x210 [ 502.716414][T21049] do_wp_page+0x1204/0x5a00 [ 502.721463][T21049] handle_mm_fault+0x1520/0x3310 [ 502.726952][T21049] do_user_addr_fault+0x75b/0x1340 [ 502.732618][T21049] exc_page_fault+0x6a/0xc0 [ 502.737665][T21049] asm_exc_page_fault+0x26/0x30 [ 502.743059][T21049] rep_movs_alternative+0x33/0x90 [ 502.748639][T21049] _copy_to_user+0x8a/0xb0 [ 502.753597][T21049] do_ip_vs_get_ctl+0x701/0xe80 [ 502.758996][T21049] nf_getsockopt+0x26e/0x290 [ 502.764126][T21049] ip_getsockopt+0x19e/0x230 [ 502.769251][T21049] do_sock_getsockopt+0x2d3/0x3f0 [ 502.774826][T21049] __x64_sys_getsockopt+0x1a4/0x240 [ 502.780584][T21049] do_syscall_64+0x14d/0xf80 [ 502.785711][T21049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.792143][T21049] [ 502.792143][T21049] other info that might help us debug this: [ 502.792143][T21049] [ 502.802398][T21049] Chain exists of: [ 502.802398][T21049] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 502.802398][T21049] [ 502.815038][T21049] Possible unsafe locking scenario: [ 502.815038][T21049] [ 502.822522][T21049] CPU0 CPU1 [ 502.827900][T21049] ---- ---- [ 502.833283][T21049] rlock(&mm->mmap_lock); [ 502.837725][T21049] lock(sk_lock-AF_INET6); [ 502.844767][T21049] lock(&mm->mmap_lock); [ 502.851635][T21049] lock(fs_reclaim); [ 502.855636][T21049] [ 502.855636][T21049] *** DEADLOCK *** [ 502.855636][T21049] [ 502.863873][T21049] 2 locks held by syz.2.3787/21049: [ 502.869093][T21049] #0: ffff888021f84d70 (ipvs->sync_mutex){+.+.}-{4:4}, at: do_ip_vs_get_ctl+0x36e/0xe80 [ 502.879004][T21049] #1: ffff88813fe3a800 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 502.888959][T21049] [ 502.888959][T21049] stack backtrace: [ 502.894880][T21049] CPU: 0 UID: 0 PID: 21049 Comm: syz.2.3787 Not tainted syzkaller #0 PREEMPT(full) [ 502.894900][T21049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 502.894911][T21049] Call Trace: [ 502.894919][T21049] [ 502.894928][T21049] dump_stack_lvl+0xe8/0x150 [ 502.894953][T21049] print_circular_bug+0x2e1/0x300 [ 502.894982][T21049] check_noncircular+0x12e/0x150 [ 502.895010][T21049] __lock_acquire+0x15a5/0x2cf0 [ 502.895042][T21049] lock_acquire+0xf0/0x2e0 [ 502.895062][T21049] ? prepare_alloc_pages+0x152/0x650 [ 502.895084][T21049] ? unwind_next_frame+0xa5/0x23c0 [ 502.895108][T21049] ? rcu_is_watching+0x15/0xb0 [ 502.895133][T21049] fs_reclaim_acquire+0x71/0x100 [ 502.895152][T21049] ? prepare_alloc_pages+0x152/0x650 [ 502.895172][T21049] prepare_alloc_pages+0x152/0x650 [ 502.895194][T21049] __alloc_frozen_pages_noprof+0x12f/0x380 [ 502.895218][T21049] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 502.895240][T21049] ? __pfx_policy_nodemask+0x10/0x10 [ 502.895261][T21049] ? arch_stack_walk+0xfb/0x150 [ 502.895290][T21049] alloc_pages_mpol+0x232/0x4a0 [ 502.895317][T21049] vma_alloc_folio_noprof+0xea/0x210 [ 502.895340][T21049] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 502.895366][T21049] do_wp_page+0x1204/0x5a00 [ 502.895399][T21049] ? __pfx_do_wp_page+0x10/0x10 [ 502.895423][T21049] ? do_raw_spin_lock+0x12b/0x2f0 [ 502.895440][T21049] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 502.895460][T21049] handle_mm_fault+0x1520/0x3310 [ 502.895481][T21049] ? handle_mm_fault+0xee/0x3310 [ 502.895498][T21049] ? __pfx_handle_mm_fault+0x10/0x10 [ 502.895519][T21049] ? lock_mm_and_find_vma+0xa7/0x340 [ 502.895538][T21049] do_user_addr_fault+0x75b/0x1340 [ 502.895568][T21049] exc_page_fault+0x6a/0xc0 [ 502.895584][T21049] asm_exc_page_fault+0x26/0x30 [ 502.895599][T21049] RIP: 0010:rep_movs_alternative+0x33/0x90 [ 502.895621][T21049] Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb [ 502.895635][T21049] RSP: 0018:ffffc90002ef79c8 EFLAGS: 00050216 [ 502.895650][T21049] RAX: 0000000000000000 RBX: 0000000000000030 RCX: 0000000000000030 [ 502.895661][T21049] RDX: 0000000000000000 RSI: ffffc90002ef7af0 RDI: 0000200000002100 [ 502.895672][T21049] RBP: ffffc90002ef7c58 R08: ffffc90002ef7b1f R09: 1ffff920005def63 [ 502.895684][T21049] R10: dffffc0000000000 R11: fffff520005def64 R12: 0000200000002130 [ 502.895696][T21049] R13: 00007ffffffff000 R14: ffffc90002ef7af0 R15: 0000200000002100 [ 502.895716][T21049] _copy_to_user+0x8a/0xb0 [ 502.895736][T21049] do_ip_vs_get_ctl+0x701/0xe80 [ 502.895763][T21049] ? __pfx_do_ip_vs_get_ctl+0x10/0x10 [ 502.895794][T21049] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 502.895813][T21049] ? __pfx___mutex_lock+0x10/0x10 [ 502.895829][T21049] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 502.895852][T21049] nf_getsockopt+0x26e/0x290 [ 502.895871][T21049] ip_getsockopt+0x19e/0x230 [ 502.895891][T21049] ? __pfx_ip_getsockopt+0x10/0x10 [ 502.895908][T21049] ? sock_common_getsockopt+0x2d/0xb0 [ 502.895933][T21049] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 502.895954][T21049] do_sock_getsockopt+0x2d3/0x3f0 [ 502.895979][T21049] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 502.896003][T21049] ? __fget_files+0x3a0/0x420 [ 502.896017][T21049] ? __fget_files+0x2a/0x420 [ 502.896034][T21049] __x64_sys_getsockopt+0x1a4/0x240 [ 502.896061][T21049] do_syscall_64+0x14d/0xf80 [ 502.896076][T21049] ? trace_irq_disable+0x3b/0x150 [ 502.896090][T21049] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.896106][T21049] ? clear_bhb_loop+0x40/0x90 [ 502.896125][T21049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.896140][T21049] RIP: 0033:0x7fdc6159c819 [ 502.896154][T21049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.896168][T21049] RSP: 002b:00007fdc623f0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 502.896183][T21049] RAX: ffffffffffffffda RBX: 00007fdc61816270 RCX: 00007fdc6159c819 [ 502.896196][T21049] RDX: 0000000000000487 RSI: 0000000000000000 RDI: 0000000000000008 [ 502.896205][T21049] RBP: 00007fdc61632c91 R08: 0000200000000000 R09: 0000000000000000 [ 502.896216][T21049] R10: 0000200000002100 R11: 0000000000000246 R12: 0000000000000000 [ 502.896226][T21049] R13: 00007fdc61816308 R14: 00007fdc61816270 R15: 00007ffd9ebcbcb8 [ 502.896244][T21049] [ 503.440809][ T5837] Bluetooth: hci5: command 0x0406 tx timeout [ 503.486098][T21044] syzkaller0: entered promiscuous mode [ 503.516514][T21044] syzkaller0: entered allmulticast mode [ 503.563410][T21038] lo speed is unknown, defaulting to 1000 [ 503.582996][T21047] vlan4: entered promiscuous mode [ 503.591499][T21047] bridge0: entered promiscuous mode [ 503.730793][T21038] lo speed is unknown, defaulting to 1000 [ 503.743068][T21042] lo speed is unknown, defaulting to 1000 [ 503.925357][T21042] lo speed is unknown, defaulting to 1000 [ 504.560985][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 506.720805][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5330 ms [ 506.728832][ C1] lec:lec_tx_timeout: lec0