last executing test programs: 9.380499897s ago: executing program 1 (id=5609): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r0, &(0x7f0000000bc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000b80)={&(0x7f0000000c00)=ANY=[@ANYBLOB="6409000000050101000000000000000007000002540201000300000000feffff004401007206060073797a31000000000000000000000000000000000000000000000000000000003ae5f6a4d1cb6dac016fb5f49e154b2974a28cef282216680b35c6bd19a9d7ca567dcbf0e14a1e1221b21646e163a9f1a72cbda5847087de070392ee3fa6cb4106009a00030000000700000002000000030000008100000008008800020000000100000098000500000000000600000003008700000000001f1d00000200070001000000ff0700000900040001000000040000000200010001000000f8fffffffbff020003000000060000000900ff03030000000300000003000900010000000900000000e009000300000004000000000008000200000000000000ff010e000100000002000000400102000000000001ba000004000800030000000400000008000900020000000700000000080500030000000600000039000080010000000d0000000000090000000000000000000800feff020000003bd300000100090002000000070000000700000000000000080000000e334002020000000300000007000600020000000100000008005cf40200000005000000060006000300000008000000070009000300000005000000090005000100000003000000030001000100000002000000ffff090000000000fffbffff09000300010000000600000003000300030000000300000040000000010000000100000061000200020000000b0000000d00610c03000000010000000500030000000000ff0100006cfffaff000000000900000006000800030000004a00000002007f000200000009000000540201000500000003000000039aeb004000270073797a31000000000000000000000000000000000200000000000000000000006812c4ab3ff25fe4e5cd4b668456672c392020bb9b5968a101a020a2bc94e3b451e7598a55a0cf3be4139e32b230e5f1ac06fdeb9c83c61488aacff492f42df00d0004000100000002000000cb0f367d02000000420800000200010002000000000100000600010003000000050000000101070000000000f74a000008000000030000009c0300008004f2000200000007000000fbd9fe090300000004000000ff07ff0f02000000050000000100b200030000000d000000ff07ff0f0000000007000000ffff06000200000009000000663005000300000003000000850b0b00020000007886000002000900020000000900000000000000020006004ae000000800000002000000050000000800010003000000010000000300400000000000ffffffffffffc00002000000000002000400030002000000010001000300030001000000030000008100c50e02000000000000000600fc0003000000050000000900008000000000faffffff06002c4001000000b90000000200040001000000faffffffc800060003000000000000000800000201000000ab7a00000800080003000000000000000000030001100000020000000700ffff01000000630500009eefbdbe01000000d86100000600090003000000010001000800800002000000160000000300030000000000010000000200c3a988a5e418599359f9ef04000100000003000000340c5900030000000400000000f80800010000000300000006000000020000000000000054020100030000000200000003ba06000400220073797a30000000000000000000000000000000000000000000000000000000004f46a17a394a891a881e1f8b54b2dc7198abae1a863195782cca979da3b0270124882e626ef4274e30111e5de5bf77f16ae691aee7e792fec58df139610d242b0100000001000000c2ffb051000833000300000008020000830007000000000003000000ff00f9ff00000000000200000500060000000000f0ffffff0000050d01000000279400000000020003000000ff0f0000060001000000000000000010904908000000000006000000ffff050001000000090000004aff0a00ec43598901000000ffffea00030000000200000006003e02010000001ed8000003008a0002000000ffffff7f07000200030000009a0800000900008003000000000000000300090003000000060000003afdd74903000000e70f0000a208ff7f01000000060000000400c76b010000000000000006000800010000000101000000007f0002000000050000000c00fcff030000000200000017bd03000000000004000000070001f001000000050000000400ffff0200000001000000050052810200000000000000ff7f040000000000050000000101080003000000070000001d08030003000000080000000300080002000000010000000400000801000000fbffffff06000200030000002c0000000500feff030000000200000000040400000000000d00000006000200010000000200000007000400030000002009000028b205000200000004000000ff00030003000000080000000500e60000000000ffff0000540201000200000002000000090081000600170073797a3100000000000000000000000000000000000000000000000000000000274d82e7ac9170e6c9ca4311e93bb74a66b079d4b9580d7c50ea9ced027691f57dfab1a3dfc1720ed758a9717d7c0421a0e01b93cedcacfcf3638f593d37773ade0001003c2e6d95010001000200be04000000000600000045c0ffff0200000005000000010008000000000007000000060802000000000001000000000808000300000000000000feff000202000000ff030000ff0001000100000068000000f700ffff01000000020000002c097a0001000000050000000600fcff03000000090000000500ff0703000000010000003f0f0e0001000000ccf6ffff0000030002000000d80000001603ff030200000003000000070005000200000007000000f7ff0a0001000000fe0b00000000080000000000faffffff0008070002000000030000004a2802000000000000000000dba10f000100000002000000040003000100000009000000050000000200000007000000ff00ffff03000000070000000700100003000000040000000500040002000000ed0600000002040003000000008000000200050003000000010001007000090003000000070000000500350f00000000ffffff7f2c040700000000000f0000000008120002000000ffffffff87e9070001000000ff0100000e00060000000000000000000010040003000000050000000300000201000000ff0100000400aa0003000000e40a00006eb64d0002000000008000000200ff7f0300000003000000060007000000000005000000"], 0x964}, 0x1, 0x0, 0x0, 0x44008}, 0x20008040) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a14010000090a010400000000000000000100000008000a400000000008000840000000010900010073797a3000000000090005400000002cd40009800800014000000006c80002800c00018008000140000000032400018008000140000000070800014000000008080001400000000908000140000000080c000180080001400000000a24000180080001400000000608000140000000ff080001400000000208000140000000013400018008000140764f15e2080001400000000708000140000000070800014000000000080001400000000908000140000000001c000180080001400000002808000140000000cb0800014000000003140001800800014000000005080001400000000108000340000000a4"], 0x13c}}, 0x0) 9.077843674s ago: executing program 1 (id=5611): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x16}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r1) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000100)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) close(0x4) unshare(0x6a040000) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, 0x0, 0x4000041) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {0xfff1, 0xc}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, 0x0, 0x0) r5 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'wrr\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x12d5f, 0x3}}, 0x44) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001300)={0xffffffffffffffff, 0x18000000000002a0, 0x8, 0x0, &(0x7f0000000000)="b9ff03076844268c", 0x0, 0x20000005, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x300) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) 8.54685948s ago: executing program 4 (id=5614): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00'], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000680)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32=r4, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) 8.131472815s ago: executing program 4 (id=5616): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000100000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000040)={&(0x7f00000008c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="780000001000030400000000fcdbdf2500000400", @ANYRES32=0x0, @ANYBLOB="00030000000000005000128009000100766c616e00000000400002800600010002000000340004800c0039004ef1f011ffffffff0c0001000300000000feffff0c00010005000000f7ffffff0c004100080000000000000008000500", @ANYRES32=r5], 0x78}}, 0x0) 7.58551226s ago: executing program 4 (id=5622): socket(0x2a, 0x2, 0x0) (async) r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) getsockopt(r2, 0x5, 0x9, &(0x7f00000003c0)=""/222, &(0x7f0000000180)=0xde) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet(0xa, 0x801, 0x84) (async) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) accept4(r7, 0x0, 0x0, 0x80000) (async) r8 = accept4(r7, 0x0, 0x0, 0x80000) setsockopt(r8, 0x84, 0x7f, &(0x7f00000001c0)="020000000980ffff", 0x8) recvmmsg(r8, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x1b, 0x4, 0x1, 0x1, 0x6c, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}, {[@lsrr={0x83, 0x23, 0x6b, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @remote, @multicast1, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @multicast2]}, @ssrr={0x89, 0xb, 0x9, [@multicast1, @local]}, @timestamp={0x44, 0xc, 0x8e, 0x0, 0x2, [0x9, 0x6]}, @rr={0x7, 0xb, 0x78, [@multicast1, @local]}, @timestamp={0x44, 0x10, 0x79, 0x0, 0x4, [0x0, 0x0, 0xfff]}]}}}}}) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) (async) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, 0x0, 0x0) 6.844325522s ago: executing program 4 (id=5624): socket(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x50}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0x2, 0x3, 0x2) (async) socket$kcm(0x2, 0x3, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000700)={{0x1}, 0x0, &(0x7f00000006c0)='%-010d \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000700)={{0x1}, 0x0, &(0x7f00000006c0)='%-010d \x00'}, 0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000600)=ANY=[], 0x10448) (async) write$cgroup_subtree(r0, &(0x7f0000000600)=ANY=[], 0x10448) bind$alg(0xffffffffffffffff, 0x0, 0x0) (async) bind$alg(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) unshare(0x62040200) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffc, 0xff, 0x80000000}, 0x1c) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x40, 0x0, 0x400, 0x0, 0x30, 0x0, 0xa3}, 0x9c) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x40, 0x0, 0x400, 0x0, 0x30, 0x0, 0xa3}, 0x9c) r4 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000400)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2d8d61c6823fc80d06f5ddc56c081bdb99be2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x128) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socket$inet(0x2, 0x80c, 0x40) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x41, &(0x7f0000000000)={&(0x7f0000000200)={0x58, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x4000004) (async) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x41, &(0x7f0000000000)={&(0x7f0000000200)={0x58, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x4000004) 6.54697274s ago: executing program 2 (id=5626): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000000100)=0xfffffffffffff9f9, 0x8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x710, 0x1100, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x0, 0x0, 0x5, 0x2f, 0x0, @empty, @private}}}}) setsockopt$inet6_tcp_buf(r3, 0x6, 0xd, &(0x7f0000000080)=':', 0x1) setsockopt$inet6_int(r3, 0x29, 0x31, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r6, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r7, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f0000000880)=r6, 0x1000000}, 0x20) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r9, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x4, &(0x7f0000000000)=@raw=[@map_val={0x18, 0x6, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x8}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffa}], &(0x7f0000000080)='syzkaller\x00', 0x101, 0xdb, &(0x7f0000000140)=""/219, 0x41100, 0x10, '\x00', r2, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x8005, 0x7, 0x101, 0x9}, 0x10, 0x0, 0x0, 0x9, &(0x7f00000002c0)=[r7, r6, r7, r7, r8, r7], &(0x7f0000000540)=[{0x2, 0x1, 0x1, 0x6}, {0x1, 0x1, 0xd, 0xa}, {0x3, 0x5, 0xd}, {0x1, 0x2, 0xb, 0x3}, {0x2, 0x3, 0x3, 0x1}, {0x3, 0x4, 0x2, 0x1}, {0x5, 0x1, 0x7, 0x5}, {0x4, 0x4, 0x10, 0xa}, {0x3, 0x3, 0xa, 0x7}], 0x10, 0x4c}, 0x94) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r11, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) r12 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r12, 0x84, 0x2, &(0x7f0000000340)={0xfff8, 0xfffd, 0xa0, 0xffff}, 0x8) sendmmsg$inet(r12, &(0x7f0000000d00)=[{{&(0x7f0000000040)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000080)='e', 0x1}], 0x1}}], 0x1, 0x4004000) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r12, 0x84, 0x64, 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r3, 0x4010942a, &(0x7f0000000040)={0x0, 0x5}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=@bridge_setlink={0x30, 0x13, 0xa29, 0x70bd2d, 0x0, {0x7, 0x0, 0x0, r2}, [@IFLA_BROADCAST={0x0, 0x2, @remote}, @IFLA_XDP={0x0, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x0, 0x1, r9}, @IFLA_XDP_FD={0x0, 0x1, r10}, @IFLA_XDP_FD={0x0, 0x1, r11}]}]}, 0xffffffd9}, 0x1, 0x0, 0x0, 0x44000}, 0x2804c000) 5.765593968s ago: executing program 2 (id=5632): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000180)="c1000000da7ff40d5c0cf5", 0xb}, {&(0x7f0000000000)="0f88a8", 0x3}, {&(0x7f0000000200)="1df3655891", 0x5}], 0x3) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000280)=':', 0xfffffffffffffdbd, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0x2, @empty}, 0x1c) r3 = socket$inet(0x2, 0x3, 0x30) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x19, &(0x7f0000000080)=0x1b, 0x4) sendto$inet6(r5, &(0x7f00000000c0)="26a757208dfd7c", 0xfffffd33, 0x0, &(0x7f00000001c0)={0xa, 0x4e21, 0x2, @loopback, 0x4}, 0x1c) recvmmsg(r5, &(0x7f000000a100)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40002040, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r4, 0x81f8943c, &(0x7f0000001b80)={0x0}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r3, 0xc0709411, &(0x7f000010d000)={{r6, 0x51, 0x4, 0x81, 0xe131, 0x10000002, 0x4, 0xb, 0x6, 0x7c7, 0x3, 0x4, 0x4, 0x100000001, 0x6}}) shutdown(r4, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000012c0)={&(0x7f0000001fc0)=ANY=[@ANYBLOB="bf77ff15debb6fd8fd9ad768c9c0cd3b7fceaeb844784195c42d7ce6875eef9480a0671ca0097796507bc7eae4684b12f830d83a82264745d423f33a84c6311a9e5709b442df92ee6f2a190866a0a340669690f90229132042cf427d3c52026b3ca70a8e932bd9ba615954fa26f66e19b97f3432dc22f1b7e40f31f3769de6741343121a20d6fba6fd419fe519af9baeab97f27571229c9c929f78e7192d42b00d86fb59aea4b841991c7a4faf638aa3322df34afbaa71dca7cb769c22a347f1befa2ef4b34b87286ae8358cbaae2c33f4ace3436b542f987e54"], 0x30}}, 0xc800) recvmmsg(r3, &(0x7f0000001980)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/24, 0x18}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47, 0x2f}, {&(0x7f0000000100)=""/224, 0xe0}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001700)=""/124, 0x7c}, {&(0x7f0000001280)=""/60, 0x3c}], 0x5}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000001840)=[{&(0x7f0000001a40)=""/157, 0x9d}, {&(0x7f0000001b00)=""/103, 0x67}, {&(0x7f0000001d80)=""/203, 0xcb}, {&(0x7f0000001600)=""/57, 0x39}, {&(0x7f0000001640)=""/135, 0x87}, {&(0x7f00000014c0)=""/101, 0x65}, {&(0x7f0000001780)=""/171, 0xab}], 0x7, &(0x7f00000018c0)=""/176, 0xb0}}], 0x3, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r9, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000001240)=ANY=[], 0x48}}, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000002480)={'netdevsim0\x00', &(0x7f0000002400)=@ethtool_coalesce={0xe, 0x1, 0x1, 0x4, 0x7, 0x8, 0x7a12, 0x7, 0x5, 0x40004, 0x3, 0x5, 0x5, 0xfffffffa, 0x8, 0x7ffe, 0x6, 0x1310000, 0x2, 0x2, 0x8e4, 0x7, 0x8}}) getsockopt$inet_mreqsrc(r3, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000080)=0x6) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001400)={&(0x7f0000001200)='rxrpc_tx_data\x00', 0xffffffffffffffff, 0x0, 0x4}, 0x18) 5.627748281s ago: executing program 1 (id=5635): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet6_udp(0xa, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_int(r3, 0x0, 0x33, &(0x7f0000000300)=0x80000005, 0x4) sendmsg$inet6(r3, &(0x7f0000000400)={&(0x7f0000000080)={0xa, 0x4e20, 0x5, @private0, 0x5}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000001140)='`', 0x1}], 0x1}, 0x4044801) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000300)=0x80000005, 0x4) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x400005}, 0x1c) mkdirat$cgroup(r2, &(0x7f0000000080)='syz0\x00', 0x1ff) r5 = openat$cgroup(r2, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) r6 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x22528, 0x800}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR={0xa, 0x9}]}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x48}}, 0x800) r9 = openat$cgroup_type(r5, &(0x7f0000000180), 0x2, 0x0) sendfile(r1, r9, 0x0, 0x7) r10 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r10, &(0x7f00000000c0), 0x12) r11 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$sock_int(r11, 0x1, 0x26, 0x0, &(0x7f0000000100)=0x4e) pread64(r3, &(0x7f0000002840)=""/4117, 0x1015, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001f7ff04b7050000240000006a0a00fe00000000850000000b000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4988a0d411a9872971c7c56f0979bd10b97163c066d0e196bf0fb04e500b0c0502df9de9ca3c00cb9a323d9b401bf4e418d07fa22f0610a70f2bdf4000200000000b0c2c125080963f6324bb7b80197aa3161f45346b100000000000000000089e399f6609876b588743794298b79dc192dff048fc207c81f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be06000000000000005064caec04a367c23d9fb6a6991ddb737d527d6acb15426406991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54fc5b29d27643453ad9226e3550ee5520211d9370175fba303f003073afd1ec9f7c6133f260c6882a146880b9387f1beb5418618bc83a3becf9bb5d80eff7da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb2f30a246c3b2f60000fc4deb91da1368b0960b8d69bd99c64893d44f962524429dc0584b8e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7073be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc348ef2ac3789b847611fcb0a26acafdd6d9a1b17dcb9f7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb0200000000000000cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d2d8f7e1d24cabe17ad4135d8872935ceac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cd43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c106beb49a71c62df5544ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f481112ab8a82247e927fb6f256830dab3671f00500d36a17790bab7d0e89e6c15314f2b963bfc867953476b0505c7d728326d666f39e82cfcf7e7a85df288d75df24c5e4d529c349923f9a4fb882310391dd58b4cbd8def239a227724d39c3e6c40e20e07e68a22888a5c3941b7a765b92bcb37f302487bcbd93ccf3a104021ff34ddf7ffcca1a04eae963e25516a114573779b24a341dfb2e80f1f345c6d96493ffc2a18478b5bf3aab2ea59c51cf0678e1a57d0ea042d911548ff612002ddb2d54d42fbdde42b56887003d27468225b2594a0500200f314113e889468cf13dd92aa0d7744db6b56557a5adad95cb9a69d4de50642b4b9d6d3ba7eb534b00d0fea62f0a61535dfc4da06e7f8695be614c557caed7eb0120516e1351fed7d8ffa31c8f4be364185469cfc5f25c90d71bce745dd2d58a30e0844f12c4cbbdd7a08465e665c2620d78673dfb6d9263e44f59fae487c62c98a3534f1a3eac9ee9f18a18106ba3d7c7a62330f5c0e98cb7982dd7bad02c8dba9c13894185bfc4bd2520b6e2043fcb3fc5eb55ecf9e6e363ea2ac40a14a6f00f0ffffa0fdb6487c51ef12c2e88beeb5aa6f6a4151cfb90644e50630ed474df7d1635afcb1ea3f6c47b5acbba2ce5099a9387f74d1ffbd1da497613174f76a656ba5bacccbb58dddaf9a3510d65383829a51e0f41e661fa80ca1eaaa6cf0824305ba4ec80400c50ffe83ccb0e6fef321190c58aca8c7c8c6d26ff5cbc2cadebda8e1219e04f8dacffd33db1a0a2e74c9eb978d80a12d0b5327bfd053000000000000000000be0d02a14708504412fa93d335992b2983c5addc191b4a21c7b340d0536b01958e15315eb5f3f9f4992c18f666359f40295fa73284c4b607669bae01bd68c3e2b770c324a0ab26b6065d7e95a7bd80052db57506ec7cc861bf3998d07484c66630ca8173fea3f06ed1dfc70a8b90418e2dc76137e0f68cb1c8a908aef9f009f85647dba54e05028c33d94d463fb20d2e7547184b8d3611e45dff02144387f342ef9b9bf650e9d049bf65258a7bc094a6965e24611c077e1ca0891362a9d68f3ec7610c0449ac59110500a09b75885cd79ba32776e4a511c8a4ad922b000000000002ef507ec6fc7f5dc431b9d8cbd9003972bf1dc6a71bedad8e19efc3edd2a7a7e555d5f3176af69920471e6e5bcb8966c813c132d65e2b99d3015e06b372e1aefaae14ee3fbc6349af362c19b59c214de66912d1a9a98d92dc030000009443de62caca334c46d110e50896fe50d0477771d387f40c8ef05750ca651e6e69a237dcf78666d6ab2bda1f853525494e4efdd93be38bb5fc671f8794002d7a951fd336aaf4ed1166cb459df70218c571ba1c40b028234505e5477effff26af8812c2fbb8785a223fce0a0601c2a3b58bea8c6216eadabcabe86ab46e4cd3d58ef7ce8d3c4b0bc5952e81dfc0a490d8568db6f9c51fe703c6864fae0053d2f91f49e977cdc1962dbc28c29471a72199862bc8fc6e211d13d8579cab4fba94b2b613c9b8148d05e0690a4c4ab35aabc45801d2b82081e62b23a01b58b1ffb624f63ad2246796796160cd3682374364edac52f1becb7c6eff50823b75fb2ef516ec4ec1cb20a2535b504502d744f2099674e58f2c117c980cf0d041c8e45c4f166bab4aa5ed200ef4dcff96f7c9c1ab8c22db0f439b23b04bcd41ffc3a0e01976ca1cf43e12d7d72f3faa4979faabd62e2dc54a980eae4d5e8c6498de331c3aba1144ef1190ea6cda641d9416c4560cab2d819eac7b04c70f141754c3ffd79da363fe8859afee531710caf1b2bf5a51142f4755cbb700c28083525a9093790096cb93417f1216000000000000000000000000000040ceb244e4cae2b65a36d41793aabccd3d0c50486eae6793e1f54814a8ee2779c14ca94759266200229b58c12279817869e831cade7b09ddffffff9d93e2ad25eed43c0b9ee4fd209b5b919a42f676b9d7236fc8dd5040899d0676291407ce9ac8101dd3512f5b3ac8cf8179d1749de324000030d0f942ec4604c28d5c287d1435956784003a53eb5f0436ead88d7acf0166dbd9f30a9b259c8a9b9faf1356faf269cded935b07863e4fdad8aab52686c81babd1c08f6700a2fadd413443022ea5c774ffefdd426abed08d437a4db48611fc82a18ab9f54758a1aad86d95cd186ceb55fafa3930090467b8b7bb8ae7e1c8b4b4106a381cb67fdb86def4de2076dc538bb97502b4b4350e633dc0a53c2fc9a01bc5cfae0245f1fab843c633446f5f3a43226109b7dafe7815773bd6969f04cbe15236b90000000000000000000000000000000000000000000000000000ff0779b9c0057addb2efe11b8b3a706569f1522b57d71bb0beccab7c8fe9e1330b2f501b2ac3cfe9e2f505e833217557abb257d61a73a758543651b250f8d8ef9c8481bb28a137d15040b0181c28dfad7c17b30c452a64c43a117cb948247c33abc765a6ba695c3cea5e32a4d11c9b4be91c60932bae2dcbec2ff4268e03aad15efc6004e6b3d7f0edf8b5d4ae7846a6d43c16c90b7c5dc13ac2ff0439ab693498964cad2bb533bcd240778b7e49145c48efde42b44c01517f1a7c7707b4c4fc0900e7086ec40354504590696282286db9030f0320e2fcba8723939005347b3c99e3f1310d41ab328c1f351b3f744ff1973431000000000000000000000000000000000000003495d69aaf9a1d83e83511a3bf44fe753b8ad83bc34ea4d46b397e000fd267c50122aa5aaf8474ec2e57d960d963900bef84a4b3c7dd01ae4d6b5522aa8a35ae7996e298bcfe3f31a34e3e12c58cf172a4d3677a67b52041ec21ae8003aa1c9969178b1b00e4d12ac9741fd788fb6260ec043c013907523c77f8acc20b9e2fd224ca8f21fab2b10991881e0a12f4e1c4f54b9ca7c9a0c8298d60b8b6eaa023418992d6d62b0e9faca4a3b3a845e859137cd933ef5eb8db16f159f32505725da51414562d064b551246dacd58023fed3c087bb52ae4bc09f3846c785d1b278e661ed01fbc2415288bc9c808c4aef648d431b3029da0dec8886c3ee9cad996843d00a3b5eb54e270dd2e96c8f2fdb4c27c2d1bd467f2a14867dec67730d8a68329839d9feff688dfbe25c73f936338e7b057980da58a6303d95f17712d667d5a1066ae457ae32925ce658b559c1182a74e267da57fe25b19153f1cdebaddf3f7a3479c09f2303dff449c0513b152a75ed48215cc31264a6ff648a95daa0d599dbce303b3b5307572df30429a3b4b115cab0a018f2501272048dd9e69877535e20078e7c28a98f26ace7a266bdc15ce904f25ec7fb2434ee7b5b69bed702ba1e7ed72942f452f1a98a2d949450091075efa823b11f5f5eccd921c04c7c15a5a05750cd85b1300fc00ce275de7559e117f87cb6c3c9a4b9f96149e3fcffa44d7000000000000000000d43d07d546acb7009c0c4f6e57b8577d2113bfca1939b9bf757265e175c1863a7c8d7640675830dc11d5d59546daf2385a7074f770c8333b21e2fb660141bc4f1ed45f703da6ac2557ab6952bd0c300000000000000000005b44bff4e3966fdfc9b720412bec09936b08e440c774e222dbd9a323a889f295e5d3bae64fc48ba123668e6a0be1e732aa5e2a0d4373a0b76d84f018d45bdf6f12d6d5d23a0331c3ae5e99a2bcdb52386135ea15890007e1cba5e52a04971139272012ae5542ba109a9d2f49798ce2fc6f639735e0222cd08075418239042bfe47c363973d3245ce507e838dfd90ae442a96fa1343029be56de31c2eff226c05f0ae3dbe2281e7bc02db39342d5b54ad3616733a5aa7753613423a0c4d2844a6e08fa5b76e18f7e24e967f6f83c546718d0f20959376427cdd449a4be3d75fd3e51e1b7f8690855af8eddbd3fd556b4460d0091e3623933f1a11db14aea54af6c49725bfa51fed222dc379995f48b1aab94441767c8bccbfd966d814715203bd8f549cd57d6a87295bf16aa25fb4e7fcaa8cec5e5c03b0095861bf2fed70ffb46bbb78ba90ca272ead9b3d2959fd9dbaabd1d51a60b474cef4c700faf718b810e4d3527a4663ee9fbc0000000000000000000000000000000000000000000000000061abf7a66b7b3f57ff830000"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) getpeername$llc(0xffffffffffffffff, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000001c0)=0x10) 5.465837454s ago: executing program 3 (id=5636): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x10, &(0x7f0000000300)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x11}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r1}, 0x10) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = socket(0xa, 0x3, 0x3a) socketpair(0x23, 0x4, 0x1, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r6 = socket$inet_sctp(0x2, 0x5, 0x84) (async) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r6, 0x84, 0x11, &(0x7f0000000000)={r8, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000600)={r8, 0x8b6}, &(0x7f0000000640)=0x8) (async) setsockopt$MRT6_TABLE(r4, 0x29, 0xd1, &(0x7f0000000040)=0xfe, 0x4) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000001c0)={@ipv4, 0x0}, &(0x7f0000000380)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f00000003c0)={'erspan0\x00', &(0x7f0000000540)={'erspan0\x00', r9, 0x8, 0x7, 0x8, 0x9, {{0xf, 0x4, 0x0, 0x7, 0x3c, 0x65, 0x0, 0x6, 0x29, 0x0, @broadcast, @rand_addr=0x64010101, {[@timestamp_addr={0x44, 0x24, 0xd9, 0x1, 0x8, [{@multicast2, 0x7}, {@empty, 0x8}, {@rand_addr=0x64010101, 0x4}, {@broadcast, 0xff}]}, @noop]}}}}}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 4.929806784s ago: executing program 4 (id=5639): unshare(0x8000000) socket$alg(0x26, 0x5, 0x0) (async) r0 = socket$alg(0x26, 0x5, 0x0) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000080)={0x0, 0x40}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000840)={r2, @in={{0x2, 0x4e24, @loopback}}}, 0x84) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r3 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@deltclass={0x490, 0x29, 0x100, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x9, 0xffe0}, {0x4, 0x9}, {0xb, 0xc}}, [@c_atm={{0x8}, {0x54, 0x2, [@TCA_ATM_HDR={0x21, 0x3, "6203455e663ca843f9df6aa72f0862e1fe2e59c2e0e9666a0a8bc6d139"}, @TCA_ATM_HDR={0x29, 0x3, "b27ce56d7bd66b577e2a00fa2a6f8cad70c37fd0b6897c949b3eae33effdff0994e913a6b5"}]}}, @c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x1, 0x80000001, 0x0, 0x7, 0x6, 0x10001, 0x1, 0x0, 0x87e0, 0x44, 0x1c, 0xebe, 0x8, 0x2, 0x8001, 0x10000, 0x6, 0x6, 0x5, 0x4, 0x8, 0xc, 0x6, 0xfff, 0x1, 0x9, 0xffffff40, 0x5, 0x7, 0xa, 0x8529, 0x0, 0x1bc2, 0x2, 0x7, 0x5690bb00, 0x0, 0x1, 0x4ac9, 0x6, 0x7fff, 0xa3, 0x7, 0x2, 0x81, 0x1, 0x4, 0xffff710f, 0x10000, 0x2, 0x1, 0xe541380, 0x40, 0x0, 0x100, 0x6, 0x40, 0x5, 0x6, 0x8, 0x1, 0x4, 0x2, 0x9, 0x4, 0x3, 0xfd, 0x440f, 0x6, 0x3b, 0x7, 0x1, 0x5, 0x1, 0x38000000, 0x1, 0x4, 0x3ff, 0x8, 0x2, 0x9, 0x800000, 0x8, 0x1, 0xd6, 0x2, 0x4, 0x0, 0x30, 0x5, 0x7fa7, 0xffff, 0x878a, 0x1, 0xfffffff8, 0x4, 0x2, 0x6, 0x7, 0x9, 0x1, 0x50000000, 0x8, 0x7fffffff, 0xffff, 0x2, 0x6, 0x4, 0x2, 0xd13, 0x3, 0x7ff, 0x2, 0xfff, 0x9371, 0xfffffffd, 0x24f0, 0x0, 0x6, 0x8, 0x80000000, 0xff, 0x6, 0xfffffffb, 0xffff7fff, 0xb02, 0x2, 0x9, 0x200, 0x80000001, 0x0, 0xa6, 0x2, 0x80000000, 0x5, 0xf, 0x2, 0x0, 0x4, 0x7, 0x7, 0xc0, 0xd1b7, 0x2, 0x8, 0xddf3, 0x8, 0x4, 0x80000000, 0x9, 0x6, 0x9, 0x100, 0x6, 0x1, 0x6, 0xe, 0xfffffff8, 0x2, 0x5, 0x7, 0x611, 0x0, 0x8, 0x0, 0x3, 0x2, 0x3, 0x3, 0x6, 0x4, 0x7, 0x9, 0x94, 0xe74, 0x80000000, 0x63, 0x8, 0x3, 0x0, 0x7, 0x6, 0x155a, 0x2, 0x401, 0x5, 0x7ff, 0x8, 0x4, 0x2, 0xbf4b, 0x2, 0x1, 0x401, 0x7, 0x0, 0x6, 0x800, 0x2, 0x0, 0x9, 0x9, 0x4, 0x4, 0x29, 0x800, 0x4, 0x45df, 0x9, 0x7fff, 0x2, 0x7f, 0x8, 0x0, 0x5, 0x2, 0x0, 0x6, 0x90, 0xfffffff7, 0x3, 0x8, 0x81, 0xff, 0x5, 0x9, 0x9, 0x8, 0x6, 0x400, 0x9d, 0x7fffffff, 0x80, 0xb, 0xffff, 0x6, 0x2, 0xa, 0x12a1, 0x5, 0x8, 0x0, 0x3, 0x7, 0xe755, 0x3, 0xa65f, 0x3, 0x6dbc, 0x7, 0x2, 0x1, 0x81, 0x100, 0x401, 0xc6]}]}}]}, 0x490}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) (async) sendmsg$nl_route_sched_retired(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@deltclass={0x490, 0x29, 0x100, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x9, 0xffe0}, {0x4, 0x9}, {0xb, 0xc}}, [@c_atm={{0x8}, {0x54, 0x2, [@TCA_ATM_HDR={0x21, 0x3, "6203455e663ca843f9df6aa72f0862e1fe2e59c2e0e9666a0a8bc6d139"}, @TCA_ATM_HDR={0x29, 0x3, "b27ce56d7bd66b577e2a00fa2a6f8cad70c37fd0b6897c949b3eae33effdff0994e913a6b5"}]}}, @c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x1, 0x80000001, 0x0, 0x7, 0x6, 0x10001, 0x1, 0x0, 0x87e0, 0x44, 0x1c, 0xebe, 0x8, 0x2, 0x8001, 0x10000, 0x6, 0x6, 0x5, 0x4, 0x8, 0xc, 0x6, 0xfff, 0x1, 0x9, 0xffffff40, 0x5, 0x7, 0xa, 0x8529, 0x0, 0x1bc2, 0x2, 0x7, 0x5690bb00, 0x0, 0x1, 0x4ac9, 0x6, 0x7fff, 0xa3, 0x7, 0x2, 0x81, 0x1, 0x4, 0xffff710f, 0x10000, 0x2, 0x1, 0xe541380, 0x40, 0x0, 0x100, 0x6, 0x40, 0x5, 0x6, 0x8, 0x1, 0x4, 0x2, 0x9, 0x4, 0x3, 0xfd, 0x440f, 0x6, 0x3b, 0x7, 0x1, 0x5, 0x1, 0x38000000, 0x1, 0x4, 0x3ff, 0x8, 0x2, 0x9, 0x800000, 0x8, 0x1, 0xd6, 0x2, 0x4, 0x0, 0x30, 0x5, 0x7fa7, 0xffff, 0x878a, 0x1, 0xfffffff8, 0x4, 0x2, 0x6, 0x7, 0x9, 0x1, 0x50000000, 0x8, 0x7fffffff, 0xffff, 0x2, 0x6, 0x4, 0x2, 0xd13, 0x3, 0x7ff, 0x2, 0xfff, 0x9371, 0xfffffffd, 0x24f0, 0x0, 0x6, 0x8, 0x80000000, 0xff, 0x6, 0xfffffffb, 0xffff7fff, 0xb02, 0x2, 0x9, 0x200, 0x80000001, 0x0, 0xa6, 0x2, 0x80000000, 0x5, 0xf, 0x2, 0x0, 0x4, 0x7, 0x7, 0xc0, 0xd1b7, 0x2, 0x8, 0xddf3, 0x8, 0x4, 0x80000000, 0x9, 0x6, 0x9, 0x100, 0x6, 0x1, 0x6, 0xe, 0xfffffff8, 0x2, 0x5, 0x7, 0x611, 0x0, 0x8, 0x0, 0x3, 0x2, 0x3, 0x3, 0x6, 0x4, 0x7, 0x9, 0x94, 0xe74, 0x80000000, 0x63, 0x8, 0x3, 0x0, 0x7, 0x6, 0x155a, 0x2, 0x401, 0x5, 0x7ff, 0x8, 0x4, 0x2, 0xbf4b, 0x2, 0x1, 0x401, 0x7, 0x0, 0x6, 0x800, 0x2, 0x0, 0x9, 0x9, 0x4, 0x4, 0x29, 0x800, 0x4, 0x45df, 0x9, 0x7fff, 0x2, 0x7f, 0x8, 0x0, 0x5, 0x2, 0x0, 0x6, 0x90, 0xfffffff7, 0x3, 0x8, 0x81, 0xff, 0x5, 0x9, 0x9, 0x8, 0x6, 0x400, 0x9d, 0x7fffffff, 0x80, 0xb, 0xffff, 0x6, 0x2, 0xa, 0x12a1, 0x5, 0x8, 0x0, 0x3, 0x7, 0xe755, 0x3, 0xa65f, 0x3, 0x6dbc, 0x7, 0x2, 0x1, 0x81, 0x100, 0x401, 0xc6]}]}}]}, 0x490}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) recvmsg(r3, &(0x7f000000b680)={0x0, 0x10400004, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x4}, {&(0x7f000000b500)=""/153, 0xfb59}], 0x2}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x40040) 4.7340139s ago: executing program 1 (id=5641): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0xb452ac95772cd2b4, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x1c, r7, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(r5, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)={0x214, r7, 0x0, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SCHED_SCAN_MATCH={0x1cc, 0x84, 0x0, 0x1, [{0x94, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x24, 0x6, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8, 0x0, 0xb3e7}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x1}, @NL80211_BAND_LC={0x8, 0x5, 0x5}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x2}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ibss_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ap_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @from_mac}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x18000}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x4}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @random="a2c42a7269db"}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x14, 0x6, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x8}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x2}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @from_mac=@device_b}]}, {0x108, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0x20, 0x1, @random="51bd1072748c36a158733ae2ab8bbdd203df6b7310cf3b4801dc7419"}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x809}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ap_ssid}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x3c, 0x6, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x8000}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x1}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x8}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x6}, @NL80211_BAND_LC={0x8, 0x5, 0x9}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x6}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ap_ssid}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x14, 0x6, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x8, 0x1, 0x1}, @NL80211_BAND_LC={0x8, 0x5, 0x5}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ap_ssid}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x54, 0x6, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8, 0x0, 0x6}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x8}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x3ff}, @NL80211_BAND_LC={0x8, 0x5, 0xffffffff}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x7}, @NL80211_BAND_LC={0x8, 0x5, 0x3}, @NL80211_BAND_2GHZ={0x8, 0x0, 0xf}, @NL80211_BAND_2GHZ={0x8}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x9}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x1}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @from_mac}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x9}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ibss_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0x19, 0x1, @random="627426b511dddbaa68c21553dfed8f95c07e11a0db"}]}]}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0xe0a}, @NL80211_ATTR_SCAN_FREQUENCIES={0x1c, 0x2c, 0x0, 0x1, [{0x8, 0x0, 0x8e8}, {0x8, 0x0, 0x401}, {0x8, 0x0, 0x7ff}]}, @NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x8}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x8}]}, 0x214}, 0x1, 0x0, 0x0, 0x400c810}, 0x4) close(r4) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000580)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xfffffffd, 0x6}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffff1f1, 0x80000001}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 4.693966921s ago: executing program 4 (id=5642): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000240)=@framed={{0x18, 0x2}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x6}, {0x7, 0x0, 0x4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, @printk={@lld, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x41}, {0x5}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000540), &(0x7f00000005c0)=0x68) connect$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r5 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x0) 4.301851517s ago: executing program 3 (id=5643): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000240)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0xe, @mcast2, 0x1}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000040)}], 0x1, &(0x7f0000000100)=[@rthdr={{0x48, 0x29, 0x39, {0x6, 0x6, 0x1, 0x1, 0x0, [@rand_addr=' \x01\x00', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}}}, @hopopts={{0x38, 0x29, 0x36, {0x89, 0x3, '\x00', [@ra={0x5, 0x2, 0xfffd}, @jumbo={0xc2, 0x4, 0x564}, @jumbo={0xc2, 0x4, 0x2}, @ra={0x5, 0x2, 0x7}, @enc_lim={0x4, 0x1, 0x81}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x5}}, @rthdrdstopts={{0x78, 0x29, 0x37, {0x2c, 0xb, '\x00', [@jumbo={0xc2, 0x4, 0x37e0}, @calipso={0x7, 0x40, {0x3, 0xe, 0x9, 0x8000, [0x6609a518, 0xffffffffffff8000, 0x7, 0x3, 0x5, 0x6, 0xea]}}, @pad1, @enc_lim={0x4, 0x1, 0x2}, @jumbo={0xc2, 0x4, 0x64c}, @ra={0x5, 0x2, 0xff}, @enc_lim={0x4, 0x1, 0x3}, @pad1]}}}], 0x110}}], 0x1, 0x40400d5) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x0, 0x20}, 0xc) 4.222124075s ago: executing program 3 (id=5644): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000200000000000000000000000850000006d0000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='tlb_flush\x00', r0}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000000e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={&(0x7f0000000000)='tlb_flush\x00', r2}, 0x10) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x600000000000000) 4.073899561s ago: executing program 3 (id=5645): r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r3, &(0x7f0000000f40)={{0x6, @rose}, [@default, @bcast, @netrom, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000440)={'ip6_vti0\x00', &(0x7f00000003c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x57, 0x64, 0x0, 0x4, @local, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x87, 0x8000, 0x9, 0x94e8}}) r6 = socket(0x2c, 0x3, 0x3ff) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000016c0)=ANY=[@ANYBLOB="40010000100001000000000004000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb0000000000000000000000000000000032000000fc020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5a9e960b9ca1880000630b0000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000a000200000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008001600050000000000000000000000000000000000000004e13e6d863eb8b17566b22fe0c1e17c006845bfa18e73a22f9e0458e25598d944b873bc371d84070000000000006bba76c36669e3babd6e7b1bae5b914df98bcaca2ff10b47c3c1cbd3d9b9d146d5859b56342a05a8f77b34c4e0be03069cb57720644e930d92d6712445c43bfd826a76c704aa593824b3f1db8e94d201bcde0af7a23757a553c0323899934d4b65cd307193757711bc836821f4fcfb287c50fc58cc7658c97d7aa8d50442dc7d2e4f09d4fb"], 0x140}}, 0x4) sendmsg$BATADV_CMD_SET_MESH(r11, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000022c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000040000020f00000005002f000000000008000300", @ANYRES32=r10, @ANYRES64=0x0], 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xfff3}, {0x1, 0xa}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28, 0x5}}}]}, 0x38}}, 0x0) r14 = socket$nl_route(0x10, 0x3, 0x0) r15 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f00000004c0)={'lo\x00', 0x0}) sendmsg$nl_route(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001400030500008000ffdbdf25021f51ff", @ANYRES32=r16, @ANYBLOB="080002007f000001"], 0x20}, 0x1, 0x0, 0x0, 0xc090}, 0x0) sendmmsg$inet(r2, &(0x7f0000002180)=[{{&(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000340)="8e9ada67bb33decd4a67b4c1035cd14c000f3c215296539141000000", 0x1c}], 0x1, &(0x7f00000023c0)=ANY=[@ANYBLOB="90195a56ede28a21ddcf57ecda55a43ae5bb5f981a2a3d192c73bf2cb29a5f", @ANYRES32=r4, @ANYRES16=r3, @ANYRES32=r5, @ANYBLOB="ac1e0001ac1414aa000000001400000000000000000000000100"/36], 0x150}}, {{&(0x7f0000000640)={0x2, 0x4e25, @broadcast}, 0x10, &(0x7f0000000940)=[{&(0x7f0000000680)="eba7119bb381567ad3e2baa5eb3b5bf6e2df0c3ee4d12a2e68100e04b172ce99dbcf521ae7a07a5b46df0d1d287d2c2b0d926952ed562bafbbd97b3efb2d8d82dad02e8385f457a1c7a9bfed57667a8d65c7375d70c0855266939d568cca51d7e4b1bf283c373098c286a388ab9febacd18ba0fe4800ce7e53dd0593a9c0a30da478800893c6e7990b31d9d1c810d5fa8a38a850c7e5344f836418f9d0443a144b7e259f8440536e47a01acf63bb09602837d94d827171c7698e9cee1627e0e2d2788f78c75c3b05143d207da616e4888393196fde454a564e4a07fc87590e376b024b62c5063fce3e", 0xe9}, {&(0x7f0000000780)="9dc122d8cf4f387916b102de4db4a6bead4e0e941ca5ccbec77834ae60c76042cd642f54e5ba9d4929e2b4da2a67497ba9470da8e83dbd4a4d88f9e781600844938857f885d061b60804c9fff1ab37343e962f74b5b00737cc34884c059a7770531e55a20e9717a39bb54c7d37806b4792fe598416fdfd0442cc271ea9520d23a7c8eead80af9a9f011464f0d4a31e00cf4b53968a1ac377e47c423001dfec16c202408a033359d96c32e18df9c8ed5ee6d0b4a95b2087d3b3eef2ef34f5f5cc3abeda8751ab7fa68dd8f7b48eebcfc6ceae46f9d28407e12c5928", 0xdb}, {&(0x7f0000000880)="147bba9eb17bcabd02e895578763e291ee88a994a8b14fb5335f7d23b8fc246f85d4d69bb0ab618ec0c5a2e07ddc67117efbe139a268119ed46ebf9e15ba8f8f09692d2ee260767df5745115f5ef8ba92ce58520ba6678d47b44e8599b53272da8926363df386d4640b4ad95bdfc8483b3ced0c30065caa324c6a0bf9bad47f7d35a55a3d04dba495bf1d1a02c9479699a9105", 0x93}, {&(0x7f0000000a00)="492033ca24f1302060f12522eaef5682eef43c64233ce2d56dfb902eb857bf967661c97dd2ca823f7b6faac0e2c1467dfb766129f36db1cd102cfe8d0a7c1ee8444f841a5b", 0x45}], 0x4, &(0x7f0000000b00)}}, {{&(0x7f0000000b40)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000d40)=[{&(0x7f0000000b80)="bf3911d4bbdebd70ba3b32747b66b95b188572834fe1fad87b23d126be3b5dac55f34ac695ae7df19394bb63b6987e8e32e9f706fb45b1723b613c69561911affc2a872e4506f64ec57d81e1e1b7eb9aca9feaeb57e030667f492c7e20900e11b4d806f6bcd18c1b0a2dab26d3fb69a83ef99144598932b0ea9e2e292fec719b4a3bb8a806baed63fbc7bc5f518ff39bcfb4031c3a", 0x95}, {&(0x7f0000000c40)="e962edb581a96438ecf386072269064f8c5bd9ac67f635dbeefbe6695dadd8cb5b87a96dce9d9096dd7a226d896ace557cf037fcea47ed6ee799df89d286097a61550717ffdcac6f2b11302b39e5565c319881ec710799f193b272d5529419420b29a20048421ee574176e96c0c4ba57eaac91f6f44a8539166ed3b0d5d042ad455d593243c6b950e53249e968cc242bd95b10e8e9c07be8b0884d2333", 0x9d}, {&(0x7f0000000d00)="ea5c811a49874d28e953", 0xa}], 0x3}}, {{&(0x7f0000000d80)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000dc0)="48af8ffee56c4fa7cc18b1087632125ea738be4189db72dbee8c1459effd9b1b34cf67a41bf8f32df1c17c422fd45a230300cb9d1dfcd8fc7e4be738c9cb0d45b8418a325cad6d8971dbd98d5c", 0x4d}, {&(0x7f0000000e40)="57e3b08cc4ae6ae8fb59385ff5da3588bf3187b09b54c3762b51b6492cf3882f3cd1327dc90423bad61b1f28cbd900a405cdad4853388abea5299122b6c25829626ca3adfa29756d21fcda12ead59b3213f1f80fda3ab3e53df943c539a2fd4ff88337375a4a9754516c2ec0", 0x6c}, {&(0x7f0000000ec0)="03508c6aab4eb6e83956f05040ec7e271f9fb03e3d1b7ad8a0fbb678f822355579f92c38449643e23f2cf0f79c3941a312c6dea9e567997cd1695ef32a91247a7dd8a02eaab3d1127c650c788fb8e50f25c8ae69eb166bded2f7ae128a849a03391ce3966b977c2539719d0905ed84b9fed2cc4ef5d705f0f9283672ef7d9010c37a1d117b9947830641854135fd464cee266f2c24fcfb9759e1510b3f0ca659f78c", 0xa2}, {&(0x7f0000000f80)="409db561a5cce5546922865b5bbb9a30ee94e607d0b5846633ca22b25f2943cdc704bdccc191088324929660f595c04917083ca6f81ecc2f0b18af0eaa0cd0db9aedb07c8f8b022a9e46af479a0927d3fdd5211c43ead10f20c14b6b1e9613ce15d46c05debc3b833d3cbe9eed987ad893e896720bddf9cba242853e1f7c5cae682caa03dae00dd42abbb742ea00c52ad848b5b791c10a39a863e3a45b09fd8f597f0813922d194b143db67072222568c122a5c351364f26d4163f42688f67b9d0", 0xc1}, {&(0x7f0000001180)="3bc3d23d63dfabec22dc5f7e1b1fc9496c392d14f04906d347591a76df2a76bbb3116e1397afe619668f11a97c41f1b1c26084ec13af93949db66d12914ba36471925a82721f0401304b297a9cb279a3edb926d551053ebb2bc25fb629e1c2d7c94df7b33a8dee26b22ac660caa0003b17a8c9d14e31d74ea17fc71cf68491ad82d2ab295c848406f15b98958a05d5abd5c8eaf804d4cf6e7921b9c228c04c4d6ef934fd02a9f1883c5113dcd2388f4220fde4065d3de0c36b9be0cd111da63c9b9dffb08dfa6be8c00deb23f544f4e680a56cf121b38f98be493cea189f6401db49a848f9e386e06eba8363ebce62b664d81bdbcadee81b31b889bbcf01355490ebf3ba818a4bc67d3790dc7b6e", 0x10e}], 0x5, &(0x7f0000001200)=ANY=[], 0x130}}, {{&(0x7f0000001340)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10, &(0x7f0000002100)=[{&(0x7f0000001380)="fa10a9e3ee23583d44626a17cc34adf8e01a0adbe51f2a268ed780a5ac3d0f2e6b8592d4564035b8e1687bec3f6379f08b949e923bdfb1bdfdb191e52508bd8461bf291f880ce688e8391f44a6d2c8dfd08be8b0b94b9f40bf2906124b671cd08f42add61afc98c4f995", 0x6a}, {&(0x7f0000001400)="9f1a38a875e4aaae9a96d4ca4fbdbdcaf88a4841ba53afc0c47fa420cea28e36ac4ed55f26cd96e0040980466c6bb9ed3220c8b837ea00499f3e92c5bc66bae5dc5264fbb27ca34949834e8e6293f164f096222ded3f658c6375dcba3c", 0x5d}, {&(0x7f0000001480)="da10bd3be6bcdc04", 0x8}, {&(0x7f0000002040)="825f8d8113f0f2817e8b83ec540c31a4a3c70d2fd0e9d2ea46f4826cd3dbb3a5587f13b473d99fea5d5f7c0f727a35c558439b8ff64072548f4910c3ec789ddf26c7ba903c68229e67eb2b10fea2d176807a7111ee00719e2a49ff7e3f2ed7a92f4a95beaf61e50838ee794e027d1095b3ec8c7259c57a4d793ab293e187925a5d483d50a5ddcd3aab072483fc0d7c4630c78821", 0x94}, {&(0x7f00000014c0)="10be4266c276bc0de782c3f7d0a7159f1e862a73c253ed19403b61f84ae3d544c9dae3978fdeb80443fd62b7638dc592090f04c6b9289e18049c200e2123a0bb067e286796c87add7886b527f914f8b910fff69bba1790471d07aad37dd83db1aa5b762534da728ea57f5d5f9366b2d2842efb2b568bbd9dbbc75e6f0c73e381", 0x80}], 0x5}}], 0x5, 0x20044000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) r17 = socket$inet6_sctp(0xa, 0x5, 0x84) r18 = socket$inet_sctp(0x2, 0xe64c8fd7c787eede, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r18, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r17, 0x84, 0x76, &(0x7f00000000c0)={r19, 0x7}, 0x8) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f0000000000)=',', 0x1}], 0x1}, 0x8940) 2.138865235s ago: executing program 2 (id=5647): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xe, 0xf}, {0xffff, 0x9}, {0x2, 0x1}}}, 0x56}, 0x1, 0x0, 0x0, 0x8}, 0x4000080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x10, &(0x7f00000000c0)=ANY=[@ANYRES32=r3], 0x0, 0x4, 0x29, 0x0, 0x0, 0x48, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf48f}, 0xb) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) r7 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYRES32=r8, @ANYRES16=r8, @ANYBLOB="010326bd6000000000002d"], 0x20}, 0x1, 0x0, 0x0, 0x40904}, 0x20040814) r9 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000061107b000000000004000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_COALESCE(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000680)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0100000000000000000002000000080003007cc58547a7d77a5a8542f5ea7d7e7b86686f773ddeb385f2d44e1e12e5957140b1de3b50c34237dce313d38795e431f3a7469bc902fc1316503850c52f4b6f1f78f99f3c0cb937e753478a415f9aeb192575d03487d835e03d90a092a261c82a994118d586c8c01dd3e7ef7b4365fd", @ANYRES32=0x0, @ANYBLOB="080001000b000000"], 0x24}, 0x1, 0x6c00}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="20100000000004001400030076657466315f766c616e000000000000"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r12) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r12) r14 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r14, &(0x7f0000000280), 0x6) sendmsg$ETHTOOL_MSG_STRSET_GET(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000023c0)=ANY=[@ANYBLOB="ac107c00", @ANYRES16=r13, @ANYBLOB="01002dbd7000ffdbdf250100000018000180140002006970766c616e31000000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2001}, 0x4010000) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="81000002", @ANYRES16=r6, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRESDEC=r2, @ANYRES8=r0], 0x7c}, 0x1, 0x0, 0x0, 0x90}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000aa00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20}, 0x94) 2.105952528s ago: executing program 0 (id=5648): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)="d8000000180081054e81f783db4cb9040a1d080006007c02e8fc55a10a0015000600142603600e120800020000000101a8000500fec0ffff05000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace0d81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}, {&(0x7f0000000080)="6a4f918ec3d5", 0x6}, {&(0x7f00000000c0)="65d9a966581164b473c226e67e3be313dbe69270e794ba5ebc91", 0x1a}, {&(0x7f0000000100)="b03baaffd97654e1372200dd7b536afd43e5cff448233656aeaa34a25e526ac7e27563809847207f93ddd4d2039ef1a58f4221e6bdf54f61b3d06e2d23b4e27338e0773fcf76b61e944a994053600a1137430aae9c841a4f9d563a444e42ab3153be9c05eef18f23cbd60dc594f96869cca8145271", 0x75}, {&(0x7f0000000040)="d530d94dc6757e82f6686cd1114ac7694ac0c97bb3947aaa6bbc14538d54f34088433f30", 0x24}], 0x5, 0x0, 0x0, 0x12000000}, 0x0) 1.909839772s ago: executing program 3 (id=5649): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x5, 0x9, &(0x7f0000000040)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x5, 0x85, &(0x7f0000000100)=""/133, 0x40f00, 0x41}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x82) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x1}, 0x1}) write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0xfdef) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140f00001000010000000000000020000000000a20000000000a01030000000000000000010000080900010073797a300000000038000000030a010200000000000000000100000009e202bed91f083200000000040004800900010073797a300000000008000a4000000004140000001100010000000000000000000000000a"], 0x80}}, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x2, 0x8, 0x401, 0x70bd2d, 0x25dfdbfc, {0x2, 0x0, 0x4}, [@nested={0x8, 0x14f, 0x0, 0x1, [@nested={0x4, 0x27}]}]}, 0x1c}}, 0x80080) 1.909490197s ago: executing program 0 (id=5650): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x3}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000240)={0x0, 0xffff7fff}, &(0x7f0000000340)=0x8) 1.706087261s ago: executing program 0 (id=5651): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)={0x15c, r2, 0x8, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8}, @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "1893f2c0b3ef46f4bf30a03ad6f367e782302738afadf60b"}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}]}], @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "bb4a263757ca96f60ea55ab65191225f7d520cda611f0654"}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "aebdb054abf769f8336066a1be44d210852bcdcd34bdd8e7"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "7a46b2f2d0522202b602b8468abe46a0340cd267d4ab3406"}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}]]}, 0x15c}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x14, 0x24, 0x401, 0x0, 0x80, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x9810) 1.691284131s ago: executing program 1 (id=5652): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x4, 0x84) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000280)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r6 = openat$cgroup_subtree(r5, &(0x7f0000000300), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000300)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f0000000340)=0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001c80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010000000000000000000200000008000100", @ANYRES32=r7], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x40800) sendmsg$NFC_CMD_LLC_SET_PARAMS(r2, &(0x7f00000002c0)={&(0x7f0000000040), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, r3, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x358}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x6}, @NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x481}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0x82}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040081}, 0x20000080) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000007000000040000000000000e0400000000000000000000000100000d000000000400000004000000000000000000000404000000000000000000000a030000000000000061"], 0x0, 0x5b}, 0x28) openat$cgroup_ro(r10, &(0x7f0000000200)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) 1.569781445s ago: executing program 2 (id=5653): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) (async, rerun: 32) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 32) sendmmsg$inet6(r1, &(0x7f0000002fc0)=[{{&(0x7f0000000340)={0xa, 0x4e23, 0xfffffff9, @private0, 0x9}, 0x1c, &(0x7f00000004c0)}}, {{&(0x7f0000000500)={0xa, 0x4e22, 0xd91280f7, @remote, 0x40}, 0x1c, &(0x7f0000000b00)}}], 0x2, 0x24000045) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000000040)=0xc) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) (async) r4 = socket$packet(0x11, 0x3, 0x300) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) setsockopt$packet_int(r4, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) (async) recvmmsg(r4, &(0x7f0000000480), 0x0, 0x0, 0x0) (async) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0xfffffffffffffebb, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0xffffff49, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1d, 0xa, &(0x7f0000000800)=ANY=[@ANYRESOCT=r2, @ANYRES32, @ANYRESHEX=r3], &(0x7f0000000680)='GPL\x00', 0x80000, 0x11, &(0x7f00000007c0)=""/17, 0x40f00, 0x53, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000a40)={0x5, 0x9, 0x5, 0x4}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000d80)=[r5, r5, 0xffffffffffffffff], &(0x7f0000000dc0)=[{0x5, 0x85, 0x9, 0x5}, {0x3, 0x2, 0x7, 0x2}, {0x5, 0x4, 0x4, 0x7}, {0x3, 0x4, 0x0, 0x6}], 0x10, 0x5}, 0x94) bpf$PROG_BIND_MAP(0x1c, &(0x7f0000000140)={r7, 0xffffffffffffffff, 0x24}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ldst={0x1, 0x0, 0x4, 0x0, 0x5, 0x52}]}, &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) (async) unshare(0x62040200) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_CONNECT(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="05002cbd7000000000002e00000008000300", @ANYRES32=r10, @ANYBLOB="0a00340002020202020200000a000608115fe9dcc001f71f59ab58799bfc00080211000000000008"], 0x44}}, 0x4010) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000580)=ANY=[@ANYRES8=r3, @ANYRES16=r0, @ANYRESDEC=r11, @ANYRES16=r7, @ANYRESDEC=r8], 0x2e) (async) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) (async) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r12, 0x84, 0x10, &(0x7f0000000200)=@assoc_value, 0x8) (async) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f00000006c0)=ANY=[@ANYBLOB="b000000088121100000108021100000008021100000210000000020000009862a67005312b6de48a2bc8a4eafe7a231e1c7c16e641d76f777c230601479d62049aa0298d65c2793f16f5ff142cfdcfc10eba9522b8ff53840a4f1344eb6a10f526b0b93c95f683ed11a92983ae805fe7efcd78aa6a43848f6dd1102f8e52087589d85757bef3919e25986eb93ef9ae247c89b663692a0bbb2f83de25d9e745ef06c08ade437e1455ba4ec285"], 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=ANY=[@ANYBLOB="1000000008021100000108021100000008021100000020000100000001100128828450"], 0x28) 1.299058752s ago: executing program 0 (id=5654): syz_emit_ethernet(0x4e, &(0x7f0000000040)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x18, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x2}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@generic={0x1, 0x2}]}}}}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r2, 0x58}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000300)={0x1d, r5, 0x2, {0x0, 0xf0}, 0xc295a7c9ee09b05c}, 0x18) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0xc0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000025000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e000004000280080005"], 0x44}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffffff}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x4e, &(0x7f0000000040)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x18, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x2}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@generic={0x1, 0x2}]}}}}}}}}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r2, 0x58}, 0x10) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000040)={'vcan0\x00'}) (async) bind$can_j1939(r4, &(0x7f0000000300)={0x1d, r5, 0x2, {0x0, 0xf0}, 0xc295a7c9ee09b05c}, 0x18) (async) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0xc0) (async) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000025000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e000004000280080005"], 0x44}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffffff}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) 409.822858ms ago: executing program 2 (id=5655): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000200000000000000000000000850000006d0000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='tlb_flush\x00', r0}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000000e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={&(0x7f0000000000)='tlb_flush\x00', r2}, 0x10) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x700000000000000) 265.937958ms ago: executing program 1 (id=5656): r0 = socket$kcm(0x10, 0x2, 0x4) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) bind$vsock_stream(r1, &(0x7f0000000940), 0x10) close(0x3) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) writev(r2, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1) shutdown(r2, 0x1) sendmsg$inet(r0, 0x0, 0x4080) 265.451956ms ago: executing program 0 (id=5657): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="3fcb00000000200000000d000000e46edd8476dd25b8d58dddf4811d17332c34764089df5e032888c0beeac6c5e6e9d2a5871362e8688f48b8760c"], 0x14}}, 0x0) r2 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0, 0x0, 0x0, 0xfffffffffffffc98}, 0x34004811) setsockopt$sock_attach_bpf(r2, 0x6, 0x25, &(0x7f0000000040), 0x4) sendmsg$inet(r2, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000002b40)="f8", 0x1}], 0x1}, 0x4000000) 225.550068ms ago: executing program 3 (id=5658): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000200)=0x4, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYRES8=r2, @ANYRES16=r2, @ANYBLOB="010029bd7000fcffffff320000001800018014000200"], 0x2c}}, 0x0) r3 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, 0x0, 0x8000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r8 = socket(0x25, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x24, 0x2c, 0xd3f, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r10, {0xf000, 0xffff}, {}, {0x2, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x7a28156041d5a854}, 0x20000800) r11 = socket$inet_udp(0x2, 0x2, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r12, &(0x7f0000000200)=ANY=[], 0x32600) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000003, 0x12, r12, 0x4000000) setsockopt$IPT_SO_SET_REPLACE(r11, 0x4000000000000, 0x40, 0x0, 0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r13, 0x6, 0x1f, &(0x7f0000000300)="cd", 0x1) epoll_create1(0x80000) socket$unix(0x1, 0x1, 0x0) 220.288594ms ago: executing program 2 (id=5659): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000005c0)='kfree_skb\x00', r2}, 0x18) r3 = socket$kcm(0x1e, 0x5, 0x0) sendmsg$kcm(r3, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@id={0x1e, 0x3, 0x0, {0x4e20}}, 0x80, 0x0}, 0x0) r4 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f0000000b40)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) recvmmsg(r4, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000001080)=""/4096, 0x1000}, {&(0x7f0000000640)=""/82, 0x52}], 0x2}, 0x40}], 0x1, 0x102, 0x0) 0s ago: executing program 0 (id=5660): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000005, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='cpu.stat\x00', 0x275a, 0x0) preadv(r1, &(0x7f0000000b40)=[{0x0}, {&(0x7f0000000ac0)=""/103, 0x67}], 0x2, 0x4, 0x0) r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000001c0)=@base={0xa, 0xc, 0xb3, 0x7f, 0x0, 0xffffffffffffffff, 0x8}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000b00000000000000004000400851000000600000018100000", @ANYRES32=r2, @ANYBLOB="0000000000000000660000000110000018000000f8ffffff00000000000000019500000000000000360a00000000000018010000202078250000000000202020db1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000140)=@generic={&(0x7f0000000040)='\x00', 0x0, 0x8}, 0x18) kernel console output (not intermixed with test programs): 142][T22820] bridge0: port 2(bridge_slave_1) entered disabled state [ 694.003739][T22820] bridge_slave_0: left allmulticast mode [ 694.010083][T22820] bridge_slave_0: left promiscuous mode [ 694.016020][T22820] bridge0: port 1(bridge_slave_0) entered disabled state [ 694.197807][T22823] lo speed is unknown, defaulting to 1000 [ 694.205427][T22823] lo speed is unknown, defaulting to 1000 [ 694.248576][T22823] lo speed is unknown, defaulting to 1000 [ 694.288821][T22851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4523'. [ 694.415445][T22854] lo speed is unknown, defaulting to 1000 [ 694.466552][T22854] lo speed is unknown, defaulting to 1000 [ 694.571282][T22866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4527'. [ 694.581765][T22866] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4527'. [ 694.594121][T22866] netlink: 'syz.0.4527': attribute type 20 has an invalid length. [ 694.645840][T22869] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 694.669991][T22873] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 694.682743][T22866] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 694.695287][T17146] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 694.745384][T17146] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 694.793698][T17146] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 694.830879][T17146] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 694.895948][T22854] lo speed is unknown, defaulting to 1000 [ 695.193950][T22888] netlink: 'syz.2.4534': attribute type 10 has an invalid length. [ 695.399436][T22897] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4536'. [ 695.424947][T22897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4536'. [ 695.987541][ T5851] Bluetooth: hci2: command 0x0401 tx timeout [ 696.097971][T22912] lo speed is unknown, defaulting to 1000 [ 696.159727][T22912] lo speed is unknown, defaulting to 1000 [ 696.190832][T22912] lo speed is unknown, defaulting to 1000 [ 696.289952][T22922] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.402654][T22922] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.514900][T22925] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.588686][T22928] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4544'. [ 696.625393][T22928] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4544'. [ 696.793096][T22931] netlink: 'syz.4.4546': attribute type 3 has an invalid length. [ 696.805578][T22931] netlink: 'syz.4.4546': attribute type 3 has an invalid length. [ 696.820103][T22939] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4548'. [ 696.850230][T22939] 8021q: adding VLAN 0 to HW filter on device bond4 [ 696.897725][T22939] macvlan2: entered promiscuous mode [ 696.903192][T22939] macvlan2: entered allmulticast mode [ 697.052928][T22942] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4549'. [ 697.083743][T22942] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 697.516476][T22955] lo speed is unknown, defaulting to 1000 [ 697.524955][T22960] netlink: 'syz.0.4555': attribute type 8 has an invalid length. [ 697.539228][T22955] lo speed is unknown, defaulting to 1000 [ 697.643137][T22955] lo speed is unknown, defaulting to 1000 [ 697.816818][T22978] vxcan0: tx drop: invalid da for name 0x00000000000000f5 [ 698.522654][T22992] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.546254][T22993] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 698.614380][T22990] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.724800][T22990] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.435358][T23009] __nla_validate_parse: 8 callbacks suppressed [ 699.435381][T23009] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4567'. [ 699.457502][T23009] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4567'. [ 699.479619][T23009] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4567'. [ 699.497579][T23009] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4567'. [ 699.705711][T23021] lo speed is unknown, defaulting to 1000 [ 699.718375][T23021] lo speed is unknown, defaulting to 1000 [ 699.726260][T23021] lo speed is unknown, defaulting to 1000 [ 700.009261][T23036] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4575'. [ 700.033164][T23038] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4577'. [ 700.123493][T23039] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 700.161842][T23037] lo speed is unknown, defaulting to 1000 [ 700.180891][T23038] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4577'. [ 700.223755][T23037] lo speed is unknown, defaulting to 1000 [ 700.313901][T23037] lo speed is unknown, defaulting to 1000 [ 700.449108][T23055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4580'. [ 700.515821][T23057] netlink: 248 bytes leftover after parsing attributes in process `syz.4.4580'. [ 700.715240][T23062] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4581'. [ 700.928025][T23062] lo speed is unknown, defaulting to 1000 [ 700.953042][T23062] lo speed is unknown, defaulting to 1000 [ 701.026329][T23062] lo speed is unknown, defaulting to 1000 [ 701.079865][T23067] lo speed is unknown, defaulting to 1000 [ 701.215706][T23067] lo speed is unknown, defaulting to 1000 [ 701.816938][T23080] lo speed is unknown, defaulting to 1000 [ 701.929131][T23067] lo speed is unknown, defaulting to 1000 [ 702.137503][T23098] netlink: 'syz.1.4590': attribute type 20 has an invalid length. [ 702.176608][T23098] netlink: 'syz.1.4590': attribute type 20 has an invalid length. [ 702.558241][T23080] lo speed is unknown, defaulting to 1000 [ 702.627504][T23087] lo speed is unknown, defaulting to 1000 [ 702.706403][T23087] lo speed is unknown, defaulting to 1000 [ 702.715783][T23080] lo speed is unknown, defaulting to 1000 [ 703.241519][T23087] lo speed is unknown, defaulting to 1000 [ 703.432542][T23125] netlink: 'syz.4.4599': attribute type 10 has an invalid length. [ 703.571803][T23125] !: entered promiscuous mode [ 703.585996][T23125] !: entered allmulticast mode [ 703.611718][T23125] A link change request failed with some changes committed already. Interface 0! may have been left with an inconsistent configuration, please check. [ 703.954647][T23129] tipc: Enabling of bearer rejected, already enabled [ 704.095381][T23129] syzkaller0: left promiscuous mode [ 704.101906][T23129] syzkaller0: left allmulticast mode [ 704.218821][T23129] syzkaller0: mtu less than device minimum [ 704.350505][T23130] syzkaller0: entered promiscuous mode [ 704.465823][T23137] __nla_validate_parse: 9 callbacks suppressed [ 704.465845][T23137] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4602'. [ 704.506980][T23137] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4602'. [ 704.516010][T23137] netlink: 'syz.0.4602': attribute type 19 has an invalid length. [ 704.913365][T23142] netlink: 'syz.0.4604': attribute type 15 has an invalid length. [ 704.972778][T23144] netlink: 'syz.4.4605': attribute type 4 has an invalid length. [ 705.553994][T23155] netlink: 188 bytes leftover after parsing attributes in process `syz.4.4607'. [ 705.724388][T23154] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 706.269674][T23164] macvlan0: entered allmulticast mode [ 706.280631][T23164] veth1_vlan: entered allmulticast mode [ 706.303601][T23164] team0: Port device macvlan0 added [ 706.454702][T23167] lo speed is unknown, defaulting to 1000 [ 706.542098][T23167] lo speed is unknown, defaulting to 1000 [ 706.575408][T23167] lo speed is unknown, defaulting to 1000 [ 706.584103][T23178] syzkaller1: entered promiscuous mode [ 706.602905][T23178] syzkaller1: entered allmulticast mode [ 707.252244][T23203] netlink: 'syz.4.4622': attribute type 3 has an invalid length. [ 707.323171][T23205] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4620'. [ 707.472580][T23203] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 707.557413][T23203] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 707.670345][T23214] netlink: 'syz.3.4624': attribute type 1 has an invalid length. [ 707.698999][T23214] netlink: 144 bytes leftover after parsing attributes in process `syz.3.4624'. [ 707.721469][T23214] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4624'. [ 707.738941][T23211] netlink: 'syz.0.4620': attribute type 2 has an invalid length. [ 707.761882][T23171] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4612'. [ 707.944907][T23203] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 707.957501][T23203] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 708.216232][T23203] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 708.257310][T23203] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 708.496012][T23203] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 708.522624][T23203] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 708.787200][T23246] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4632'. [ 708.926912][T17137] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 708.966771][T17137] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.132860][T17146] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 709.151834][T17146] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.164574][T17146] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 709.173117][T17146] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.244750][T23254] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4634'. [ 709.391399][T17133] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 709.404844][T17133] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.600736][T23259] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4636'. [ 709.630488][T23259] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4636'. [ 709.950630][T23275] netlink: 'syz.2.4642': attribute type 1 has an invalid length. [ 709.979784][T23275] netlink: 'syz.2.4642': attribute type 2 has an invalid length. [ 710.020344][T23275] tap0: tun_chr_ioctl cmd 1074025677 [ 710.034585][T23275] tap0: linktype set to 0 [ 710.087447][T23283] netlink: 'syz.0.4645': attribute type 10 has an invalid length. [ 710.119321][T23283] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4645'. [ 710.162359][T23283] batman_adv: batadv0: Adding interface: virt_wifi0 [ 710.169667][T23283] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 710.196472][T23283] batman_adv: batadv0: Interface activated: virt_wifi0 [ 710.308199][T23291] tipc: Enabling of bearer rejected, already enabled [ 710.332609][T23291] syzkaller0: entered allmulticast mode [ 710.474279][T23300] netlink: 'syz.2.4650': attribute type 1 has an invalid length. [ 711.136279][T23328] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4659'. [ 711.258461][T23336] netlink: 84 bytes leftover after parsing attributes in process `syz.1.4659'. [ 711.818515][T23359] lo speed is unknown, defaulting to 1000 [ 711.834440][T23359] lo speed is unknown, defaulting to 1000 [ 711.849240][T23359] lo speed is unknown, defaulting to 1000 [ 712.461480][T23385] netlink: 'syz.0.4670': attribute type 39 has an invalid length. [ 712.611607][T23379] tipc: Enabled bearer , priority 0 [ 712.659062][T23386] syzkaller0: entered promiscuous mode [ 712.665535][T23386] syzkaller0: entered allmulticast mode [ 712.716148][T23381] : entered promiscuous mode [ 712.735641][T23373] lo speed is unknown, defaulting to 1000 [ 712.740420][T23379] tipc: Resetting bearer [ 712.758421][T23373] lo speed is unknown, defaulting to 1000 [ 712.820729][T23378] tipc: Resetting bearer [ 712.945088][T23378] tipc: Disabling bearer [ 712.977202][T23373] lo speed is unknown, defaulting to 1000 [ 713.220260][T23413] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4677'. [ 713.437429][T23417] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4678'. [ 713.451787][T23429] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 713.463789][T23420] lo speed is unknown, defaulting to 1000 [ 713.509484][T23420] lo speed is unknown, defaulting to 1000 [ 713.557818][T23420] lo speed is unknown, defaulting to 1000 [ 713.709393][T23431] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 713.785871][T23433] (unnamed net_device) (uninitialized): option use_carrier: invalid value (227) [ 713.872214][T23431] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 714.021143][T23431] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 714.235562][T23441] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode broadcast(3) [ 714.636543][T23431] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.076334][T17143] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 716.095361][T17143] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 716.163622][T17143] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 716.200637][T23456] netlink: 'syz.1.4690': attribute type 1 has an invalid length. [ 716.226663][T23453] ipvlan3: entered promiscuous mode [ 716.239979][T23453] bridge0: port 1(ipvlan3) entered blocking state [ 716.253792][T23453] bridge0: port 1(ipvlan3) entered disabled state [ 716.262441][T23453] ipvlan3: entered allmulticast mode [ 716.275130][T23453] erspan0: entered allmulticast mode [ 716.288177][T23453] ipvlan3: left allmulticast mode [ 716.308981][T23453] erspan0: left allmulticast mode [ 716.425877][T17143] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 716.579061][T23468] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 716.601306][T23471] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4695'. [ 716.622528][T23471] netlink: 84 bytes leftover after parsing attributes in process `syz.4.4695'. [ 716.641162][T23472] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4696'. [ 716.656106][T23468] netlink: 'syz.1.4693': attribute type 1 has an invalid length. [ 716.810024][T23474] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4693'. [ 716.830318][T23468] 8021q: adding VLAN 0 to HW filter on device bond5 [ 716.929835][T23484] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.949187][T23484] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.080398][T23484] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 717.180709][T23484] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.425214][T23484] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 717.467492][T23484] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.563802][T23508] netlink: 772 bytes leftover after parsing attributes in process `syz.1.4702'. [ 717.592636][T23480] lo speed is unknown, defaulting to 1000 [ 717.663631][T23484] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 717.698051][T23484] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.752553][T23480] lo speed is unknown, defaulting to 1000 [ 717.781038][T23480] lo speed is unknown, defaulting to 1000 [ 717.981022][T23481] netlink: 'syz.2.4697': attribute type 21 has an invalid length. [ 718.008711][T23481] netlink: 156 bytes leftover after parsing attributes in process `syz.2.4697'. [ 718.027466][T23481] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4697'. [ 718.055129][T23510] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4697'. [ 718.075274][T17144] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.139724][T17144] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.184039][T23522] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4705'. [ 718.194046][T17144] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.226998][T17144] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.342632][ T8692] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.360807][ T8692] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.455628][T17145] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.461030][T23529] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 718.473877][T17145] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.492588][T23526] lo speed is unknown, defaulting to 1000 [ 718.499979][T23528] netlink: 'syz.3.4708': attribute type 1 has an invalid length. [ 718.527052][T23526] lo speed is unknown, defaulting to 1000 [ 718.556301][T23526] lo speed is unknown, defaulting to 1000 [ 718.739606][T23534] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 718.754692][T23536] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4709'. [ 719.030665][T23542] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 719.067328][T23542] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 719.181168][T23542] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 719.203511][T23542] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 719.317786][T23542] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 719.329028][T23542] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 719.402296][T23542] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 719.416133][T23542] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.214459][T23605] lo speed is unknown, defaulting to 1000 [ 721.339008][T23611] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 721.374396][T23605] lo speed is unknown, defaulting to 1000 [ 721.392177][T23605] lo speed is unknown, defaulting to 1000 [ 721.638894][T23617] tipc: Enabled bearer , priority 10 [ 722.105098][T23627] tipc: Enabled bearer , priority 0 [ 722.120271][T23627] syzkaller0: entered promiscuous mode [ 722.125813][T23627] syzkaller0: entered allmulticast mode [ 722.174538][T23627] tipc: Resetting bearer [ 722.192929][T23626] tipc: Resetting bearer [ 722.259246][T23626] tipc: Disabling bearer [ 722.344619][ T59] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 722.369697][ T59] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.537779][T17149] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 722.546031][T17149] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.590968][T23644] netlink: 'syz.2.4740': attribute type 39 has an invalid length. [ 722.626067][T23647] __nla_validate_parse: 6 callbacks suppressed [ 722.626093][T23647] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4743'. [ 722.633696][T23637] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 722.659681][ T5903] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 722.751364][T23644] veth0_macvtap: left promiscuous mode [ 722.790894][ T8683] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 722.821088][ T8683] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.968810][ T59] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 723.003898][ T59] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.121220][T23664] netlink: 'syz.2.4746': attribute type 1 has an invalid length. [ 723.133962][T23664] netlink: 'syz.2.4746': attribute type 12 has an invalid length. [ 723.167443][T23664] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4746'. [ 723.287511][T23669] netlink: 'syz.4.4748': attribute type 8 has an invalid length. [ 723.314195][T23672] netlink: 'syz.4.4748': attribute type 8 has an invalid length. [ 723.393248][T23674] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4749'. [ 723.419804][T23664] bond0: option mode: unable to set because the bond device has slaves [ 723.431661][T23674] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4749'. [ 723.669254][ T888] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 723.769855][T23689] netlink: 'syz.2.4750': attribute type 39 has an invalid length. [ 724.038108][T23699] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 724.066595][T23694] lo speed is unknown, defaulting to 1000 [ 724.102177][T23694] lo speed is unknown, defaulting to 1000 [ 724.126205][T23694] lo speed is unknown, defaulting to 1000 [ 724.213057][T23702] bond0: (slave ip6gretap1): Enslaving as an active interface with an up link [ 724.291576][T23709] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4753'. [ 724.300895][T23709] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4753'. [ 724.378930][T23705] 8021q: adding VLAN 0 to HW filter on device bond0 [ 724.499995][T23709] veth5: entered promiscuous mode [ 724.554212][T23722] openvswitch: netlink: IPv4 tun info is not correct [ 724.591855][T23711] veth1_vlan: left allmulticast mode [ 724.647690][T23711] team0: Port device macvlan0 removed [ 724.684983][T23711] bond3: (slave geneve2): Releasing active interface [ 724.700608][T23725] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4757'. [ 724.712525][T23727] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4759'. [ 724.721587][T23725] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4757'. [ 724.737939][T23711] geneve2: left promiscuous mode [ 724.765880][T23727] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4759'. [ 724.809006][T23711] bond0: (slave ip6gretap1): Releasing backup interface [ 724.882490][ T8690] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 724.914032][ T8690] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.022349][ T8690] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.039580][ T8690] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.157617][T23741] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 725.182750][T23741] netlink: 'syz.2.4764': attribute type 1 has an invalid length. [ 726.581783][T23770] lo speed is unknown, defaulting to 1000 [ 726.626980][T23770] lo speed is unknown, defaulting to 1000 [ 726.668025][T23770] lo speed is unknown, defaulting to 1000 [ 726.730542][T23777] 0ªî{X¹¦: left allmulticast mode [ 726.751783][T23777] 8021q: adding VLAN 0 to HW filter on device team0 [ 726.779799][ T5903] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 726.827716][T23777] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 726.927763][ T5903] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 727.659623][T23792] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 727.748920][T23791] lo speed is unknown, defaulting to 1000 [ 727.908095][T23791] lo speed is unknown, defaulting to 1000 [ 727.917598][T23791] lo speed is unknown, defaulting to 1000 [ 728.080556][T23802] __nla_validate_parse: 4 callbacks suppressed [ 728.080582][T23802] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4782'. [ 728.122365][T23802] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4782'. [ 728.177499][T23803] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4782'. [ 728.215820][T23802] bridge0: port 1(vlan3) entered blocking state [ 728.241926][T23802] bridge0: port 1(vlan3) entered disabled state [ 728.257533][T23802] vlan3: entered allmulticast mode [ 728.273633][T23802] bridge0: entered allmulticast mode [ 728.302490][T23802] vlan3: left allmulticast mode [ 728.317649][T23802] bridge0: left allmulticast mode [ 728.537948][T23807] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4784'. [ 728.585660][T23807] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4784'. [ 728.888437][T23820] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4786'. [ 729.223674][T23831] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 729.435525][T23835] mac80211_hwsim hwsim32 wlan0: entered promiscuous mode [ 729.457585][T23835] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 729.559388][T23846] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 729.577745][T23848] netlink: 'syz.0.4791': attribute type 1 has an invalid length. [ 729.621312][T23846] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 729.691307][T23850] siw: device registration error -23 [ 730.025154][T23859] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4796'. [ 730.113563][T23859] veth1: entered promiscuous mode [ 730.132886][T23859] bridge4: entered promiscuous mode [ 730.150470][T23859] debugfs: 'hsr0' already exists in 'hsr' [ 730.186494][T23859] Cannot create hsr debugfs directory [ 730.215142][T23859] hsr0: entered promiscuous mode [ 730.292125][T23867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4798'. [ 730.341947][T23867] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap0 [ 730.518588][T23870] lo speed is unknown, defaulting to 1000 [ 730.576204][T23870] lo speed is unknown, defaulting to 1000 [ 730.599032][T23876] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 730.628634][T23870] lo speed is unknown, defaulting to 1000 [ 731.358058][T23895] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4806'. [ 731.399951][T23895] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4806'. [ 731.889460][T23915] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 732.455367][T23943] lo speed is unknown, defaulting to 1000 [ 732.535883][T23943] lo speed is unknown, defaulting to 1000 [ 732.641725][T23943] lo speed is unknown, defaulting to 1000 [ 732.854996][T23964] netlink: 'syz.3.4823': attribute type 1 has an invalid length. [ 733.127102][T23967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 733.172604][T23966] lo speed is unknown, defaulting to 1000 [ 733.194339][T23966] lo speed is unknown, defaulting to 1000 [ 733.202138][T23966] lo speed is unknown, defaulting to 1000 [ 734.259897][T23999] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 734.265825][T24006] __nla_validate_parse: 8 callbacks suppressed [ 734.265849][T24006] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4832'. [ 734.485756][T24010] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 734.819973][T24010] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.055848][T24010] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.284631][T24010] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.456192][T24039] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4842'. [ 735.495614][T24039] netlink: 120 bytes leftover after parsing attributes in process `syz.2.4842'. [ 735.507901][T24039] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4842'. [ 735.517960][T24041] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4843'. [ 735.582979][T24041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4843'. [ 735.711170][ T3500] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.755643][ T3500] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.782770][T24045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4844'. [ 735.791906][ T3500] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.808231][T24045] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4844'. [ 735.868279][ T3500] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 736.014606][T24054] netlink: 'syz.0.4848': attribute type 10 has an invalid length. [ 736.036471][T24054] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4848'. [ 736.099931][T24055] lo speed is unknown, defaulting to 1000 [ 736.147313][T24058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 736.164207][T24055] lo speed is unknown, defaulting to 1000 [ 736.204480][T24055] lo speed is unknown, defaulting to 1000 [ 736.271897][T24064] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4852'. [ 736.619377][T24071] vxcan2: entered promiscuous mode [ 737.140200][T24078] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 737.182517][T24078] syzkaller0: entered promiscuous mode [ 737.188771][T24078] syzkaller0: entered allmulticast mode [ 737.769725][T24102] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 737.874333][T24116] rdma_op ffff8880117dd9f0 conn xmit_rdma 0000000000000000 [ 738.947193][ T5851] Bluetooth: hci2: command 0x0401 tx timeout [ 739.930672][T24112] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 740.121375][T24129] vxcan2: entered promiscuous mode [ 740.285103][T24137] mac80211_hwsim hwsim45 wlan1: entered allmulticast mode [ 740.384923][T24145] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 740.421142][T24137] netlink: 'syz.0.4873': attribute type 10 has an invalid length. [ 740.430294][T24137] mac80211_hwsim hwsim45 wlan1: left allmulticast mode [ 740.461185][T24137] mac80211_hwsim hwsim45 wlan1: entered allmulticast mode [ 740.473622][T24137] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 740.495344][T24141] lo speed is unknown, defaulting to 1000 [ 740.505170][T24141] lo speed is unknown, defaulting to 1000 [ 740.530915][T24141] lo speed is unknown, defaulting to 1000 [ 741.402226][T24150] __nla_validate_parse: 1 callbacks suppressed [ 741.402251][T24150] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4876'. [ 741.472724][T24150] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4876'. [ 742.695182][T24186] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4884'. [ 743.445973][T24202] tipc: Resetting bearer [ 743.728289][T24202] batadv_slave_0: left promiscuous mode [ 743.741489][T24202] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 743.975727][T24205] netlink: 'syz.4.4891': attribute type 1 has an invalid length. [ 743.984491][T24205] netlink: 'syz.4.4891': attribute type 1 has an invalid length. [ 743.992460][T24205] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4891'. [ 744.071034][T24202] bridge1: left promiscuous mode [ 744.210889][T24202] hsr0: left promiscuous mode [ 744.329922][ T8690] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.350528][ T8690] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.411148][ T8690] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.457537][ T8690] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.483672][ T8690] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.534050][ T8690] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.561669][ T8690] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.584397][ T8690] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.858066][T24226] tipc: Enabling of bearer rejected, already enabled [ 744.876103][T24226] syzkaller0: mtu less than device minimum [ 744.882668][T24230] netlink: 'syz.1.4900': attribute type 1 has an invalid length. [ 745.120622][T24244] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4902'. [ 745.481946][T24260] lo speed is unknown, defaulting to 1000 [ 745.514829][T24260] lo speed is unknown, defaulting to 1000 [ 745.559548][T24260] lo speed is unknown, defaulting to 1000 [ 745.602479][T24263] netlink: 'syz.1.4907': attribute type 1 has an invalid length. [ 746.311954][T24281] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4911'. [ 746.486123][T24287] netlink: 'syz.4.4914': attribute type 1 has an invalid length. [ 746.704582][T24293] team0: Port device gretap1 added [ 747.174780][T24135] Set syz1 is full, maxelem 65536 reached [ 747.336083][T24299] macsec1: entered promiscuous mode [ 747.352187][T24299] macvlan1: entered promiscuous mode [ 747.364240][T24299] macsec1: entered allmulticast mode [ 747.382680][T24299] macvlan1: entered allmulticast mode [ 747.407411][T24299] veth1_vlan: entered allmulticast mode [ 747.435077][T24307] netlink: 'syz.3.4919': attribute type 1 has an invalid length. [ 747.465512][T24307] netlink: 172 bytes leftover after parsing attributes in process `syz.3.4919'. [ 747.486484][T24299] macvlan1: left allmulticast mode [ 747.511863][T24299] veth1_vlan: left allmulticast mode [ 747.538699][T24299] macvlan1: left promiscuous mode [ 747.827795][T24309] lo speed is unknown, defaulting to 1000 [ 747.857186][T24309] lo speed is unknown, defaulting to 1000 [ 747.876105][T24309] lo speed is unknown, defaulting to 1000 [ 747.883461][T24316] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4922'. [ 747.912324][T24316] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4922'. [ 748.181258][ T30] audit: type=1800 audit(1753989329.319:12): pid=24321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4923" name="memory.events" dev="tmpfs" ino=1776 res=0 errno=0 [ 748.525014][T24328] 8021q: adding VLAN 0 to HW filter on device team0 [ 748.539632][T24328] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 748.566246][T24330] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4926'. [ 748.587852][ T9] lo speed is unknown, defaulting to 1000 [ 748.593650][ T9] syz1: Port: 1 Link ACTIVE [ 748.595010][T24332] bond0: entered promiscuous mode [ 748.622519][T24332] batadv0: entered promiscuous mode [ 748.629769][T24332] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 748.640090][T24332] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 748.651079][T24332] hsr1: entered allmulticast mode [ 748.656231][T24332] bond0: entered allmulticast mode [ 748.661882][T24332] batadv0: entered allmulticast mode [ 748.668320][T24332] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 748.680330][T24332] bond0: left promiscuous mode [ 748.686087][T24332] batadv0: left promiscuous mode [ 749.044481][T24356] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4933'. [ 749.058583][T24356] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4933'. [ 749.099088][T24358] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4934'. [ 749.171149][T24358] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4934'. [ 749.358151][T24365] macvlan1: entered promiscuous mode [ 749.363715][T24365] macvlan1: entered allmulticast mode [ 749.388963][T24365] veth1_vlan: entered allmulticast mode [ 749.458416][T24372] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4939'. [ 749.491817][T24372] netlink: 7 bytes leftover after parsing attributes in process `syz.4.4939'. [ 750.032205][T24394] syzkaller1: entered promiscuous mode [ 750.044611][T24394] syzkaller1: entered allmulticast mode [ 750.420212][T24400] netlink: 'syz.2.4948': attribute type 1 has an invalid length. [ 750.712735][T24419] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 750.739627][T24411] netlink: 'syz.1.4953': attribute type 3 has an invalid length. [ 750.801631][T24422] IPVS: set_ctl: invalid protocol: 60 172.20.20.187:20004 [ 750.885584][T24425] lo speed is unknown, defaulting to 1000 [ 750.935031][T24425] lo speed is unknown, defaulting to 1000 [ 750.963737][T24428] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 750.989444][T24425] lo speed is unknown, defaulting to 1000 [ 751.225293][T24447] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 751.692612][T24468] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 751.708981][T24468] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 751.725333][T24468] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 751.739990][T24468] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 751.756927][T24468] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 751.783103][T24468] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 752.858213][T24501] __nla_validate_parse: 14 callbacks suppressed [ 752.858240][T24501] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.4979'. [ 752.949945][T24497] lo speed is unknown, defaulting to 1000 [ 753.064459][T24497] lo speed is unknown, defaulting to 1000 [ 753.170661][T24508] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4983'. [ 753.230415][T24497] lo speed is unknown, defaulting to 1000 [ 753.330444][T24516] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4985'. [ 753.365060][T24517] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4984'. [ 753.748881][ T5848] Bluetooth: hci0: command tx timeout [ 753.826316][T24534] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4989'. [ 753.857300][T24534] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4989'. [ 753.904055][T24531] tipc: Enabled bearer , priority 0 [ 753.922989][T24531] syzkaller0: entered promiscuous mode [ 753.929238][T24531] syzkaller0: entered allmulticast mode [ 754.290974][T24547] tipc: Enabling of bearer rejected, failed to enable media [ 754.350540][T24549] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4994'. [ 754.371921][T24551] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4994'. [ 754.567057][T24530] tipc: Resetting bearer [ 754.675298][T24530] tipc: Disabling bearer [ 755.812366][T24605] netlink: 788 bytes leftover after parsing attributes in process `syz.1.5012'. [ 756.036636][T24617] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5015'. [ 757.094909][T24644] lo speed is unknown, defaulting to 1000 [ 757.143996][T24643] lo speed is unknown, defaulting to 1000 [ 757.148184][T24662] netlink: 'syz.2.5028': attribute type 30 has an invalid length. [ 757.177116][T24644] lo speed is unknown, defaulting to 1000 [ 757.299986][T24643] lo speed is unknown, defaulting to 1000 [ 757.346163][T24644] lo speed is unknown, defaulting to 1000 [ 757.929490][T24643] lo speed is unknown, defaulting to 1000 [ 758.070964][T24699] __nla_validate_parse: 41 callbacks suppressed [ 758.070991][T24699] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5036'. [ 758.264263][T24705] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5038'. [ 758.313533][T24704] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5038'. [ 758.504577][T24714] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 758.610411][T24714] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5041'. [ 758.740586][T24723] netlink: 18 bytes leftover after parsing attributes in process `syz.3.5042'. [ 758.923145][T24725] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5044'. [ 759.168736][T24739] netlink: 'syz.3.5047': attribute type 1 has an invalid length. [ 759.381910][T24742] bond5: (slave gretap2): making interface the new active one [ 759.391196][T24742] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 759.484633][T24749] netlink: 'syz.2.5050': attribute type 10 has an invalid length. [ 759.603338][T24749] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.5050'. [ 759.888462][T24760] netlink: 'syz.4.5053': attribute type 1 has an invalid length. [ 759.896257][T24760] netlink: 236 bytes leftover after parsing attributes in process `syz.4.5053'. [ 759.930610][T24760] NCSI netlink: No device for ifindex 813332851 [ 760.043885][T24762] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5055'. [ 760.069709][T24762] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5055'. [ 761.774388][T24816] smc: net device bond0 applied user defined pnetid SYZ2 [ 761.820647][T24819] lo speed is unknown, defaulting to 1000 [ 761.888323][T24819] lo speed is unknown, defaulting to 1000 [ 761.910340][T24826] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 761.920340][T24819] lo speed is unknown, defaulting to 1000 [ 762.190912][T24834] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 762.209761][T24836] netlink: 'syz.0.5074': attribute type 1 has an invalid length. [ 762.250095][T24838] netlink: 'syz.2.5075': attribute type 10 has an invalid length. [ 762.261121][T24834] tipc: Enabled bearer , priority 10 [ 762.275524][T24841] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond0, syncid = 8, id = 0 [ 762.322755][T24838] team0: Port device geneve0 added [ 762.332636][T17133] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.369785][T17133] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.409204][T17133] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.456069][T17133] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.567178][T24853] netlink: 'syz.2.5078': attribute type 21 has an invalid length. [ 762.638523][T24855] vlan0: entered promiscuous mode [ 763.044712][T24866] netlink: 'syz.2.5083': attribute type 7 has an invalid length. [ 763.477728][T24872] lo speed is unknown, defaulting to 1000 [ 763.495835][T24872] lo speed is unknown, defaulting to 1000 [ 763.567571][T24872] lo speed is unknown, defaulting to 1000 [ 763.749213][T24883] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 764.022523][T24891] __nla_validate_parse: 6 callbacks suppressed [ 764.022545][T24891] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5092'. [ 764.105480][T24889] IPVS: set_ctl: invalid protocol: 137 172.20.20.187:20004 [ 764.521378][T24914] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 764.634136][T24904] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5094'. [ 765.027150][T24924] netlink: 27 bytes leftover after parsing attributes in process `syz.0.5098'. [ 765.358819][T24932] tipc: Enabling of bearer rejected, already enabled [ 765.399575][T24932] syzkaller0: Caught tx_queue_len zero misconfig [ 765.697218][T24932] syzkaller0: mtu less than device minimum [ 765.903976][T24944] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.125504][T24957] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5106'. [ 768.472068][T24944] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.667752][T24967] netlink: 'syz.0.5108': attribute type 1 has an invalid length. [ 768.683759][T24967] netlink: 208 bytes leftover after parsing attributes in process `syz.0.5108'. [ 768.695661][T24944] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.801664][T24944] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.098888][T17149] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.136388][T17149] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.196205][T17133] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.207122][T24992] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5116'. [ 769.237173][T17133] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.281151][T24990] macvlan3: entered allmulticast mode [ 769.286583][T24990] veth1_vlan: entered allmulticast mode [ 769.304097][T24990] veth1_vlan: left allmulticast mode [ 769.447257][T25000] 8021q: adding VLAN 0 to HW filter on device bond6 [ 769.474172][T25009] netlink: 'syz.2.5121': attribute type 2 has an invalid length. [ 769.654652][T25014] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5122'. [ 769.731510][T25006] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 769.763348][T25006] bond6: (slave macvlan3): Enslaving as a backup interface with a down link [ 769.789239][T25016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5123'. [ 769.819924][T25009] : entered promiscuous mode [ 769.829707][T25016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5123'. [ 769.868815][T25016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5123'. [ 769.917112][T25016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5123'. [ 769.956921][T25016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5123'. [ 770.041684][T25014] 8021q: adding VLAN 0 to HW filter on device bond1 [ 770.112118][T25016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5123'. [ 770.150203][T25026] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5124'. [ 770.153395][T25018] 8021q: adding VLAN 0 to HW filter on device bond1 [ 770.168136][T25018] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 770.169982][T25016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5123'. [ 770.192975][T25018] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 770.245301][T25029] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 770.561818][T25035] lo speed is unknown, defaulting to 1000 [ 770.578788][T25035] lo speed is unknown, defaulting to 1000 [ 770.596306][T25035] lo speed is unknown, defaulting to 1000 [ 770.606253][T25037] FAULT_INJECTION: forcing a failure. [ 770.606253][T25037] name failslab, interval 1, probability 0, space 0, times 0 [ 770.651830][T25037] CPU: 0 UID: 0 PID: 25037 Comm: syz.1.5127 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 770.651884][T25037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 770.651904][T25037] Call Trace: [ 770.651914][T25037] [ 770.651924][T25037] dump_stack_lvl+0x189/0x250 [ 770.651958][T25037] ? __pfx____ratelimit+0x10/0x10 [ 770.651986][T25037] ? __pfx_dump_stack_lvl+0x10/0x10 [ 770.652004][T25037] ? __pfx__printk+0x10/0x10 [ 770.652032][T25037] ? __pfx___might_resched+0x10/0x10 [ 770.652058][T25037] ? fs_reclaim_acquire+0x7d/0x100 [ 770.652083][T25037] should_fail_ex+0x414/0x560 [ 770.652119][T25037] should_failslab+0xa8/0x100 [ 770.652142][T25037] __kmalloc_noprof+0xcb/0x4f0 [ 770.652165][T25037] ? kfree+0x4d/0x440 [ 770.652184][T25037] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 770.652215][T25037] tomoyo_realpath_from_path+0xe3/0x5d0 [ 770.652240][T25037] ? tomoyo_domain+0xd9/0x130 [ 770.652269][T25037] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 770.652291][T25037] tomoyo_path_number_perm+0x1e8/0x5a0 [ 770.652315][T25037] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 770.652354][T25037] ? __lock_acquire+0xab9/0xd20 [ 770.652400][T25037] ? __fget_files+0x2a/0x420 [ 770.652422][T25037] ? __fget_files+0x2a/0x420 [ 770.652437][T25037] ? __fget_files+0x3a0/0x420 [ 770.652452][T25037] ? __fget_files+0x2a/0x420 [ 770.652473][T25037] security_file_ioctl+0xcb/0x2d0 [ 770.652499][T25037] __se_sys_ioctl+0x47/0x170 [ 770.652525][T25037] do_syscall_64+0xfa/0x3b0 [ 770.652551][T25037] ? lockdep_hardirqs_on+0x9c/0x150 [ 770.652579][T25037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.652599][T25037] ? clear_bhb_loop+0x60/0xb0 [ 770.652622][T25037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.652638][T25037] RIP: 0033:0x7fd481f8eb69 [ 770.652658][T25037] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 770.652674][T25037] RSP: 002b:00007fd482df6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 770.652698][T25037] RAX: ffffffffffffffda RBX: 00007fd4821b5fa0 RCX: 00007fd481f8eb69 [ 770.652711][T25037] RDX: 0000200000000000 RSI: 00000000000089f1 RDI: 0000000000000003 [ 770.652723][T25037] RBP: 00007fd482df6090 R08: 0000000000000000 R09: 0000000000000000 [ 770.652734][T25037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 770.652745][T25037] R13: 0000000000000000 R14: 00007fd4821b5fa0 R15: 00007ffe1c860b88 [ 770.652776][T25037] [ 770.652785][T25037] ERROR: Out of memory at tomoyo_realpath_from_path. [ 771.024980][T25046] mac80211_hwsim hwsim37 wlan0: entered promiscuous mode [ 771.078212][T25046] macsec0: entered promiscuous mode [ 771.083728][T25046] macsec0: entered allmulticast mode [ 771.149640][T25046] mac80211_hwsim hwsim37 wlan0: entered allmulticast mode [ 771.235982][T25051] team0: Port device dummy0 removed [ 771.537908][ T30] audit: type=1800 audit(1753989352.679:13): pid=25057 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.5134" name="memory.events" dev="tmpfs" ino=2055 res=0 errno=0 [ 771.673923][T25061] tipc: Enabling of bearer rejected, failed to enable media [ 772.360985][T25075] lo speed is unknown, defaulting to 1000 [ 772.387769][T25075] lo speed is unknown, defaulting to 1000 [ 772.406504][T25075] lo speed is unknown, defaulting to 1000 [ 772.549595][T25086] FAULT_INJECTION: forcing a failure. [ 772.549595][T25086] name failslab, interval 1, probability 0, space 0, times 0 [ 772.616990][T25086] CPU: 1 UID: 0 PID: 25086 Comm: syz.2.5141 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 772.617025][T25086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 772.617037][T25086] Call Trace: [ 772.617046][T25086] [ 772.617056][T25086] dump_stack_lvl+0x189/0x250 [ 772.617086][T25086] ? __pfx____ratelimit+0x10/0x10 [ 772.617112][T25086] ? __pfx_dump_stack_lvl+0x10/0x10 [ 772.617132][T25086] ? __pfx__printk+0x10/0x10 [ 772.617155][T25086] ? __pfx___might_resched+0x10/0x10 [ 772.617181][T25086] ? fs_reclaim_acquire+0x7d/0x100 [ 772.617207][T25086] should_fail_ex+0x414/0x560 [ 772.617241][T25086] should_failslab+0xa8/0x100 [ 772.617262][T25086] __kmalloc_noprof+0xcb/0x4f0 [ 772.617286][T25086] ? tomoyo_encode+0x28b/0x550 [ 772.617317][T25086] tomoyo_encode+0x28b/0x550 [ 772.617347][T25086] tomoyo_realpath_from_path+0x58d/0x5d0 [ 772.617374][T25086] ? tomoyo_domain+0xd9/0x130 [ 772.617411][T25086] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 772.617433][T25086] tomoyo_path_number_perm+0x1e8/0x5a0 [ 772.617459][T25086] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 772.617499][T25086] ? __lock_acquire+0xab9/0xd20 [ 772.617546][T25086] ? __fget_files+0x2a/0x420 [ 772.617568][T25086] ? __fget_files+0x2a/0x420 [ 772.617584][T25086] ? __fget_files+0x3a0/0x420 [ 772.617600][T25086] ? __fget_files+0x2a/0x420 [ 772.617622][T25086] security_file_ioctl+0xcb/0x2d0 [ 772.617645][T25086] __se_sys_ioctl+0x47/0x170 [ 772.617672][T25086] do_syscall_64+0xfa/0x3b0 [ 772.617698][T25086] ? lockdep_hardirqs_on+0x9c/0x150 [ 772.617722][T25086] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.617740][T25086] ? clear_bhb_loop+0x60/0xb0 [ 772.617762][T25086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.617779][T25086] RIP: 0033:0x7efda118eb69 [ 772.617796][T25086] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 772.617812][T25086] RSP: 002b:00007efda20d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 772.617836][T25086] RAX: ffffffffffffffda RBX: 00007efda13b5fa0 RCX: 00007efda118eb69 [ 772.617850][T25086] RDX: 0000200000000000 RSI: 00000000000089f1 RDI: 0000000000000003 [ 772.617861][T25086] RBP: 00007efda20d5090 R08: 0000000000000000 R09: 0000000000000000 [ 772.617873][T25086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 772.617885][T25086] R13: 0000000000000000 R14: 00007efda13b5fa0 R15: 00007ffc6a1d5618 [ 772.617916][T25086] [ 772.617950][T25086] ERROR: Out of memory at tomoyo_realpath_from_path. [ 773.217564][T25094] 8021q: adding VLAN 0 to HW filter on device bond2 [ 773.325212][T25096] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 773.369528][T25096] bond2: (slave macvlan3): Enslaving as a backup interface with a down link [ 773.543419][ T5896] IPVS: starting estimator thread 0... [ 773.549633][T25102] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 773.549717][T25101] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 773.647259][T25109] IPVS: using max 31 ests per chain, 74400 per kthread [ 774.044236][T25126] bond3: entered promiscuous mode [ 774.080315][T25126] bond3: entered allmulticast mode [ 774.086021][T25126] 8021q: adding VLAN 0 to HW filter on device bond3 [ 774.339027][T25139] FAULT_INJECTION: forcing a failure. [ 774.339027][T25139] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 774.415915][T25139] CPU: 0 UID: 0 PID: 25139 Comm: syz.4.5156 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 774.415948][T25139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 774.415962][T25139] Call Trace: [ 774.415970][T25139] [ 774.415990][T25139] dump_stack_lvl+0x189/0x250 [ 774.416021][T25139] ? __pfx____ratelimit+0x10/0x10 [ 774.416048][T25139] ? __pfx_dump_stack_lvl+0x10/0x10 [ 774.416067][T25139] ? __pfx__printk+0x10/0x10 [ 774.416101][T25139] should_fail_ex+0x414/0x560 [ 774.416137][T25139] _copy_from_user+0x2d/0xb0 [ 774.416165][T25139] get_user_ifreq+0x6c/0x180 [ 774.416194][T25139] sock_ioctl+0x6dd/0x790 [ 774.416218][T25139] ? __pfx_sock_ioctl+0x10/0x10 [ 774.416240][T25139] ? __fget_files+0x3a0/0x420 [ 774.416260][T25139] ? __fget_files+0x2a/0x420 [ 774.416280][T25139] ? bpf_lsm_file_ioctl+0x9/0x20 [ 774.416304][T25139] ? __pfx_sock_ioctl+0x10/0x10 [ 774.416325][T25139] __se_sys_ioctl+0xf9/0x170 [ 774.416351][T25139] do_syscall_64+0xfa/0x3b0 [ 774.416377][T25139] ? lockdep_hardirqs_on+0x9c/0x150 [ 774.416399][T25139] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.416417][T25139] ? clear_bhb_loop+0x60/0xb0 [ 774.416440][T25139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.416457][T25139] RIP: 0033:0x7fcde1d8eb69 [ 774.416476][T25139] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 774.416492][T25139] RSP: 002b:00007fcde2cd9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 774.416517][T25139] RAX: ffffffffffffffda RBX: 00007fcde1fb5fa0 RCX: 00007fcde1d8eb69 [ 774.416531][T25139] RDX: 0000200000000000 RSI: 00000000000089f1 RDI: 0000000000000003 [ 774.416543][T25139] RBP: 00007fcde2cd9090 R08: 0000000000000000 R09: 0000000000000000 [ 774.416554][T25139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 774.416566][T25139] R13: 0000000000000000 R14: 00007fcde1fb5fa0 R15: 00007ffe4802f7c8 [ 774.416598][T25139] [ 774.808853][T25143] __nla_validate_parse: 16 callbacks suppressed [ 774.808877][T25143] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5158'. [ 774.946361][T25148] netlink: 'syz.4.5158': attribute type 4 has an invalid length. [ 775.762451][T25175] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5165'. [ 775.813475][T25175] openvswitch: netlink: nsh attr 2560 is out of range max 3 [ 775.906448][T25175] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 776.057935][T25192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5169'. [ 776.285203][T25202] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 776.341542][T25209] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5172'. [ 776.510740][T25202] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 776.823925][T25215] 8021q: adding VLAN 0 to HW filter on device bond4 [ 776.849283][T25215] bridge0: port 1(bond4) entered blocking state [ 776.859927][T25215] bridge0: port 1(bond4) entered disabled state [ 776.891194][T25215] bond4: entered allmulticast mode [ 776.922764][T25215] bond4: entered promiscuous mode [ 776.939186][T25217] batadv_slave_1: entered promiscuous mode [ 776.950758][T25202] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 776.996569][T25223] batadv_slave_1: left promiscuous mode [ 777.051783][T25202] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.232251][T25232] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 777.283518][T17125] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.295734][T17125] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.384652][ T3500] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.436346][ T3500] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.473865][T25241] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 777.543622][T25239] : entered promiscuous mode [ 777.563366][T25237] lo speed is unknown, defaulting to 1000 [ 777.570226][T25245] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5186'. [ 777.574977][T25237] lo speed is unknown, defaulting to 1000 [ 777.598504][T25237] lo speed is unknown, defaulting to 1000 [ 777.651655][T25245] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5186'. [ 777.744942][T25249] tipc: Enabling of bearer rejected, already enabled [ 778.595287][T25268] FAULT_INJECTION: forcing a failure. [ 778.595287][T25268] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 778.625390][T25268] CPU: 1 UID: 0 PID: 25268 Comm: syz.2.5194 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 778.625424][T25268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 778.625437][T25268] Call Trace: [ 778.625447][T25268] [ 778.625456][T25268] dump_stack_lvl+0x189/0x250 [ 778.625485][T25268] ? __pfx____ratelimit+0x10/0x10 [ 778.625512][T25268] ? __pfx_dump_stack_lvl+0x10/0x10 [ 778.625531][T25268] ? __pfx__printk+0x10/0x10 [ 778.625563][T25268] should_fail_ex+0x414/0x560 [ 778.625598][T25268] _copy_to_user+0x31/0xb0 [ 778.625626][T25268] simple_read_from_buffer+0xe1/0x170 [ 778.625661][T25268] proc_fail_nth_read+0x1b3/0x220 [ 778.625690][T25268] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 778.625715][T25268] ? rw_verify_area+0x258/0x650 [ 778.625737][T25268] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 778.625760][T25268] vfs_read+0x1fd/0x980 [ 778.625794][T25268] ? fdget_pos+0x247/0x320 [ 778.625816][T25268] ? __pfx___mutex_lock+0x10/0x10 [ 778.625844][T25268] ? __pfx_vfs_read+0x10/0x10 [ 778.625870][T25268] ? __fget_files+0x2a/0x420 [ 778.625891][T25268] ? __fget_files+0x3a0/0x420 [ 778.625908][T25268] ? __fget_files+0x2a/0x420 [ 778.625934][T25268] ksys_read+0x145/0x250 [ 778.625961][T25268] ? __pfx_ksys_read+0x10/0x10 [ 778.625981][T25268] ? rcu_is_watching+0x15/0xb0 [ 778.626014][T25268] ? do_syscall_64+0xbe/0x3b0 [ 778.626043][T25268] do_syscall_64+0xfa/0x3b0 [ 778.626065][T25268] ? lockdep_hardirqs_on+0x9c/0x150 [ 778.626088][T25268] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.626106][T25268] ? clear_bhb_loop+0x60/0xb0 [ 778.626128][T25268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.626145][T25268] RIP: 0033:0x7efda118d57c [ 778.626164][T25268] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 778.626180][T25268] RSP: 002b:00007efda20d5030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 778.626202][T25268] RAX: ffffffffffffffda RBX: 00007efda13b5fa0 RCX: 00007efda118d57c [ 778.626216][T25268] RDX: 000000000000000f RSI: 00007efda20d50a0 RDI: 0000000000000004 [ 778.626227][T25268] RBP: 00007efda20d5090 R08: 0000000000000000 R09: 0000000000000000 [ 778.626238][T25268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 778.626248][T25268] R13: 0000000000000000 R14: 00007efda13b5fa0 R15: 00007ffc6a1d5618 [ 778.626282][T25268] [ 779.189105][T25280] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5198'. [ 779.217898][T25280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5198'. [ 779.265206][T25276] netlink: 'syz.0.5197': attribute type 5 has an invalid length. [ 780.034962][T25310] netlink: 68 bytes leftover after parsing attributes in process `syz.4.5205'. [ 780.267461][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.277085][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.306360][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.321316][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.342785][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.355901][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.375007][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.385711][T25325] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5212'. [ 780.395959][T25321] lo speed is unknown, defaulting to 1000 [ 780.405346][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 780.424129][T25326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 780.425174][T25321] lo speed is unknown, defaulting to 1000 [ 780.447709][T25321] lo speed is unknown, defaulting to 1000 [ 780.729121][T25332] netlink: 'syz.2.5215': attribute type 2 has an invalid length. [ 780.755121][T25332] netlink: 'syz.2.5215': attribute type 1 has an invalid length. [ 780.780368][T25332] netlink: 'syz.2.5215': attribute type 1 has an invalid length. [ 780.898183][T25334] 8021q: VLANs not supported on vxcan0 [ 781.118693][T25347] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (34) [ 781.209038][ T30] audit: type=1804 audit(1753989362.349:14): pid=25351 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.5221" name="/newroot/430/memory.events" dev="tmpfs" ino=2211 res=1 errno=0 [ 781.317574][ T30] audit: type=1800 audit(1753989362.349:15): pid=25351 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5221" name="memory.events" dev="tmpfs" ino=2211 res=0 errno=0 [ 781.684513][T25368] 8021q: VLANs not supported on sit0 [ 781.701149][T25367] 8021q: VLANs not supported on sit0 [ 782.103824][T25384] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 782.162641][T25381] lo speed is unknown, defaulting to 1000 [ 782.220890][T25381] lo speed is unknown, defaulting to 1000 [ 782.282710][T25381] lo speed is unknown, defaulting to 1000 [ 782.493860][T25391] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 782.682575][T25391] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 782.830039][T25391] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 782.923189][T25400] pim6reg1: entered promiscuous mode [ 782.944719][T25400] pim6reg1: entered allmulticast mode [ 782.961386][T25391] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 783.116974][ T3500] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 783.266143][ T3500] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 783.275459][ T3500] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 783.335504][T25412] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 783.454036][T25416] FAULT_INJECTION: forcing a failure. [ 783.454036][T25416] name failslab, interval 1, probability 0, space 0, times 0 [ 783.472381][ T3500] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 783.483529][T25416] CPU: 0 UID: 0 PID: 25416 Comm: syz.2.5241 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 783.483562][T25416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 783.483575][T25416] Call Trace: [ 783.483583][T25416] [ 783.483594][T25416] dump_stack_lvl+0x189/0x250 [ 783.483625][T25416] ? __pfx____ratelimit+0x10/0x10 [ 783.483652][T25416] ? __pfx_dump_stack_lvl+0x10/0x10 [ 783.483670][T25416] ? __pfx__printk+0x10/0x10 [ 783.483700][T25416] ? __pfx___might_resched+0x10/0x10 [ 783.483724][T25416] ? fs_reclaim_acquire+0x7d/0x100 [ 783.483751][T25416] should_fail_ex+0x414/0x560 [ 783.483786][T25416] should_failslab+0xa8/0x100 [ 783.483806][T25416] kmem_cache_alloc_noprof+0x73/0x3c0 [ 783.483832][T25416] ? vm_area_dup+0x2b/0x680 [ 783.483856][T25416] vm_area_dup+0x2b/0x680 [ 783.483878][T25416] __split_vma+0x1a9/0xa00 [ 783.483911][T25416] ? __pfx___split_vma+0x10/0x10 [ 783.483945][T25416] ? process_measurement+0x1640/0x1a40 [ 783.483979][T25416] vms_gather_munmap_vmas+0x2de/0x12b0 [ 783.484016][T25416] ? mtree_range_walk+0x6a7/0x840 [ 783.484041][T25416] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 783.484083][T25416] mmap_region+0x678/0x1f30 [ 783.484126][T25416] ? __pfx_mmap_region+0x10/0x10 [ 783.484152][T25416] ? is_bpf_text_address+0x26/0x2b0 [ 783.484193][T25416] ? __lock_acquire+0xab9/0xd20 [ 783.484264][T25416] ? mm_get_unmapped_area+0xa7/0xd0 [ 783.484301][T25416] ? shmem_get_unmapped_area+0x2cf/0x910 [ 783.484328][T25416] ? cap_mmap_addr+0xb0/0x100 [ 783.484351][T25416] ? bpf_lsm_mmap_addr+0x9/0x20 [ 783.484373][T25416] ? security_mmap_addr+0x71/0x270 [ 783.484406][T25416] do_mmap+0xc45/0x10d0 [ 783.484439][T25416] ? __pfx_do_mmap+0x10/0x10 [ 783.484462][T25416] ? down_write_killable+0x178/0x230 [ 783.484483][T25416] ? __pfx_vfs_write+0x10/0x10 [ 783.484507][T25416] ? __pfx_down_write_killable+0x10/0x10 [ 783.484523][T25416] ? apparmor_mmap_file+0xc4/0xe0 [ 783.484550][T25416] vm_mmap_pgoff+0x31b/0x4c0 [ 783.484582][T25416] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 783.484599][T25416] ? ksys_write+0x22a/0x250 [ 783.484624][T25416] ? __pfx_ksys_write+0x10/0x10 [ 783.484645][T25416] ? rcu_is_watching+0x15/0xb0 [ 783.484673][T25416] ? ksys_mmap_pgoff+0xf4/0x760 [ 783.484697][T25416] ? __x64_sys_mmap+0x7f/0x140 [ 783.484721][T25416] do_syscall_64+0xfa/0x3b0 [ 783.484745][T25416] ? lockdep_hardirqs_on+0x9c/0x150 [ 783.484768][T25416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.484787][T25416] ? clear_bhb_loop+0x60/0xb0 [ 783.484809][T25416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.484826][T25416] RIP: 0033:0x7efda118eb69 [ 783.484845][T25416] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 783.484861][T25416] RSP: 002b:00007efda20d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 783.484885][T25416] RAX: ffffffffffffffda RBX: 00007efda13b5fa0 RCX: 00007efda118eb69 [ 783.484900][T25416] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000200000003000 [ 783.484913][T25416] RBP: 00007efda20d5090 R08: ffffffffffffffff R09: 0000000000000000 [ 783.484926][T25416] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000001 [ 783.484938][T25416] R13: 0000000000000000 R14: 00007efda13b5fa0 R15: 00007ffc6a1d5618 [ 783.484968][T25416] [ 783.524826][T25410] lo speed is unknown, defaulting to 1000 [ 783.836878][T25410] lo speed is unknown, defaulting to 1000 [ 783.845653][T25410] lo speed is unknown, defaulting to 1000 [ 784.841465][T25462] FAULT_INJECTION: forcing a failure. [ 784.841465][T25462] name failslab, interval 1, probability 0, space 0, times 0 [ 784.874958][T25462] CPU: 0 UID: 0 PID: 25462 Comm: syz.3.5254 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 784.874993][T25462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 784.875006][T25462] Call Trace: [ 784.875015][T25462] [ 784.875025][T25462] dump_stack_lvl+0x189/0x250 [ 784.875056][T25462] ? __pfx____ratelimit+0x10/0x10 [ 784.875084][T25462] ? __pfx_dump_stack_lvl+0x10/0x10 [ 784.875103][T25462] ? __pfx__printk+0x10/0x10 [ 784.875132][T25462] ? __pfx___might_resched+0x10/0x10 [ 784.875164][T25462] should_fail_ex+0x414/0x560 [ 784.875199][T25462] should_failslab+0xa8/0x100 [ 784.875221][T25462] kmem_cache_alloc_noprof+0x73/0x3c0 [ 784.875248][T25462] ? mas_alloc_nodes+0x2e9/0x8e0 [ 784.875276][T25462] mas_alloc_nodes+0x2e9/0x8e0 [ 784.875309][T25462] mas_preallocate+0x3ad/0x6f0 [ 784.875339][T25462] ? __pfx_mas_preallocate+0x10/0x10 [ 784.875374][T25462] ? __mas_set_range+0x12f/0x3c0 [ 784.875404][T25462] __split_vma+0x2fa/0xa00 [ 784.875438][T25462] ? __pfx___split_vma+0x10/0x10 [ 784.875473][T25462] ? process_measurement+0x1640/0x1a40 [ 784.875508][T25462] vms_gather_munmap_vmas+0x2de/0x12b0 [ 784.875547][T25462] ? mtree_range_walk+0x6a7/0x840 [ 784.875571][T25462] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 784.875616][T25462] mmap_region+0x678/0x1f30 [ 784.875661][T25462] ? __pfx_mmap_region+0x10/0x10 [ 784.875690][T25462] ? __lock_acquire+0xab9/0xd20 [ 784.875728][T25462] ? __lock_acquire+0xab9/0xd20 [ 784.875799][T25462] ? mm_get_unmapped_area+0xa7/0xd0 [ 784.875829][T25462] ? shmem_get_unmapped_area+0x2cf/0x910 [ 784.875858][T25462] ? cap_mmap_addr+0xb0/0x100 [ 784.875880][T25462] ? bpf_lsm_mmap_addr+0x9/0x20 [ 784.875903][T25462] ? security_mmap_addr+0x71/0x270 [ 784.875964][T25462] do_mmap+0xc45/0x10d0 [ 784.876002][T25462] ? __pfx_do_mmap+0x10/0x10 [ 784.876021][T25462] ? down_write_killable+0x178/0x230 [ 784.876041][T25462] ? __pfx_vfs_write+0x10/0x10 [ 784.876066][T25462] ? __pfx_down_write_killable+0x10/0x10 [ 784.876085][T25462] ? apparmor_mmap_file+0xc4/0xe0 [ 784.876113][T25462] vm_mmap_pgoff+0x31b/0x4c0 [ 784.876146][T25462] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 784.876164][T25462] ? ksys_write+0x22a/0x250 [ 784.876191][T25462] ? __pfx_ksys_write+0x10/0x10 [ 784.876211][T25462] ? rcu_is_watching+0x15/0xb0 [ 784.876240][T25462] ? ksys_mmap_pgoff+0xf4/0x760 [ 784.876264][T25462] ? __x64_sys_mmap+0x7f/0x140 [ 784.876288][T25462] do_syscall_64+0xfa/0x3b0 [ 784.876312][T25462] ? lockdep_hardirqs_on+0x9c/0x150 [ 784.876336][T25462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.876354][T25462] ? clear_bhb_loop+0x60/0xb0 [ 784.876378][T25462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.876396][T25462] RIP: 0033:0x7f863a18eb69 [ 784.876416][T25462] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 784.876433][T25462] RSP: 002b:00007f863b037038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 784.876458][T25462] RAX: ffffffffffffffda RBX: 00007f863a3b5fa0 RCX: 00007f863a18eb69 [ 784.876472][T25462] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000200000003000 [ 784.876486][T25462] RBP: 00007f863b037090 R08: ffffffffffffffff R09: 0000000000000000 [ 784.876499][T25462] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000001 [ 784.876511][T25462] R13: 0000000000000000 R14: 00007f863a3b5fa0 R15: 00007ffdd4b2a0e8 [ 784.876543][T25462] [ 785.405852][T25473] netlink: 'syz.0.5259': attribute type 1 has an invalid length. [ 785.414519][T25473] netlink: 'syz.0.5259': attribute type 2 has an invalid length. [ 785.482465][T25477] sctp: [Deprecated]: syz.0.5259 (pid 25477) Use of int in max_burst socket option deprecated. [ 785.482465][T25477] Use struct sctp_assoc_value instead [ 785.811909][T25488] __nla_validate_parse: 68 callbacks suppressed [ 785.811932][T25488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5261'. [ 786.049517][T25500] lo speed is unknown, defaulting to 1000 [ 786.069312][T25500] lo speed is unknown, defaulting to 1000 [ 786.082883][T25503] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 786.090153][T25500] lo speed is unknown, defaulting to 1000 [ 786.166051][T25504] veth3: entered promiscuous mode [ 786.350916][T25511] netlink: 'syz.0.5271': attribute type 2 has an invalid length. [ 786.359204][T25511] netlink: 164 bytes leftover after parsing attributes in process `syz.0.5271'. [ 786.387357][ T5851] Bluetooth: hci2: command 0x0401 tx timeout [ 786.395621][T25513] FAULT_INJECTION: forcing a failure. [ 786.395621][T25513] name failslab, interval 1, probability 0, space 0, times 0 [ 786.467349][T25517] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5273'. [ 786.473167][T25513] CPU: 0 UID: 0 PID: 25513 Comm: syz.3.5269 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 786.473197][T25513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 786.473210][T25513] Call Trace: [ 786.473219][T25513] [ 786.473228][T25513] dump_stack_lvl+0x189/0x250 [ 786.473257][T25513] ? __pfx____ratelimit+0x10/0x10 [ 786.473285][T25513] ? __pfx_dump_stack_lvl+0x10/0x10 [ 786.473303][T25513] ? __pfx__printk+0x10/0x10 [ 786.473333][T25513] ? __pfx___might_resched+0x10/0x10 [ 786.473358][T25513] ? fs_reclaim_acquire+0x7d/0x100 [ 786.473385][T25513] should_fail_ex+0x414/0x560 [ 786.473420][T25513] should_failslab+0xa8/0x100 [ 786.473440][T25513] kmem_cache_alloc_noprof+0x73/0x3c0 [ 786.473464][T25513] ? vm_area_dup+0x2b/0x680 [ 786.473487][T25513] vm_area_dup+0x2b/0x680 [ 786.473509][T25513] __split_vma+0x1a9/0xa00 [ 786.473544][T25513] ? mas_next_slot+0xc20/0xcf0 [ 786.473572][T25513] ? __pfx___split_vma+0x10/0x10 [ 786.473616][T25513] vms_gather_munmap_vmas+0x4ab/0x12b0 [ 786.473660][T25513] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 786.473704][T25513] mmap_region+0x678/0x1f30 [ 786.473760][T25513] ? __pfx_mmap_region+0x10/0x10 [ 786.473788][T25513] ? is_bpf_text_address+0x26/0x2b0 [ 786.473829][T25513] ? __lock_acquire+0xab9/0xd20 [ 786.473898][T25513] ? mm_get_unmapped_area+0xa7/0xd0 [ 786.473927][T25513] ? shmem_get_unmapped_area+0x2cf/0x910 [ 786.473956][T25513] ? cap_mmap_addr+0xb0/0x100 [ 786.473978][T25513] ? bpf_lsm_mmap_addr+0x9/0x20 [ 786.473999][T25513] ? security_mmap_addr+0x71/0x270 [ 786.474036][T25513] do_mmap+0xc45/0x10d0 [ 786.474072][T25513] ? __pfx_do_mmap+0x10/0x10 [ 786.474092][T25513] ? down_write_killable+0x178/0x230 [ 786.474112][T25513] ? __pfx_vfs_write+0x10/0x10 [ 786.474138][T25513] ? __pfx_down_write_killable+0x10/0x10 [ 786.474156][T25513] ? apparmor_mmap_file+0xc4/0xe0 [ 786.474183][T25513] vm_mmap_pgoff+0x31b/0x4c0 [ 786.474218][T25513] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 786.474237][T25513] ? ksys_write+0x22a/0x250 [ 786.474262][T25513] ? __pfx_ksys_write+0x10/0x10 [ 786.474283][T25513] ? rcu_is_watching+0x15/0xb0 [ 786.474311][T25513] ? ksys_mmap_pgoff+0xf4/0x760 [ 786.474334][T25513] ? __x64_sys_mmap+0x7f/0x140 [ 786.474357][T25513] do_syscall_64+0xfa/0x3b0 [ 786.474380][T25513] ? lockdep_hardirqs_on+0x9c/0x150 [ 786.474403][T25513] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.474421][T25513] ? clear_bhb_loop+0x60/0xb0 [ 786.474443][T25513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.474461][T25513] RIP: 0033:0x7f863a18eb69 [ 786.474479][T25513] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 786.474495][T25513] RSP: 002b:00007f863b037038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 786.474519][T25513] RAX: ffffffffffffffda RBX: 00007f863a3b5fa0 RCX: 00007f863a18eb69 [ 786.474533][T25513] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000200000003000 [ 786.474545][T25513] RBP: 00007f863b037090 R08: ffffffffffffffff R09: 0000000000000000 [ 786.474557][T25513] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000001 [ 786.474568][T25513] R13: 0000000000000000 R14: 00007f863a3b5fa0 R15: 00007ffdd4b2a0e8 [ 786.474598][T25513] [ 786.813977][T25517] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5273'. [ 786.840235][T25517] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5273'. [ 786.862682][T25517] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5273'. [ 786.968174][T25532] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5275'. [ 787.066271][T25535] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 787.092940][T25540] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5278'. [ 787.135745][T25541] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5278'. [ 787.196204][T25541] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5278'. [ 787.266567][T17133] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 787.289968][T25540] bridge7: port 1(veth0_to_bond) entered blocking state [ 787.298895][T25540] bridge7: port 1(veth0_to_bond) entered disabled state [ 787.306414][T25540] veth0_to_bond: entered allmulticast mode [ 787.326590][T25540] veth0_to_bond: entered promiscuous mode [ 787.345034][T17133] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 787.359364][T17133] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 787.385167][T17133] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 787.386065][T25552] siw: device registration error -23 [ 787.567976][T25567] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 787.676249][T25575] netlink: 'syz.0.5283': attribute type 32 has an invalid length. [ 787.844766][T25586] netlink: 'syz.3.5284': attribute type 2 has an invalid length. [ 788.026561][T25565] bond6: (slave macvlan3): Releasing backup interface [ 788.061277][T25565] smc: removing net device bond0 with user defined pnetid SYZ2 [ 788.084974][T25565] bond0 (unregistering): Released all slaves [ 788.125371][T25571] macsec0: entered promiscuous mode [ 788.131853][T25572] bridge_slave_0: entered allmulticast mode [ 788.192638][T25586] : entered promiscuous mode [ 788.508985][T25603] RDS: rds_bind could not find a transport for ::ffff:172.30.1.4, load rds_tcp or rds_rdma? [ 788.597528][T25606] tap0: tun_chr_ioctl cmd 1074025677 [ 788.622162][T25606] tap0: linktype set to 825 [ 788.741543][T25611] netlink: 'syz.3.5296': attribute type 10 has an invalid length. [ 788.750495][T25616] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 788.769641][T25611] team0: Port device dummy0 added [ 788.795203][T25609] lo speed is unknown, defaulting to 1000 [ 788.998183][T25609] lo speed is unknown, defaulting to 1000 [ 789.023371][T25609] lo speed is unknown, defaulting to 1000 [ 789.407871][T25631] tipc: Enabled bearer , priority 0 [ 789.422382][T25631] syzkaller0: entered promiscuous mode [ 789.436102][T25631] syzkaller0: entered allmulticast mode [ 789.552014][T25631] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 789.624602][T25631] tipc: Resetting bearer [ 789.649611][T25629] tipc: Resetting bearer [ 789.676341][T25629] tipc: Disabling bearer [ 789.716088][T25637] syzkaller1: entered promiscuous mode [ 789.722748][T25637] syzkaller1: entered allmulticast mode [ 789.734680][T25641] tipc: Enabled bearer , priority 0 [ 789.746426][T25642] tipc: Enabling of bearer rejected, already enabled [ 789.850393][T25640] syzkaller0: entered promiscuous mode [ 789.857984][T25640] syzkaller0: entered allmulticast mode [ 789.970000][ T8690] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 789.987592][ T8690] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 790.005349][T25642] tipc: Resetting bearer [ 790.027128][ T8690] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 790.052061][ T8690] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 790.134216][T25639] tipc: Resetting bearer [ 790.223656][T25639] tipc: Disabling bearer [ 790.244308][T25659] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 790.294757][T25659] (unnamed net_device) (uninitialized): option ad_select: invalid value (34) [ 790.774974][T25685] lo speed is unknown, defaulting to 1000 [ 790.831654][T25685] lo speed is unknown, defaulting to 1000 [ 790.898479][T25692] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 790.955605][T25685] lo speed is unknown, defaulting to 1000 [ 790.972591][T25689] lo speed is unknown, defaulting to 1000 [ 791.081614][T25689] lo speed is unknown, defaulting to 1000 [ 791.291471][T25701] FAULT_INJECTION: forcing a failure. [ 791.291471][T25701] name failslab, interval 1, probability 0, space 0, times 0 [ 791.320502][T25701] CPU: 0 UID: 0 PID: 25701 Comm: syz.2.5327 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 791.320536][T25701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 791.320549][T25701] Call Trace: [ 791.320561][T25701] [ 791.320571][T25701] dump_stack_lvl+0x189/0x250 [ 791.320601][T25701] ? __pfx____ratelimit+0x10/0x10 [ 791.320629][T25701] ? __pfx_dump_stack_lvl+0x10/0x10 [ 791.320648][T25701] ? __pfx__printk+0x10/0x10 [ 791.320677][T25701] ? __pfx___might_resched+0x10/0x10 [ 791.320709][T25701] should_fail_ex+0x414/0x560 [ 791.320742][T25701] ? __pfx_shmem_alloc_inode+0x10/0x10 [ 791.320761][T25701] should_failslab+0xa8/0x100 [ 791.320781][T25701] ? __pfx_shmem_alloc_inode+0x10/0x10 [ 791.320797][T25701] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 791.320823][T25701] ? shmem_alloc_inode+0x28/0x40 [ 791.320843][T25701] ? __pfx_shmem_alloc_inode+0x10/0x10 [ 791.320860][T25701] shmem_alloc_inode+0x28/0x40 [ 791.320877][T25701] alloc_inode+0x67/0x1b0 [ 791.320907][T25701] new_inode+0x22/0x170 [ 791.320931][T25701] shmem_get_inode+0x346/0xe90 [ 791.320969][T25701] __shmem_file_setup+0x1d3/0x300 [ 791.320997][T25701] shmem_zero_setup+0x8d/0x130 [ 791.321023][T25701] mmap_region+0x121e/0x1f30 [ 791.321069][T25701] ? __pfx_mmap_region+0x10/0x10 [ 791.321098][T25701] ? __lock_acquire+0xab9/0xd20 [ 791.321136][T25701] ? __lock_acquire+0xab9/0xd20 [ 791.321208][T25701] ? mm_get_unmapped_area+0xa7/0xd0 [ 791.321250][T25701] ? bpf_lsm_mmap_addr+0x9/0x20 [ 791.321272][T25701] ? security_mmap_addr+0x71/0x270 [ 791.321312][T25701] do_mmap+0xc45/0x10d0 [ 791.321349][T25701] ? __pfx_do_mmap+0x10/0x10 [ 791.321369][T25701] ? down_write_killable+0x178/0x230 [ 791.321390][T25701] ? __pfx_vfs_write+0x10/0x10 [ 791.321415][T25701] ? __pfx_down_write_killable+0x10/0x10 [ 791.321434][T25701] ? apparmor_mmap_file+0xc4/0xe0 [ 791.321461][T25701] vm_mmap_pgoff+0x31b/0x4c0 [ 791.321494][T25701] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 791.321512][T25701] ? ksys_write+0x22a/0x250 [ 791.321538][T25701] ? __pfx_ksys_write+0x10/0x10 [ 791.321558][T25701] ? rcu_is_watching+0x15/0xb0 [ 791.321588][T25701] ? ksys_mmap_pgoff+0xf4/0x760 [ 791.321611][T25701] ? __x64_sys_mmap+0x7f/0x140 [ 791.321635][T25701] do_syscall_64+0xfa/0x3b0 [ 791.321658][T25701] ? lockdep_hardirqs_on+0x9c/0x150 [ 791.321682][T25701] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.321700][T25701] ? clear_bhb_loop+0x60/0xb0 [ 791.321724][T25701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.321742][T25701] RIP: 0033:0x7efda118eb69 [ 791.321761][T25701] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 791.321777][T25701] RSP: 002b:00007efda20d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 791.321801][T25701] RAX: ffffffffffffffda RBX: 00007efda13b5fa0 RCX: 00007efda118eb69 [ 791.321816][T25701] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000200000003000 [ 791.321828][T25701] RBP: 00007efda20d5090 R08: ffffffffffffffff R09: 0000000000000000 [ 791.321840][T25701] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000001 [ 791.321852][T25701] R13: 0000000000000000 R14: 00007efda13b5fa0 R15: 00007ffc6a1d5618 [ 791.321885][T25701] [ 791.832814][T25689] lo speed is unknown, defaulting to 1000 [ 791.851935][T25707] __nla_validate_parse: 12 callbacks suppressed [ 791.851958][T25707] netlink: 248 bytes leftover after parsing attributes in process `syz.4.5329'. [ 792.091651][T25718] netlink: 3 bytes leftover after parsing attributes in process `syz.2.5332'. [ 792.111443][T25718] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5332'. [ 792.125835][T25718] netlink: 3 bytes leftover after parsing attributes in process `syz.2.5332'. [ 792.135395][T25718] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5332'. [ 792.145980][T25718] netlink: 3 bytes leftover after parsing attributes in process `syz.2.5332'. [ 792.178914][T25709] netlink: 248 bytes leftover after parsing attributes in process `syz.4.5329'. [ 792.451942][T25721] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5333'. [ 792.688290][T25730] netlink: 'syz.2.5337': attribute type 12 has an invalid length. [ 792.731051][T25736] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5336'. [ 792.823006][T25738] ipvlan2: entered promiscuous mode [ 792.836191][T25738] bridge0: port 2(ipvlan2) entered blocking state [ 792.850114][T25738] bridge0: port 2(ipvlan2) entered disabled state [ 792.864311][T25738] ipvlan2: entered allmulticast mode [ 792.873137][T25738] bridge0: entered allmulticast mode [ 792.883650][T25738] ipvlan2: left allmulticast mode [ 792.889823][T25738] bridge0: left allmulticast mode [ 792.956434][T25740] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5338'. [ 793.168272][T25750] netlink: 'syz.4.5341': attribute type 1 has an invalid length. [ 794.188704][T25801] netlink: 'syz.4.5354': attribute type 1 has an invalid length. [ 794.343307][T25816] netlink: 'syz.3.5360': attribute type 1 has an invalid length. [ 794.467574][T25820] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 794.479885][T25820] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 794.513227][ T5975] IPVS: starting estimator thread 0... [ 794.624081][T25838] netlink: 'syz.1.5361': attribute type 1 has an invalid length. [ 794.631876][T25827] IPVS: using max 32 ests per chain, 76800 per kthread [ 794.828425][T25844] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 794.937124][T25843] netlink: 'syz.3.5367': attribute type 5 has an invalid length. [ 795.033620][T25841] lo speed is unknown, defaulting to 1000 [ 795.068724][T25841] lo speed is unknown, defaulting to 1000 [ 795.098726][T25841] lo speed is unknown, defaulting to 1000 [ 795.240296][T25855] netlink: 'syz.4.5372': attribute type 1 has an invalid length. [ 795.512176][T25861] lo speed is unknown, defaulting to 1000 [ 795.584885][T25861] lo speed is unknown, defaulting to 1000 [ 795.615341][T25861] lo speed is unknown, defaulting to 1000 [ 795.688030][T25872] bridge0: port 2(vlan1) entered blocking state [ 795.715174][T25872] bridge0: port 2(vlan1) entered disabled state [ 795.737696][T25872] vlan1: entered allmulticast mode [ 795.742869][T25872] bridge0: entered allmulticast mode [ 795.772709][T25872] vlan1: left allmulticast mode [ 795.800022][T25872] bridge0: left allmulticast mode [ 795.994954][T25888] netlink: 'syz.4.5382': attribute type 1 has an invalid length. [ 796.310090][T25895] ip6gre2: entered promiscuous mode [ 796.357475][T25896] macsec3: entered promiscuous mode [ 796.372281][T25896] team0: entered promiscuous mode [ 796.381576][T25896] team_slave_1: entered promiscuous mode [ 796.396099][T25896] geneve0: entered promiscuous mode [ 796.405594][T25896] macsec3: entered allmulticast mode [ 796.421191][T25896] team0: entered allmulticast mode [ 796.426580][T25896] team_slave_1: entered allmulticast mode [ 796.435804][T25896] geneve0: entered allmulticast mode [ 796.446373][T25896] team0: Device macsec3 is already an upper device of the team interface [ 796.458753][T25896] team0: left allmulticast mode [ 796.463649][T25896] team_slave_1: left allmulticast mode [ 796.469292][T25896] geneve0: left allmulticast mode [ 796.474461][T25896] team0: left promiscuous mode [ 796.479924][T25896] team_slave_1: left promiscuous mode [ 796.485782][T25896] geneve0: left promiscuous mode [ 796.970981][T25928] __nla_validate_parse: 17 callbacks suppressed [ 796.971008][T25928] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5392'. [ 797.018783][T25927] netlink: 284 bytes leftover after parsing attributes in process `syz.0.5393'. [ 797.148830][T25937] FAULT_INJECTION: forcing a failure. [ 797.148830][T25937] name failslab, interval 1, probability 0, space 0, times 0 [ 797.180424][T25937] CPU: 1 UID: 0 PID: 25937 Comm: syz.2.5396 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 797.180461][T25937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 797.180473][T25937] Call Trace: [ 797.180483][T25937] [ 797.180494][T25937] dump_stack_lvl+0x189/0x250 [ 797.180524][T25937] ? __pfx____ratelimit+0x10/0x10 [ 797.180552][T25937] ? __pfx_dump_stack_lvl+0x10/0x10 [ 797.180570][T25937] ? __pfx__printk+0x10/0x10 [ 797.180599][T25937] ? __pfx___might_resched+0x10/0x10 [ 797.180624][T25937] ? fs_reclaim_acquire+0x7d/0x100 [ 797.180650][T25937] should_fail_ex+0x414/0x560 [ 797.180685][T25937] should_failslab+0xa8/0x100 [ 797.180705][T25937] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 797.180730][T25937] ? __d_alloc+0x36/0x7a0 [ 797.180757][T25937] ? __dquot_initialize+0x218/0xcb0 [ 797.180782][T25937] __d_alloc+0x36/0x7a0 [ 797.180809][T25937] d_alloc_pseudo+0x21/0xc0 [ 797.180831][T25937] alloc_file_pseudo+0xcc/0x210 [ 797.180857][T25937] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 797.180877][T25937] ? shmem_get_inode+0xbc5/0xe90 [ 797.180914][T25937] __shmem_file_setup+0x284/0x300 [ 797.180947][T25937] shmem_zero_setup+0x8d/0x130 [ 797.180973][T25937] mmap_region+0x121e/0x1f30 [ 797.181019][T25937] ? __pfx_mmap_region+0x10/0x10 [ 797.181047][T25937] ? is_bpf_text_address+0x26/0x2b0 [ 797.181087][T25937] ? __lock_acquire+0xab9/0xd20 [ 797.181158][T25937] ? mm_get_unmapped_area+0xa7/0xd0 [ 797.181198][T25937] ? bpf_lsm_mmap_addr+0x9/0x20 [ 797.181219][T25937] ? security_mmap_addr+0x71/0x270 [ 797.181251][T25937] do_mmap+0xc45/0x10d0 [ 797.181287][T25937] ? __pfx_do_mmap+0x10/0x10 [ 797.181306][T25937] ? down_write_killable+0x178/0x230 [ 797.181326][T25937] ? __pfx_vfs_write+0x10/0x10 [ 797.181350][T25937] ? __pfx_down_write_killable+0x10/0x10 [ 797.181369][T25937] ? apparmor_mmap_file+0xc4/0xe0 [ 797.181396][T25937] vm_mmap_pgoff+0x31b/0x4c0 [ 797.181429][T25937] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 797.181446][T25937] ? ksys_write+0x22a/0x250 [ 797.181473][T25937] ? __pfx_ksys_write+0x10/0x10 [ 797.181494][T25937] ? rcu_is_watching+0x15/0xb0 [ 797.181524][T25937] ? ksys_mmap_pgoff+0xf4/0x760 [ 797.181548][T25937] ? __x64_sys_mmap+0x7f/0x140 [ 797.181570][T25937] do_syscall_64+0xfa/0x3b0 [ 797.181593][T25937] ? lockdep_hardirqs_on+0x9c/0x150 [ 797.181617][T25937] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.181635][T25937] ? clear_bhb_loop+0x60/0xb0 [ 797.181657][T25937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.181676][T25937] RIP: 0033:0x7efda118eb69 [ 797.181695][T25937] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 797.181711][T25937] RSP: 002b:00007efda20d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 797.181736][T25937] RAX: ffffffffffffffda RBX: 00007efda13b5fa0 RCX: 00007efda118eb69 [ 797.181755][T25937] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000200000003000 [ 797.181768][T25937] RBP: 00007efda20d5090 R08: ffffffffffffffff R09: 0000000000000000 [ 797.181781][T25937] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000002 [ 797.181792][T25937] R13: 0000000000000000 R14: 00007efda13b5fa0 R15: 00007ffc6a1d5618 [ 797.181823][T25937] [ 797.602849][T25941] lo speed is unknown, defaulting to 1000 [ 797.662137][T25945] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 797.684318][T25941] lo speed is unknown, defaulting to 1000 [ 797.754701][T25941] lo speed is unknown, defaulting to 1000 [ 797.763869][T25946] tipc: Enabled bearer , priority 0 [ 797.777377][T25946] syzkaller0: entered promiscuous mode [ 797.809343][T25946] syzkaller0: entered allmulticast mode [ 797.904275][T25947] tipc: Resetting bearer [ 797.913302][T25952] netlink: 'syz.2.5400': attribute type 1 has an invalid length. [ 798.022386][T25952] 8021q: adding VLAN 0 to HW filter on device bond5 [ 798.121947][T25956] bond5: (slave bridge6): making interface the new active one [ 798.204584][T25956] bond5: (slave bridge6): Enslaving as an active interface with an up link [ 798.320673][T25963] bond5: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 798.425517][T25944] tipc: Resetting bearer [ 798.474937][T25944] tipc: Disabling bearer [ 799.066321][T25995] ipvlan2: entered promiscuous mode [ 799.343437][T26007] lo speed is unknown, defaulting to 1000 [ 799.365104][T26019] sctp: [Deprecated]: syz.3.5420 (pid 26019) Use of struct sctp_assoc_value in delayed_ack socket option. [ 799.365104][T26019] Use struct sctp_sack_info instead [ 799.375001][T26007] lo speed is unknown, defaulting to 1000 [ 799.419429][T26007] lo speed is unknown, defaulting to 1000 [ 799.434398][T26023] vxcan1: entered allmulticast mode [ 799.685563][T26029] netlink: 'syz.3.5423': attribute type 4 has an invalid length. [ 799.787013][ T5975] lo speed is unknown, defaulting to 1000 [ 799.800854][ T5975] syz1: Port: 1 Link DOWN [ 799.928541][T26041] FAULT_INJECTION: forcing a failure. [ 799.928541][T26041] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 799.977077][T26041] CPU: 1 UID: 0 PID: 26041 Comm: syz.3.5426 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 799.977111][T26041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 799.977123][T26041] Call Trace: [ 799.977132][T26041] [ 799.977142][T26041] dump_stack_lvl+0x189/0x250 [ 799.977173][T26041] ? __pfx____ratelimit+0x10/0x10 [ 799.977207][T26041] ? __pfx_dump_stack_lvl+0x10/0x10 [ 799.977227][T26041] ? __pfx__printk+0x10/0x10 [ 799.977265][T26041] should_fail_ex+0x414/0x560 [ 799.977299][T26041] _copy_to_user+0x31/0xb0 [ 799.977328][T26041] simple_read_from_buffer+0xe1/0x170 [ 799.977360][T26041] proc_fail_nth_read+0x1b3/0x220 [ 799.977385][T26041] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 799.977408][T26041] ? rw_verify_area+0x258/0x650 [ 799.977431][T26041] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 799.977462][T26041] vfs_read+0x1fd/0x980 [ 799.977485][T26041] ? fdget_pos+0x247/0x320 [ 799.977509][T26041] ? __pfx___mutex_lock+0x10/0x10 [ 799.977536][T26041] ? __pfx_vfs_read+0x10/0x10 [ 799.977562][T26041] ? __fget_files+0x2a/0x420 [ 799.977585][T26041] ? __fget_files+0x3a0/0x420 [ 799.977602][T26041] ? __fget_files+0x2a/0x420 [ 799.977629][T26041] ksys_read+0x145/0x250 [ 799.977656][T26041] ? __pfx_ksys_read+0x10/0x10 [ 799.977677][T26041] ? rcu_is_watching+0x15/0xb0 [ 799.977710][T26041] ? do_syscall_64+0xbe/0x3b0 [ 799.977740][T26041] do_syscall_64+0xfa/0x3b0 [ 799.977762][T26041] ? lockdep_hardirqs_on+0x9c/0x150 [ 799.977785][T26041] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 799.977803][T26041] ? clear_bhb_loop+0x60/0xb0 [ 799.977826][T26041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 799.977844][T26041] RIP: 0033:0x7f863a18d57c [ 799.977862][T26041] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 799.977879][T26041] RSP: 002b:00007f863b037030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 799.977902][T26041] RAX: ffffffffffffffda RBX: 00007f863a3b5fa0 RCX: 00007f863a18d57c [ 799.977917][T26041] RDX: 000000000000000f RSI: 00007f863b0370a0 RDI: 0000000000000008 [ 799.977929][T26041] RBP: 00007f863b037090 R08: 0000000000000000 R09: 0000000000000000 [ 799.977940][T26041] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000002 [ 799.977952][T26041] R13: 0000000000000000 R14: 00007f863a3b5fa0 R15: 00007ffdd4b2a0e8 [ 799.977985][T26041] [ 800.508160][T26053] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5431'. [ 800.868959][T26065] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5431'. [ 800.948874][T26065] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5431'. [ 801.090594][T26053] lo speed is unknown, defaulting to 1000 [ 801.170061][T26053] lo speed is unknown, defaulting to 1000 [ 801.288812][T26053] lo speed is unknown, defaulting to 1000 [ 801.362936][T26079] bridge0: entered allmulticast mode [ 801.383096][T26079] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5436'. [ 801.926309][T26102] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5441'. [ 801.980500][T26102] gretap1: entered promiscuous mode [ 802.089860][T26107] netlink: 'syz.2.5446': attribute type 10 has an invalid length. [ 802.125121][T26107] 8021q: adding VLAN 0 to HW filter on device team0 [ 802.134569][T26107] bond0: (slave team0): Enslaving as an active interface with an up link [ 802.419405][T26117] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5448'. [ 803.049387][T26135] sctp: [Deprecated]: syz.3.5452 (pid 26135) Use of int in max_burst socket option. [ 803.049387][T26135] Use struct sctp_assoc_value instead [ 803.082962][T26134] lo speed is unknown, defaulting to 1000 [ 803.093762][T26134] lo speed is unknown, defaulting to 1000 [ 803.126169][T26134] lo speed is unknown, defaulting to 1000 [ 803.264543][T26142] lo speed is unknown, defaulting to 1000 [ 803.301250][T26142] lo speed is unknown, defaulting to 1000 [ 803.593889][T26148] veth1_to_bond: entered allmulticast mode [ 803.609387][T26148] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5457'. [ 803.614608][T26142] lo speed is unknown, defaulting to 1000 [ 803.703949][T26148] bond0: (slave bond_slave_1): Releasing backup interface [ 803.906121][T26148] veth1_to_bond (unregistering): left allmulticast mode [ 804.508634][T26163] lo speed is unknown, defaulting to 1000 [ 804.625045][T26166] lo speed is unknown, defaulting to 1000 [ 804.652982][T26163] lo speed is unknown, defaulting to 1000 [ 804.695721][T26163] lo speed is unknown, defaulting to 1000 [ 805.217296][T26166] lo speed is unknown, defaulting to 1000 [ 805.257921][T26166] lo speed is unknown, defaulting to 1000 [ 805.936251][T26194] netlink: 'syz.2.5469': attribute type 3 has an invalid length. [ 805.963432][T26194] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5469'. [ 806.470127][T26208] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5473'. [ 806.788447][T26209] netlink: 'syz.0.5472': attribute type 1 has an invalid length. [ 807.034814][T26229] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.5477'. [ 807.076417][T26229] netlink: 5 bytes leftover after parsing attributes in process `syz.3.5477'. [ 807.182200][T26236] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5479'. [ 808.213514][T26269] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5488'. [ 808.344243][T26272] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 808.390001][T26269] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5488'. [ 808.468129][T26267] lo speed is unknown, defaulting to 1000 [ 808.488436][T26267] lo speed is unknown, defaulting to 1000 [ 808.511234][T26267] lo speed is unknown, defaulting to 1000 [ 808.549927][T26280] netlink: 5636 bytes leftover after parsing attributes in process `syz.0.5491'. [ 808.688442][T26280] lo speed is unknown, defaulting to 1000 [ 808.696195][T26280] lo speed is unknown, defaulting to 1000 [ 809.127555][T26280] lo speed is unknown, defaulting to 1000 [ 809.583432][T26296] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5497'. [ 809.637075][T26296] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5497'. [ 809.898152][T26301] netlink: 1 bytes leftover after parsing attributes in process `syz.1.5497'. [ 810.099333][T26308] syzkaller1: entered promiscuous mode [ 810.104863][T26308] syzkaller1: entered allmulticast mode [ 811.945701][T26362] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5511'. [ 811.997965][T26367] netlink: 'syz.1.5511': attribute type 1 has an invalid length. [ 812.192240][T26367] smc: adding net device bond0 with user defined pnetid SYZ2 [ 812.311041][T26362] bond0: (slave bridge0): making interface the new active one [ 812.341724][T26362] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 812.621635][T26378] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5515'. [ 812.959859][T26388] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5518'. [ 813.024957][T26391] lo speed is unknown, defaulting to 1000 [ 813.062598][T26391] lo speed is unknown, defaulting to 1000 [ 813.099196][T26391] lo speed is unknown, defaulting to 1000 [ 813.534298][T26398] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 813.770250][T26396] lo speed is unknown, defaulting to 1000 [ 813.790712][T26396] lo speed is unknown, defaulting to 1000 [ 813.818033][T26396] lo speed is unknown, defaulting to 1000 [ 814.243695][T26409] netlink: 'syz.4.5525': attribute type 1 has an invalid length. [ 814.362214][T26409] 8021q: adding VLAN 0 to HW filter on device bond8 [ 814.478385][T26416] netlink: 'syz.1.5527': attribute type 13 has an invalid length. [ 814.517278][T26416] netlink: 'syz.1.5527': attribute type 17 has an invalid length. [ 814.545200][T26414] lo speed is unknown, defaulting to 1000 [ 814.621952][T26418] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5528'. [ 814.684435][T26420] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5527'. [ 814.880024][T26423] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 814.904700][T26416] 8021q: adding VLAN 0 to HW filter on device team0 [ 815.086489][T26432] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5530'. [ 815.771780][T26451] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5535'. [ 815.824670][T26416] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 815.844589][ T5975] lo speed is unknown, defaulting to 1000 [ 815.850474][ T5975] syz0: Port: 1 Link ACTIVE [ 815.853675][T26414] lo speed is unknown, defaulting to 1000 [ 815.860497][T17125] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 815.887173][ T9] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 815.922448][T26451] (unnamed net_device) (uninitialized): option lacp_rate: invalid value (59) [ 815.934056][ T7163] lo speed is unknown, defaulting to 1000 [ 815.940506][T26414] lo speed is unknown, defaulting to 1000 [ 815.987940][T17156] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 816.077352][ T5975] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 816.216268][T26465] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 816.314088][T26463] lo speed is unknown, defaulting to 1000 [ 816.322289][T26463] lo speed is unknown, defaulting to 1000 [ 816.635732][T26463] lo speed is unknown, defaulting to 1000 [ 816.920801][T26477] lo speed is unknown, defaulting to 1000 [ 816.943982][T26477] lo speed is unknown, defaulting to 1000 [ 816.963326][T26477] lo speed is unknown, defaulting to 1000 [ 817.033494][T17149] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 817.047835][T17149] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 817.516185][ T5975] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 817.809024][T26492] lo speed is unknown, defaulting to 1000 [ 817.906020][T26492] lo speed is unknown, defaulting to 1000 [ 818.038436][T26492] lo speed is unknown, defaulting to 1000 [ 818.083521][T26504] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5550'. [ 818.632935][T26512] lo speed is unknown, defaulting to 1000 [ 818.668497][T26512] lo speed is unknown, defaulting to 1000 [ 818.720322][T26512] lo speed is unknown, defaulting to 1000 [ 818.767093][T26516] tipc: Enabled bearer , priority 0 [ 818.775329][T26516] syzkaller0: entered promiscuous mode [ 818.797145][T26516] syzkaller0: entered allmulticast mode [ 818.856497][T26516] sch_tbf: burst 12 is lower than device syzkaller0 mtu (1514) ! [ 818.878497][T26516] tipc: Resetting bearer [ 818.885993][T26516] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5553'. [ 818.942842][T26516] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5553'. [ 818.943611][T26522] netlink: 'syz.3.5553': attribute type 10 has an invalid length. [ 819.000960][T26522] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5553'. [ 819.054150][T26515] tipc: Resetting bearer [ 819.141945][T26515] tipc: Disabling bearer [ 819.340881][T26535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 819.408477][T26536] netlink: 'syz.4.5559': attribute type 1 has an invalid length. [ 819.417083][T26534] netlink: 'syz.4.5559': attribute type 1 has an invalid length. [ 819.424823][T26534] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5559'. [ 819.448533][T26536] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5559'. [ 819.454517][T26532] lo speed is unknown, defaulting to 1000 [ 819.550135][T26532] lo speed is unknown, defaulting to 1000 [ 819.640840][T26532] lo speed is unknown, defaulting to 1000 [ 820.077008][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 820.304661][T26548] lo speed is unknown, defaulting to 1000 [ 820.320187][T26551] __nla_validate_parse: 1 callbacks suppressed [ 820.320210][T26551] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5563'. [ 820.349656][T26548] lo speed is unknown, defaulting to 1000 [ 820.564748][T26552] veth7: entered promiscuous mode [ 820.625143][T26548] lo speed is unknown, defaulting to 1000 [ 820.957961][T26564] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5565'. [ 820.980780][T26561] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5566'. [ 821.001744][T26564] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5565'. [ 821.210071][T26567] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5568'. [ 821.349039][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 821.474088][T26586] netlink: 'syz.3.5570': attribute type 1 has an invalid length. [ 821.593492][T26587] sctp: [Deprecated]: syz.0.5572 (pid 26587) Use of int in max_burst socket option deprecated. [ 821.593492][T26587] Use struct sctp_assoc_value instead [ 821.753433][T26591] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5573'. [ 822.389718][T26609] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5578'. [ 822.447018][T26607] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5578'. [ 822.663973][T26597] macvlan1: entered promiscuous mode [ 822.696301][T26597] ipvlan0: entered promiscuous mode [ 822.713929][T26597] ipvlan0: left promiscuous mode [ 822.731887][T26597] macvlan1: left promiscuous mode [ 822.871953][T26626] tipc: Enabling of bearer rejected, failed to enable media [ 822.978714][T26630] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5585'. [ 823.065791][T26634] netlink: 'syz.0.5584': attribute type 4 has an invalid length. [ 823.082739][T26633] netlink: 'syz.0.5584': attribute type 4 has an invalid length. [ 823.144792][T26636] vlan1: entered allmulticast mode [ 823.164122][T26642] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5587'. [ 823.173634][T26636] bond9: entered allmulticast mode [ 823.220030][T26642] syzkaller1: entered promiscuous mode [ 823.225679][T26642] syzkaller1: entered allmulticast mode [ 823.314981][T26639] lo speed is unknown, defaulting to 1000 [ 823.353849][T26649] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 823.490585][T26646] lo speed is unknown, defaulting to 1000 [ 823.496422][T26639] lo speed is unknown, defaulting to 1000 [ 823.522062][T26646] lo speed is unknown, defaulting to 1000 [ 823.529319][T26639] lo speed is unknown, defaulting to 1000 [ 823.931700][T26662] netlink: zone id is out of range [ 823.937367][T26662] netlink: zone id is out of range [ 823.943279][T26662] netlink: zone id is out of range [ 823.951294][T26662] netlink: zone id is out of range [ 823.957056][T26662] netlink: zone id is out of range [ 823.964816][T26662] netlink: zone id is out of range [ 823.998180][T26662] netlink: zone id is out of range [ 824.003838][T26662] netlink: zone id is out of range [ 824.018989][T26662] netlink: zone id is out of range [ 824.034501][T26662] netlink: zone id is out of range [ 824.144140][T26668] lo speed is unknown, defaulting to 1000 [ 824.169716][T26668] lo speed is unknown, defaulting to 1000 [ 824.207614][T26671] netlink: 'syz.2.5595': attribute type 2 has an invalid length. [ 824.255640][T26673] netlink: 'syz.3.5596': attribute type 10 has an invalid length. [ 824.330177][T26646] lo speed is unknown, defaulting to 1000 [ 825.046131][T26681] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input7 [ 825.175264][T26668] lo speed is unknown, defaulting to 1000 [ 825.709296][T26699] __nla_validate_parse: 2 callbacks suppressed [ 825.709325][T26699] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5602'. [ 825.753778][T26699] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5602'. [ 825.794555][T26699] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5602'. [ 825.888947][T26689] siw: device registration error -23 [ 826.124031][T26718] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5607'. [ 826.323146][T26727] netlink: 1192 bytes leftover after parsing attributes in process `syz.1.5609'. [ 826.348870][T26727] netlink: 'syz.1.5609': attribute type 5 has an invalid length. [ 826.370799][T26732] sctp: [Deprecated]: syz.3.5610 (pid 26732) Use of int in max_burst socket option. [ 826.370799][T26732] Use struct sctp_assoc_value instead [ 826.682263][T26740] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5612'. [ 826.745407][T26741] netlink: 'syz.1.5611': attribute type 13 has an invalid length. [ 826.750941][T26738] lo speed is unknown, defaulting to 1000 [ 826.784658][T26741] netlink: 'syz.1.5611': attribute type 17 has an invalid length. [ 826.877321][T26738] lo speed is unknown, defaulting to 1000 [ 826.900409][T26738] lo speed is unknown, defaulting to 1000 [ 827.185751][T26750] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5614'. [ 827.208886][T26750] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5614'. [ 827.289751][T26752] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5614'. [ 827.818391][T26767] netlink: 'syz.0.5619': attribute type 1 has an invalid length. [ 827.867507][T26769] netlink: 'syz.3.5620': attribute type 1 has an invalid length. [ 827.870257][T26757] vlan1: entered promiscuous mode [ 827.882322][T26757] bond0: entered promiscuous mode [ 827.891689][T26757] vlan1: entered allmulticast mode [ 827.913179][T26767] bridge_slave_0: left allmulticast mode [ 827.922794][T26767] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 827.999513][T26767] ipvlan2: left promiscuous mode [ 828.085395][T26769] syz.3.5620: vmalloc error: size 33558528, failed to allocated page array size 65544, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 828.138215][T26769] CPU: 0 UID: 0 PID: 26769 Comm: syz.3.5620 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 828.138247][T26769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 828.138258][T26769] Call Trace: [ 828.138267][T26769] [ 828.138275][T26769] dump_stack_lvl+0x189/0x250 [ 828.138305][T26769] ? __pfx_dump_stack_lvl+0x10/0x10 [ 828.138322][T26769] ? __pfx__printk+0x10/0x10 [ 828.138343][T26769] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 828.138364][T26769] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 828.138385][T26769] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 828.138407][T26769] warn_alloc+0x214/0x310 [ 828.138434][T26769] ? __pfx_warn_alloc+0x10/0x10 [ 828.138462][T26769] ? __get_vm_area_node+0x28f/0x300 [ 828.138489][T26769] ? xskq_create+0xbf/0x170 [ 828.138520][T26769] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 828.138569][T26769] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 828.138592][T26769] ? __kasan_kmalloc+0x93/0xb0 [ 828.138622][T26769] vmalloc_user_noprof+0xad/0xf0 [ 828.138642][T26769] ? xskq_create+0xbf/0x170 [ 828.138665][T26769] xskq_create+0xbf/0x170 [ 828.138689][T26769] xsk_init_queue+0xb0/0x110 [ 828.138724][T26769] xsk_setsockopt+0x57b/0x8d0 [ 828.138750][T26769] ? __pfx_xsk_setsockopt+0x10/0x10 [ 828.138770][T26769] ? __pfx_aa_sk_perm+0x10/0x10 [ 828.138796][T26769] ? __fget_files+0x2a/0x420 [ 828.138814][T26769] ? aa_sock_opt_perm+0x74/0x110 [ 828.138838][T26769] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 828.138857][T26769] ? __pfx_xsk_setsockopt+0x10/0x10 [ 828.138881][T26769] do_sock_setsockopt+0x17c/0x1b0 [ 828.138910][T26769] __x64_sys_setsockopt+0x13f/0x1b0 [ 828.138934][T26769] do_syscall_64+0xfa/0x3b0 [ 828.138964][T26769] ? lockdep_hardirqs_on+0x9c/0x150 [ 828.138987][T26769] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.139006][T26769] ? clear_bhb_loop+0x60/0xb0 [ 828.139029][T26769] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.139045][T26769] RIP: 0033:0x7f863a18eb69 [ 828.139064][T26769] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 828.139081][T26769] RSP: 002b:00007f863b037038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 828.139105][T26769] RAX: ffffffffffffffda RBX: 00007f863a3b5fa0 RCX: 00007f863a18eb69 [ 828.139119][T26769] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000008 [ 828.139131][T26769] RBP: 00007f863a211df1 R08: 0000000000000004 R09: 0000000000000000 [ 828.139143][T26769] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 828.139155][T26769] R13: 0000000000000000 R14: 00007f863a3b5fa0 R15: 00007ffdd4b2a0e8 [ 828.139185][T26769] [ 828.139328][T26769] Mem-Info: [ 828.429798][T26769] active_anon:4519 inactive_anon:0 isolated_anon:0 [ 828.429798][T26769] active_file:8466 inactive_file:40130 isolated_file:0 [ 828.429798][T26769] unevictable:768 dirty:178 writeback:75 [ 828.429798][T26769] slab_reclaimable:14367 slab_unreclaimable:241030 [ 828.429798][T26769] mapped:29932 shmem:1383 pagetables:1000 [ 828.429798][T26769] sec_pagetables:0 bounce:0 [ 828.429798][T26769] kernel_misc_reclaimable:0 [ 828.429798][T26769] free:1169106 free_pcp:12826 free_cma:0 [ 828.485240][T26769] Node 0 active_anon:18076kB inactive_anon:0kB active_file:33864kB inactive_file:160316kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:119728kB dirty:708kB writeback:0kB shmem:3996kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:15344kB pagetables:3852kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 828.521161][T26767] gretap1: left promiscuous mode [ 828.522343][T26769] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 828.559479][T26769] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 828.590754][T26769] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 828.596576][T26769] Node 0 DMA32 free:750116kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:18028kB inactive_anon:0kB active_file:33864kB inactive_file:158488kB unevictable:1536kB writepending:808kB present:3129332kB managed:2560292kB mlocked:0kB bounce:0kB free_pcp:41420kB local_pcp:20528kB free_cma:0kB [ 828.605245][ T59] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 828.654818][T26769] lowmem_reserve[]: 0 0 1 1 1 [ 828.661231][ T59] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 828.670359][T26769] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 828.701117][T26769] lowmem_reserve[]: 0 0 0 0 0 [ 828.705970][T26769] Node 1 Normal free:3910804kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:9848kB local_pcp:3864kB free_cma:0kB [ 828.784536][ T59] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 828.793938][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 828.832724][ T8690] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 828.863340][T26769] lowmem_reserve[]: 0 0 0 0 0 [ 828.870266][T26787] netlink: 'syz.0.5623': attribute type 10 has an invalid length. [ 828.906903][T26769] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 828.930085][T26769] Node 0 DMA32: 1177*4kB (ME) 566*8kB (M) 437*16kB (UME) 1550*32kB (UME) 338*64kB (UM) 36*128kB (UM) 13*256kB (UM) 5*512kB (UM) 9*1024kB (U) 4*2048kB (UME) 155*4096kB (M) = 750244kB [ 828.959372][T26769] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 828.983374][T26769] Node 1 Normal: 121*4kB (UME) 52*8kB (UME) 39*16kB (UME) 229*32kB (UME) 86*64kB (UME) 15*128kB (UME) 3*256kB (ME) 3*512kB (ME) 1*1024kB (M) 2*2048kB (UE) 949*4096kB (M) = 3910804kB [ 828.998198][T26790] lo speed is unknown, defaulting to 1000 [ 829.022632][T26769] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 829.042996][T26769] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 829.062491][T26769] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 829.069362][T26790] lo speed is unknown, defaulting to 1000 [ 829.092716][T26769] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 829.115994][T26769] 50001 total pagecache pages [ 829.133251][T26769] 0 pages in swap cache [ 829.139540][T26790] lo speed is unknown, defaulting to 1000 [ 829.144216][T26769] Free swap = 124996kB [ 829.162453][T26769] Total swap = 124996kB [ 829.181715][T26769] 2097051 pages RAM [ 829.195314][T26769] 0 pages HighMem/MovableOnly [ 829.210468][T26769] 424872 pages reserved [ 829.228482][T26769] 0 pages cma reserved [ 829.667526][T26814] netlink: 96 bytes leftover after parsing attributes in process `syz.3.5630'. [ 829.727673][T26805] siw: device registration error -23 [ 829.731220][T26814] vlan3: entered allmulticast mode [ 829.740698][T26814] gretap0: entered allmulticast mode [ 830.051629][T26825] netem: change failed [ 830.100275][T26831] netlink: 'syz.1.5635': attribute type 9 has an invalid length. [ 830.706986][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 831.704967][T26877] __nla_validate_parse: 34 callbacks suppressed [ 831.704991][T26877] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5645'. [ 833.395625][T26855] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 833.416291][T26855] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 833.436026][T26856] tipc: Enabled bearer , priority 0 [ 833.486367][T26857] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 833.509581][T26857] team0: Port device batadv2 added [ 833.529919][T26858] syzkaller0: entered promiscuous mode [ 833.541270][T26858] syzkaller0: entered allmulticast mode [ 833.569927][T26871] tipc: Resetting bearer [ 833.603045][T26888] netlink: 'syz.0.5648': attribute type 21 has an invalid length. [ 833.614950][T26853] tipc: Resetting bearer [ 833.747831][T26853] tipc: Disabling bearer [ 833.776356][T26855] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 833.781656][T26885] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5647'. [ 833.790200][T26855] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 833.959654][T26855] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 833.987639][T26855] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.396266][T26855] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.449909][T26855] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.474615][T17156] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 835.492425][T17156] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 835.529257][ T8683] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 835.543361][ T8683] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 835.663269][T17156] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 835.685188][T17156] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 835.716556][T26855] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 835.730772][T26855] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.800601][T17156] ================================================================== [ 835.808702][T17156] BUG: KASAN: slab-use-after-free in __mutex_lock+0x147/0x1340 [ 835.816288][T17156] Read of size 8 at addr ffff88807a5c8ab0 by task kworker/u8:38/17156 [ 835.824465][T17156] [ 835.826813][T17156] CPU: 1 UID: 0 PID: 17156 Comm: kworker/u8:38 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 835.826841][T17156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 835.826856][T17156] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 835.826905][T17156] Call Trace: [ 835.826915][T17156] [ 835.826924][T17156] dump_stack_lvl+0x189/0x250 [ 835.826948][T17156] ? __kasan_check_byte+0x12/0x40 [ 835.826976][T17156] ? __pfx_dump_stack_lvl+0x10/0x10 [ 835.826994][T17156] ? lock_release+0x4b/0x3e0 [ 835.827020][T17156] ? __virt_addr_valid+0x4a5/0x5c0 [ 835.827044][T17156] print_report+0xca/0x240 [ 835.827067][T17156] ? __mutex_lock+0x147/0x1340 [ 835.827091][T17156] kasan_report+0x118/0x150 [ 835.827113][T17156] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 835.827135][T17156] ? __mutex_lock+0x147/0x1340 [ 835.827162][T17156] __mutex_lock+0x147/0x1340 [ 835.827187][T17156] ? __mutex_lock+0x5b6/0x1340 [ 835.827212][T17156] ? udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 835.827237][T17156] ? __pfx___mutex_lock+0x10/0x10 [ 835.827262][T17156] ? __lock_acquire+0xab9/0xd20 [ 835.827290][T17156] udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 835.827316][T17156] ? process_scheduled_works+0x9ef/0x17b0 [ 835.827340][T17156] ? process_scheduled_works+0x9ef/0x17b0 [ 835.827364][T17156] process_scheduled_works+0xae1/0x17b0 [ 835.827401][T17156] ? __pfx_process_scheduled_works+0x10/0x10 [ 835.827432][T17156] worker_thread+0x8a0/0xda0 [ 835.827469][T17156] kthread+0x70e/0x8a0 [ 835.827490][T17156] ? __pfx_worker_thread+0x10/0x10 [ 835.827513][T17156] ? __pfx_kthread+0x10/0x10 [ 835.827532][T17156] ? _raw_spin_unlock_irq+0x23/0x50 [ 835.827552][T17156] ? lockdep_hardirqs_on+0x9c/0x150 [ 835.827573][T17156] ? __pfx_kthread+0x10/0x10 [ 835.827591][T17156] ret_from_fork+0x3fc/0x770 [ 835.827620][T17156] ? __pfx_ret_from_fork+0x10/0x10 [ 835.827646][T17156] ? __switch_to_asm+0x39/0x70 [ 835.827664][T17156] ? __switch_to_asm+0x33/0x70 [ 835.827680][T17156] ? __pfx_kthread+0x10/0x10 [ 835.827699][T17156] ret_from_fork_asm+0x1a/0x30 [ 835.827725][T17156] [ 835.827733][T17156] [ 836.033509][T17156] Allocated by task 26855: [ 836.037936][T17156] kasan_save_track+0x3e/0x80 [ 836.042618][T17156] __kasan_kmalloc+0x93/0xb0 [ 836.047204][T17156] __kmalloc_noprof+0x27a/0x4f0 [ 836.052046][T17156] udp_tunnel_nic_netdevice_event+0x854/0x19f0 [ 836.058196][T17156] notifier_call_chain+0x1b3/0x3e0 [ 836.063305][T17156] register_netdevice+0x1608/0x1ae0 [ 836.068491][T17156] nsim_create+0xae8/0xf10 [ 836.072924][T17156] __nsim_dev_port_add+0x6b6/0xb10 [ 836.078051][T17156] nsim_dev_port_add_all+0x37/0xf0 [ 836.083176][T17156] nsim_dev_reload_up+0x451/0x780 [ 836.088203][T17156] devlink_reload+0x4e9/0x8d0 [ 836.092867][T17156] devlink_nl_reload_doit+0xb35/0xd50 [ 836.098226][T17156] genl_family_rcv_msg_doit+0x215/0x300 [ 836.103757][T17156] genl_rcv_msg+0x60e/0x790 [ 836.108244][T17156] netlink_rcv_skb+0x205/0x470 [ 836.112999][T17156] genl_rcv+0x28/0x40 [ 836.116962][T17156] netlink_unicast+0x82c/0x9e0 [ 836.121712][T17156] netlink_sendmsg+0x805/0xb30 [ 836.126461][T17156] __sock_sendmsg+0x219/0x270 [ 836.131122][T17156] ____sys_sendmsg+0x505/0x830 [ 836.135870][T17156] ___sys_sendmsg+0x21f/0x2a0 [ 836.140533][T17156] __x64_sys_sendmsg+0x19b/0x260 [ 836.145466][T17156] do_syscall_64+0xfa/0x3b0 [ 836.150002][T17156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.155914][T17156] [ 836.158229][T17156] Freed by task 26855: [ 836.162289][T17156] kasan_save_track+0x3e/0x80 [ 836.166971][T17156] kasan_save_free_info+0x46/0x50 [ 836.172024][T17156] __kasan_slab_free+0x62/0x70 [ 836.176778][T17156] kfree+0x18e/0x440 [ 836.180665][T17156] udp_tunnel_nic_netdevice_event+0x1332/0x19f0 [ 836.186895][T17156] notifier_call_chain+0x1b3/0x3e0 [ 836.191990][T17156] unregister_netdevice_many_notify+0x14d7/0x1ff0 [ 836.198431][T17156] unregister_netdevice_queue+0x33c/0x380 [ 836.204154][T17156] nsim_destroy+0x1dd/0x670 [ 836.208669][T17156] __nsim_dev_port_del+0x14d/0x1b0 [ 836.213788][T17156] nsim_dev_port_add_all+0xae/0xf0 [ 836.218891][T17156] nsim_dev_reload_up+0x451/0x780 [ 836.223973][T17156] devlink_reload+0x4e9/0x8d0 [ 836.228660][T17156] devlink_nl_reload_doit+0xb35/0xd50 [ 836.234035][T17156] genl_family_rcv_msg_doit+0x215/0x300 [ 836.239580][T17156] genl_rcv_msg+0x60e/0x790 [ 836.244072][T17156] netlink_rcv_skb+0x205/0x470 [ 836.248830][T17156] genl_rcv+0x28/0x40 [ 836.252806][T17156] netlink_unicast+0x82c/0x9e0 [ 836.257558][T17156] netlink_sendmsg+0x805/0xb30 [ 836.262312][T17156] __sock_sendmsg+0x219/0x270 [ 836.266977][T17156] ____sys_sendmsg+0x505/0x830 [ 836.271722][T17156] ___sys_sendmsg+0x21f/0x2a0 [ 836.276378][T17156] __x64_sys_sendmsg+0x19b/0x260 [ 836.281296][T17156] do_syscall_64+0xfa/0x3b0 [ 836.285887][T17156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.291786][T17156] [ 836.294094][T17156] Last potentially related work creation: [ 836.299792][T17156] kasan_save_stack+0x3e/0x60 [ 836.304457][T17156] kasan_record_aux_stack+0xbd/0xd0 [ 836.309641][T17156] insert_work+0x3d/0x330 [ 836.313959][T17156] __queue_work+0xbd9/0xfe0 [ 836.318442][T17156] queue_work_on+0x181/0x270 [ 836.323018][T17156] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 836.328638][T17156] udp_tunnel_push_rx_port+0x180/0x200 [ 836.334080][T17156] geneve_offload_rx_ports+0xd7/0x160 [ 836.339446][T17156] geneve_netdevice_event+0x6a/0x80 [ 836.344626][T17156] notifier_call_chain+0x1b3/0x3e0 [ 836.349717][T17156] call_netdevice_notifiers+0x88/0xc0 [ 836.355076][T17156] udp_tunnel_nic_netdevice_event+0x134d/0x19f0 [ 836.361310][T17156] notifier_call_chain+0x1b3/0x3e0 [ 836.366402][T17156] register_netdevice+0x1608/0x1ae0 [ 836.371590][T17156] nsim_create+0xae8/0xf10 [ 836.375993][T17156] __nsim_dev_port_add+0x6b6/0xb10 [ 836.381091][T17156] nsim_dev_port_add_all+0x37/0xf0 [ 836.386197][T17156] nsim_dev_reload_up+0x451/0x780 [ 836.391206][T17156] devlink_reload+0x4e9/0x8d0 [ 836.395867][T17156] devlink_nl_reload_doit+0xb35/0xd50 [ 836.401220][T17156] genl_family_rcv_msg_doit+0x215/0x300 [ 836.406749][T17156] genl_rcv_msg+0x60e/0x790 [ 836.411241][T17156] netlink_rcv_skb+0x205/0x470 [ 836.415993][T17156] genl_rcv+0x28/0x40 [ 836.419956][T17156] netlink_unicast+0x82c/0x9e0 [ 836.424718][T17156] netlink_sendmsg+0x805/0xb30 [ 836.429496][T17156] __sock_sendmsg+0x219/0x270 [ 836.434167][T17156] ____sys_sendmsg+0x505/0x830 [ 836.438919][T17156] ___sys_sendmsg+0x21f/0x2a0 [ 836.443580][T17156] __x64_sys_sendmsg+0x19b/0x260 [ 836.448498][T17156] do_syscall_64+0xfa/0x3b0 [ 836.452990][T17156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.458868][T17156] [ 836.461175][T17156] Second to last potentially related work creation: [ 836.467739][T17156] kasan_save_stack+0x3e/0x60 [ 836.472408][T17156] kasan_record_aux_stack+0xbd/0xd0 [ 836.477593][T17156] insert_work+0x3d/0x330 [ 836.481924][T17156] __queue_work+0xcfc/0xfe0 [ 836.486408][T17156] queue_work_on+0x181/0x270 [ 836.490995][T17156] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 836.496659][T17156] udp_tunnel_push_rx_port+0x180/0x200 [ 836.502111][T17156] vxlan_offload_rx_ports+0x139/0x200 [ 836.507508][T17156] vxlan_netdevice_event+0x111/0x470 [ 836.512969][T17156] notifier_call_chain+0x1b3/0x3e0 [ 836.518065][T17156] call_netdevice_notifiers+0x88/0xc0 [ 836.523433][T17156] udp_tunnel_nic_netdevice_event+0x134d/0x19f0 [ 836.529670][T17156] notifier_call_chain+0x1b3/0x3e0 [ 836.534762][T17156] register_netdevice+0x1608/0x1ae0 [ 836.539946][T17156] nsim_create+0xae8/0xf10 [ 836.544346][T17156] __nsim_dev_port_add+0x6b6/0xb10 [ 836.549442][T17156] nsim_dev_port_add_all+0x37/0xf0 [ 836.554538][T17156] nsim_dev_reload_up+0x451/0x780 [ 836.559559][T17156] devlink_reload+0x4e9/0x8d0 [ 836.564223][T17156] devlink_nl_reload_doit+0xb35/0xd50 [ 836.569576][T17156] genl_family_rcv_msg_doit+0x215/0x300 [ 836.575106][T17156] genl_rcv_msg+0x60e/0x790 [ 836.579589][T17156] netlink_rcv_skb+0x205/0x470 [ 836.584338][T17156] genl_rcv+0x28/0x40 [ 836.588303][T17156] netlink_unicast+0x82c/0x9e0 [ 836.593050][T17156] netlink_sendmsg+0x805/0xb30 [ 836.597803][T17156] __sock_sendmsg+0x219/0x270 [ 836.602468][T17156] ____sys_sendmsg+0x505/0x830 [ 836.607222][T17156] ___sys_sendmsg+0x21f/0x2a0 [ 836.611887][T17156] __x64_sys_sendmsg+0x19b/0x260 [ 836.616804][T17156] do_syscall_64+0xfa/0x3b0 [ 836.621297][T17156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.627173][T17156] [ 836.629483][T17156] The buggy address belongs to the object at ffff88807a5c8a00 [ 836.629483][T17156] which belongs to the cache kmalloc-256 of size 256 [ 836.643545][T17156] The buggy address is located 176 bytes inside of [ 836.643545][T17156] freed 256-byte region [ffff88807a5c8a00, ffff88807a5c8b00) [ 836.657410][T17156] [ 836.659718][T17156] The buggy address belongs to the physical page: [ 836.666136][T17156] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a5c8 [ 836.674892][T17156] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 836.683374][T17156] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 836.691336][T17156] page_type: f5(slab) [ 836.695303][T17156] raw: 00fff00000000040 ffff88801a441b40 ffffea0000c0da80 dead000000000005 [ 836.703871][T17156] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 836.712441][T17156] head: 00fff00000000040 ffff88801a441b40 ffffea0000c0da80 dead000000000005 [ 836.721096][T17156] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 836.729749][T17156] head: 00fff00000000001 ffffea0001e97201 00000000ffffffff 00000000ffffffff [ 836.738401][T17156] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 836.747084][T17156] page dumped because: kasan: bad access detected [ 836.753552][T17156] page_owner tracks the page as allocated [ 836.759256][T17156] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 19697, tgid 19693 (syz.4.3555), ts 580693028291, free_ts 570242956721 [ 836.780771][T17156] post_alloc_hook+0x240/0x2a0 [ 836.785538][T17156] get_page_from_freelist+0x21e4/0x22c0 [ 836.791071][T17156] __alloc_frozen_pages_noprof+0x181/0x370 [ 836.796858][T17156] alloc_pages_mpol+0x232/0x4a0 [ 836.801694][T17156] allocate_slab+0x8a/0x3b0 [ 836.806177][T17156] ___slab_alloc+0xbfc/0x1480 [ 836.810835][T17156] __kmalloc_noprof+0x305/0x4f0 [ 836.815677][T17156] iter_file_splice_write+0x1cb/0x1000 [ 836.821129][T17156] direct_splice_actor+0x101/0x160 [ 836.826226][T17156] splice_direct_to_actor+0x5a5/0xcc0 [ 836.831585][T17156] do_splice_direct+0x181/0x270 [ 836.836424][T17156] do_sendfile+0x4da/0x7e0 [ 836.840880][T17156] __se_sys_sendfile64+0x13e/0x190 [ 836.845974][T17156] do_syscall_64+0xfa/0x3b0 [ 836.850465][T17156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.856345][T17156] page last free pid 19333 tgid 19330 stack trace: [ 836.862823][T17156] __free_frozen_pages+0xc71/0xe70 [ 836.867916][T17156] __slab_free+0x326/0x400 [ 836.872316][T17156] qlist_free_all+0x97/0x140 [ 836.876915][T17156] kasan_quarantine_reduce+0x148/0x160 [ 836.882360][T17156] __kasan_kmalloc_large+0x1c/0xa0 [ 836.887459][T17156] ___kmalloc_large_node+0x15a/0x210 [ 836.892730][T17156] __kmalloc_large_node_noprof+0x18/0x90 [ 836.898349][T17156] __kvmalloc_node_noprof+0x6d/0x5f0 [ 836.903620][T17156] alloc_netdev_mqs+0xa3/0x1170 [ 836.908460][T17156] tun_set_iff+0x532/0xef0 [ 836.912866][T17156] __tun_chr_ioctl+0x788/0x1df0 [ 836.917700][T17156] __se_sys_ioctl+0xf9/0x170 [ 836.922276][T17156] do_syscall_64+0xfa/0x3b0 [ 836.926774][T17156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.932652][T17156] [ 836.934957][T17156] Memory state around the buggy address: [ 836.940578][T17156] ffff88807a5c8980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 836.948620][T17156] ffff88807a5c8a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 836.956663][T17156] >ffff88807a5c8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 836.964705][T17156] ^ [ 836.970313][T17156] ffff88807a5c8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 836.978368][T17156] ffff88807a5c8b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 836.986552][T17156] ================================================================== [ 837.069667][T17156] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 837.076924][T17156] CPU: 1 UID: 0 PID: 17156 Comm: kworker/u8:38 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 837.088915][T17156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 837.098986][T17156] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 837.106308][T17156] Call Trace: [ 837.109599][T17156] [ 837.112537][T17156] dump_stack_lvl+0x99/0x250 [ 837.117154][T17156] ? __asan_memcpy+0x40/0x70 [ 837.121853][T17156] ? __pfx_dump_stack_lvl+0x10/0x10 [ 837.127066][T17156] ? __pfx__printk+0x10/0x10 [ 837.131673][T17156] panic+0x2db/0x790 [ 837.135587][T17156] ? __pfx_panic+0x10/0x10 [ 837.140008][T17156] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 837.145909][T17156] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 837.152255][T17156] ? print_memory_metadata+0x314/0x400 [ 837.157733][T17156] ? __mutex_lock+0x147/0x1340 [ 837.162519][T17156] check_panic_on_warn+0x89/0xb0 [ 837.167468][T17156] ? __mutex_lock+0x147/0x1340 [ 837.172245][T17156] end_report+0x78/0x160 [ 837.176507][T17156] kasan_report+0x129/0x150 [ 837.181030][T17156] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 837.186927][T17156] ? __mutex_lock+0x147/0x1340 [ 837.191687][T17156] __mutex_lock+0x147/0x1340 [ 837.196285][T17156] ? __mutex_lock+0x5b6/0x1340 [ 837.201047][T17156] ? udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 837.207289][T17156] ? __pfx___mutex_lock+0x10/0x10 [ 837.212318][T17156] ? __lock_acquire+0xab9/0xd20 [ 837.217175][T17156] udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 837.223329][T17156] ? process_scheduled_works+0x9ef/0x17b0 [ 837.229043][T17156] ? process_scheduled_works+0x9ef/0x17b0 [ 837.234842][T17156] process_scheduled_works+0xae1/0x17b0 [ 837.240387][T17156] ? __pfx_process_scheduled_works+0x10/0x10 [ 837.246361][T17156] worker_thread+0x8a0/0xda0 [ 837.250954][T17156] kthread+0x70e/0x8a0 [ 837.255016][T17156] ? __pfx_worker_thread+0x10/0x10 [ 837.260120][T17156] ? __pfx_kthread+0x10/0x10 [ 837.264694][T17156] ? _raw_spin_unlock_irq+0x23/0x50 [ 837.269878][T17156] ? lockdep_hardirqs_on+0x9c/0x150 [ 837.275063][T17156] ? __pfx_kthread+0x10/0x10 [ 837.279636][T17156] ret_from_fork+0x3fc/0x770 [ 837.284219][T17156] ? __pfx_ret_from_fork+0x10/0x10 [ 837.289319][T17156] ? __switch_to_asm+0x39/0x70 [ 837.294068][T17156] ? __switch_to_asm+0x33/0x70 [ 837.298813][T17156] ? __pfx_kthread+0x10/0x10 [ 837.303389][T17156] ret_from_fork_asm+0x1a/0x30 [ 837.308143][T17156] [ 837.311599][T17156] Kernel Offset: disabled [ 837.315932][T17156] Rebooting in 86400 seconds..