last executing test programs: 3.563841088s ago: executing program 4 (id=6104): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x291c9}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x20000000000080}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x4004000) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x300, &(0x7f0000000200)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2c, 0x25dfdbfc, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vxcan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x810) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x35, 0x0, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, '\x00', 0x1b}}, 0x1c) recvmmsg(r1, &(0x7f0000008cc0)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001", @ANYRESDEC=r2], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)={0x40, 0xd, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY_END={0x4}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000011c0)={0x1c, 0xd, 0x6, 0x201, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8}]}, 0x1c}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.161858775s ago: executing program 0 (id=6110): ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) (async, rerun: 64) r4 = socket$l2tp6(0xa, 0x2, 0x73) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x3c, r3, 0x917, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r4}]}, 0x3c}, 0x1, 0x620b}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, r3, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x20008844) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000100000000000000a3031a303186d34f7ee3452d87030000001863000010000000000000000700000000000000000000007b220800ffb959cce9305167877f4523ab7b08de1affffff950000"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', r0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd6e, 0x0, 0x0, 0x10, 0x4}, 0x94) (rerun: 64) 2.969602442s ago: executing program 0 (id=6114): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f00000004c0)={'lo\x00', {0x2, 0x4e23, @loopback}}) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) connect$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, @any, 0x7}, 0xa) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$inet6(0xa, 0x2, 0xdf41) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000300)={0x0, 0x6, 0x1, [0x100, 0x3ff, 0x9, 0x80000000, 0x1], [0x2, 0x4, 0x7, 0xfc, 0xdc, 0x4, 0x0, 0x80000001, 0x6, 0x4, 0x4, 0x2, 0x7f, 0x2, 0x7, 0x200, 0x7, 0x800, 0x8, 0x4, 0x6, 0x1, 0xffffffff, 0x8001, 0x5, 0xcf9, 0xa, 0x5, 0x6, 0xeb5, 0x7, 0xffffffff, 0xd5, 0x8000000000000001, 0x7f, 0x5, 0x6, 0x1ff, 0x0, 0x2, 0x8, 0x8, 0x6, 0x0, 0x7, 0x2, 0xe, 0x7, 0x2, 0x2, 0x5, 0x1, 0x8001, 0xffff, 0xfffffffffffff6b4, 0x5, 0x7, 0xca4, 0x5, 0x5, 0x3, 0x2, 0x8000000000000001, 0x6, 0x4, 0x4, 0xd91, 0x9, 0xffffffffffffff33, 0xc8f, 0x7, 0x0, 0xffffffffffffffd9, 0x4, 0x7, 0x10000, 0xb, 0x3, 0x2, 0x7fffffffffffffff, 0x0, 0x9, 0x8, 0x5, 0x8, 0x9, 0x76, 0x9, 0x4, 0x1, 0xfc, 0x6, 0xe9, 0x7fffffffffffffff, 0x4, 0xa6a7, 0x3ff, 0x8, 0x5d, 0xfff, 0xfffffffffffffff7, 0x7, 0xfffffffffffffffe, 0x200, 0x10000, 0xac3, 0x7, 0xff, 0xfb, 0x0, 0x8001, 0x4, 0x8, 0x6, 0x2, 0x10000, 0x10000, 0x5, 0x9, 0x3cb, 0x8000000000000001]}) ioctl$BTRFS_IOC_DEV_REPLACE(r3, 0xca289435, &(0x7f0000000740)={0x3, 0x101, @start={r4, 0x0, "386df7a8eb1eddc2ed93da7b952f47efaa305b9a368d6137a8f418c00220154e00ba00d0a0e57da841ef8a4dc0137d30b2bf20322e5cc5b2e46dc8441038c9eb23216f7ef4b44f3844a0ca4ebcfbe25bb576c18c9174080f6bd2d41dd04006f9defaeadfd29b7f9ef4ac3d5b654bfe3e5a3e9ae8cd4a9ae5e18772936f5e4663f802cb4f58107f22ecbfc48212c499735927789d5da9a867b5b4d473ee68c627cb69529157d0c042fc66f4b315effeffb26dc548f872d7445eee5fde680cd4f8dc790c60f05a4f53dd5f6ee214e37d66b544e6385d8bd39aa350e9c75199511a99acd878ebe1a80df3ee734a08dedfd1dee9020b9b4c1ac06c94313c12b3a30edc1fa4408539dfb96cdaea3bfe77af8df46963087c843cfb10b154d751babd0ceaaff7dc42385b23b740de51a756eea07af475830f0e8c7aab59d0f9f300a9d5d50e8c7a80821e374f6521bbe6a7062f8fa11e5816e6d907561180bfa15bc52cd085c0a220dcc39d832bdc8b24bab116c406b7c6c3a1059fe601731911a86bbe9687eb656c49146ad4fbc0aeadbef873ff0ccffc5dd6f6e2ea911fccb805b8402ec2f5b9a6fe52d60185241eb6f0fda3896465bc8d724a21b544da444bddfd1c94ae1e8451fa6586eae293e75d269ef441981639971de7b0adb8c34e26d083a3b7cbae3ece2f2e09081c7d0500b08842f2580ab50a5845174ceb67dd101affc71802a48624d7b6af6ca94894cca5e47e360e97f3f266a718dc19935f051f637cd630d90ebe377d180396819c140f059151ae913de16f0eceebb87eb1ae34d5fac52e2e0b60d6b66d05bade252ab9ceba9cb32696c8a52b12b26bf087d578013e9c86490976f3a8c69a308d15efe94b705d2c1ff73081146b919cebdeab3908b2d0c4d657ab4049478f714e332d8ed81e7db6ba1ac232fbf8d89d3fd1e777a91c946f8bc3b1ad0e3b83b5dfdbc79b616db7ef4f872eaf0ebea9d6a3f45ebde9dc9e744338580c113fcef29f408f4a1b585a2e97eccfecdf460d5d760346a38996f70de86f49163fd470723bd613bf44ddcb30690be77796e4bddc8f6b6dc7d754ab44ea6185ca9b417e419f7dcd0e19b135de4a9df8fb1b159dcb87b0a1a09ec1f7426f874d42ba84784afba842838618c1bc69369a92d22169ec5dd336652a9e3e29267d1e8a7d02bd5e02878f8e06b4e4c739ca587a97230237f7f0d9cec8aada40f4abcfa75e97ec9da6eeff8505f6a7ff8fc58eb3eeb978ef07ded0adf6351f540862308ba4cbac6fed93349ada82a74647e66637bbf4a0606a4134d764ad2d09313b9ce0694a5ef9582578eea639bdb2c7a1a98ab5644d037581378dc731f378926f63f14c91e98561c7ae10d3aee2553a06d95dacf840410cb1e8fa08b1e046940435e357b441ce0c24c13f1789a3c609464540f929658f3ef4dbcb0072a0", "093a4d9869e1fa465c6b6a61b8110178d4d0ec50855885eb5bcb2aae6054629c975e8106f831b3e4d74095e0590e7c07a435f3673d3c992178c6263de36ffa3866c89bda3de7f15e83bea81cf748df31d563a1c9ee253c12a18f551fb6894e5da10e2903cc4acbc496bd4cfeb97133e71276c03ab080fdac0d6202dc27810e4efd0cccf14ffa8c1beed53e47e3b192ead13f5990832b219cc70a949fb0d551a8bd1ca5c1af7e8595fb0291016153a0fae0c7f21cb54e812e9e792d43bf07bc3e9452515095da19646b82fd255e136fc2f1775dde2dd5640d01b7c2a473b9ace54723a43c698f753a40c11985689a61563630dc2f51819ff49c6b5bacf92e8abaf3547c7cdf456b058f3d39b762ef4718bf17f8f76e0dd65903454709d5fc495a84e60fba4325991435762385ddf840328877a48f646e34f98861d78ced417ec61de40963d97812ace1bda3f16e4c7be2affdac59b7cd525f255a135361e2aa64fc71a4200a8da20921bb418bfd01264658bd24c7cf54fb6d65357f444129f9812acdfa3885ab283f2f937ac39890b8a8e0cf2d35deadcdc38118747d710a2eb0744e4117ee86b2b02acebf7867ea9fa9225440a8f8a66f5f63c3ad6c4156ff6fa13e5edfba5c3c80b4a470d5434fcc4bf1830cc93f9db9e91261b81c7a66759f4d96430a4e1b6898a7db396aebbb9f121d0218459cd4d0a911a56f468f9ad6fd37a07a3a29aaa717e242a4195fc1d03445a8b9c98054c6a393576f2c2ff55eab0a0ba9e27cd0d48469d7f42a5f100323b731de50fc4fd6810f3d2804cc72fc7516e02be65d7093f638a0ea7a53f788c307170e6ff3186ced77e13043b1585c841dfd95163bb214afca90bccc64635a7f35e8c229798f78fdd54c6aa1e0609dbea4dac41cf88239d3adfa15d852be309eb71d3537741fcda10556d15e3393c91e717ca96b1cd00c50812a346cc6503c041315182f3c2a99534080ed7502b54841b84c580cf3c46a061dafc267dd753e12e662790f60b7094ae3b6809756519dca57be755bc4ccb9a8bf51a99ccd0c5047dea726c7356fb730a33c7bea3f3c635d2fc3c4c7c42269ccaba3a6d0992f94b6c42abd3089aad94691108664201cff658696f84ea499b93226907ccd3f9eb8502268ead7b7e1ddd53b2c7c67e40bf64a465c6d48df718a174228c3919e2dc933a5f30f7c67fc642f62944ce4a9ddb27b188394edb45f1dfc2bb0989232f9701b9c16f40423110b17f5119a92c8aebddf6544a3054e12a4ad74f9d1479a209226354969288b2d7bc2348487021ad0844e82c0810eb087cbae5fa9473faaae76791b1dd660386f2f32ab957d964f71b53875b83622bddf34ba0f810bea7728fca1fedc132761ee31cf3b9cf30490d7f768dfe19affba88f739de5d7919280efa7e9985f45309928f3bc034ce1aa7fcbcc596"}, [0x2, 0x8f31, 0x7ff, 0x7fffffff, 0x9, 0x8000000000000001, 0x0, 0xb3, 0xc, 0x7, 0xfff, 0xfffffffffffffffc, 0x756, 0x5, 0x2, 0x5, 0x2, 0x6, 0x2, 0x6, 0x6, 0x1, 0x2, 0x8, 0x4732, 0x6, 0x9, 0x7, 0x4, 0x200, 0x0, 0x2de, 0x8, 0x9ef, 0x80, 0x1, 0xd, 0x9, 0x0, 0x12, 0x6, 0x5, 0x4, 0x8, 0x35c, 0x3, 0x10, 0xfffffffffffffffc, 0x8, 0x2, 0x70dc, 0x2f79, 0xf, 0xfffffffffffffffb, 0x8, 0x7, 0x7fffffff, 0xfffffffffffffc01, 0x9, 0x18, 0x1ff, 0x9, 0xffff, 0x8]}) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000003140f0028bd7000ffdbdf250900020073797a3100000000080041007369770014003300776c616e31000000000000000000000053b2cdd2a06b512005981618d17e8d7411de3cd6dbae2e9ccc83cb3b9c16dd96c2fd4e8549ae03a8b8ac1ead0ffa7ee3d4441aa0f42921"], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) r5 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x4, 0x80, 0x0, 0x0, 0x0, 0x4, 0x5, {0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffb, 0xfffffff9, 0x200, 0xfffffff8, 0x9}}, &(0x7f0000000180)=0xb0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f00000001c0)={r6, @in6={{0xa, 0x4e22, 0x92, @empty, 0x1}}}, 0x84) 2.838368365s ago: executing program 3 (id=6116): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) recvfrom$llc(r0, 0x0, 0x0, 0x12100, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f0000000100)="17000000020001000003d68c5ee1768812003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dbffffffffffffffff1f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e00000000000070000000051c9844dc9031379b67a885813c8c9", 0xb8) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f0000000200)={'broute\x00', 0x0, 0x3, 0x99, [0x7f, 0x4, 0xe9b, 0xf7, 0x8001, 0x4], 0x2, &(0x7f0000000040)=[{}, {}], &(0x7f0000000140)=""/153}, &(0x7f0000000280)=0x78) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61153c00000000006113340000000000bfa000000000000007000000ee0016055e0301000000000025050000030000006916b80000000000bf07000000000000260507000fff0720670600003f000000140600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2474ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7166c23d28c0a7101b8b09736ecd34aa9dc1b498"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) 2.803310718s ago: executing program 0 (id=6117): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61153c00000000006113340000000000bfa000000000000007000000ee0016055e0301000000000025050000030000006916b80000000000bf07000000000000260507000fff0720670600003f000000140600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2474ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7166c23d28c0a7101b8b09736ecd34aa9dc1b498"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1}, &(0x7f0000000040), &(0x7f0000000080)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r1, &(0x7f0000001240)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x12d, 0xb29, 0x14}, @ipv4=@udp={{0x6, 0x4, 0x3, 0x1b, 0x12e, 0x66, 0x0, 0x40, 0x11, 0x0, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x3a}, {[@timestamp={0x44, 0x4, 0x1b, 0x0, 0x6}]}}, {0x4e20, 0x4e21, 0x116, 0x0, @wg=@data={0x4, 0x202, 0x7, "e8771ac366586e56f446dcd22ec94c672f1cd650516a2fbeddd0cb5cffc4ef63a1c2be9551171e48bb8559ac9077c099289048d76df434e4ec536c04816b127eb525176f5737b934b37a9d109ea3aa64d0fb30013becb29f6a39d4cbdbc4e2540996ed75b90498301c99df853d4baac4654e6f1a06cf03a87aa2d2d74199bcafa0dc84a8ea112fba51687b8727bb905c7b42a0c9b26559b4ecc397c6a33731df0fca1aee35968435e8129f8e6d52a0754fcaa693706c4557af6be8821983e702fdd3dac90b6cbe00b1fe59f5bcd890dbb87c0d8d80ba8727e4ff6b89af3ecda43705a9dc113396c950947e85193eabe1364909509babcad37d21392d0714"}}}}, 0x13c) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0xc, 0xc, 0x3, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r3}, 0x38) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r3, &(0x7f0000000040), 0x0}, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x12c, 0x12c, 0x5, [@type_tag={0x2000008, 0x0, 0x0, 0x12, 0x5}, @enum64={0xf, 0x8, 0x0, 0x13, 0x0, 0x7, [{0x9, 0xffff, 0xe}, {0x9, 0xc000, 0xd}, {0xa, 0x60, 0x10}, {0xd, 0x400, 0x3}, {0xf, 0x93e4}, {0x9, 0x9, 0x5df}, {0x2, 0xa72, 0x5}, {0x9, 0x6}]}, @union={0xa, 0x2, 0x0, 0x5, 0x1, 0xff, [{0x9, 0x2, 0x5}, {0x1, 0x3, 0x5}]}, @enum64={0x2, 0x2, 0x0, 0x13, 0x0, 0x1, [{0x4, 0x1, 0x2}, {0x2, 0x6, 0x5}]}, @volatile={0x4, 0x0, 0x0, 0x9, 0x3}, @const={0x5, 0x0, 0x0, 0xa, 0x2}, @struct={0x2, 0x6, 0x0, 0x4, 0x0, 0x80000000, [{0x4, 0x5, 0x6}, {0xd, 0x2, 0x7f}, {0x3, 0x3, 0x4}, {0xd}, {0x11, 0x2, 0xb}, {0x9, 0x3, 0x5}]}]}, {0x0, [0x0, 0x30, 0x2e]}}, &(0x7f0000000480)=""/28, 0x149, 0x1c, 0x1, 0x1}, 0x28) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, 0x0, 0x20000000) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$F2FS_IOC_DEFRAGMENT(r6, 0xc010f508, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r6, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) shutdown(r6, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0), 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{}, 0x0, 0x0}, 0x20) 2.728912041s ago: executing program 3 (id=6118): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x40010) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010400000000000000000100000a74000000060a0b04000000000000000002000008400004803c000180080001006c6f670030000280060004400001000008000340fffffffa0a0002407d5def2e21000000080003400000000806000140000100000900010073797a30000000000900020073797a320000000008000b400000000314000000110001"], 0x9c}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000540)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) close(r0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)={0x74, r5, 0x1, 0x70bd26, 0x0, {}, [@WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e22, @loopback}}]}, {0x4}, {0x4}, {0x4}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x74}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'dummy0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r6, 0x89a2, &(0x7f0000000200)='bridge0\x00') sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x84, 0x30, 0xffff, 0x0, 0x0, {}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x2, 0x1, 0x6, 0x4, 0x8, {0x7, 0x0, 0x6, 0x80, 0x2}, {0x0, 0x2, 0x1, 0xc05, 0x77}, 0x2, 0x5, 0xffffffff}}]]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x84}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f0000000000)={0x3, 'veth1_to_batadv\x00', {0x9}, 0x7}) socket$nl_netfilter(0x10, 0x3, 0xc) 2.534064741s ago: executing program 4 (id=6119): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x408000}, 0xc, &(0x7f0000000880)={&(0x7f00000006c0)={0x1a4, r0, 0x600, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}]}, @TIPC_NLA_LINK={0x8c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe35}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x12e3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0xf4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x26, 0x3, "d043d6b467723190809b528cd28b73ec39d5a796eecaaf298d7687609dea729363b5"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "b72e27877705661a18b5683526cab103a4d3eb89538d3559"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}, @TIPC_NLA_NODE_KEY={0x3e, 0x4, {'gcm(aes)\x00', 0x16, "241876118ddaa98cfaeae85147a40445086557eacf76"}}, @TIPC_NLA_NODE_ID={0x38, 0x3, "a2d29ab39753afcd8e1e1dc0bfa84cc304e079320e46c5241f9f88c73a6e306f12afca9f0171765fc37f3fe438bc5073b8e92b2d"}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x4000414}, 0x40000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_INGRESS={0x8}, @TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004044}, 0x20040080) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) close(r5) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f00000004c0)=@xdp={0x2c, 0x0, r7, 0x18}, 0x80, &(0x7f00000003c0)=[{&(0x7f00000001c0)="27030200dc0f14000e0005000014c10200000001125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x3d, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0x11}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f0000000200)={r8}) 2.454647731s ago: executing program 1 (id=6120): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x40, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5}, {0x5, 0x3, 0x80}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x40}}, 0xc000) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2c0000001a000100000000000000cf0080202000000000000000000008000200ffffffff080001", @ANYRES8=r5, @ANYRESOCT=r2], 0x2c}, 0x1, 0x0, 0x0, 0x200008c0}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="4d7e00000000000000002a00000008002f000000000005003600000000000c0005000000000000000000060006000000000008000200", @ANYRES32=r7, @ANYBLOB="ce72ff6fc98f64dd2a638285b8"], 0x48}, 0x4, 0x700000000000000}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10400}, 0xc, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="200627bd7000fddbdf251d0000001c002f800c0002000201aaaaaaaaaaaa0c0002000201aaaaaaaaaaaa08000300", @ANYRES32=r7, @ANYBLOB="0c00060002000000020000000c326fd96510ed95fa01040000"], 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x800) r8 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000001bc0), 0x2, 0x0) r9 = socket$kcm(0x11, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c0000001000390426bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006a726964676500000400028008002500ffffffff"], 0x9a}}, 0x0) sendfile(r9, r8, &(0x7f0000000b80)=0x1349cdec, 0x80000001) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x89e2, &(0x7f0000000040)={r10}) setsockopt$XDP_UMEM_REG(r11, 0x11b, 0x4, &(0x7f0000000580)={&(0x7f0000000480)=""/247, 0x2000, 0x0, 0x6}, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x83, 0x83, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x4}, @const={0x0, 0x0, 0x0, 0x2, 0x3}, @datasec={0x4, 0x6, 0x0, 0xf, 0x3, [{0x3, 0x4, 0xd}, {0x2, 0x7c, 0x4}, {0x2, 0x5, 0x1ff}, {0x5, 0xb, 0xffffffff}, {0x2, 0x1, 0x9}, {0x3, 0x8, 0xfe}], "f1a8b9"}, @var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x61]}}, 0x0, 0xa0}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) 2.442779533s ago: executing program 0 (id=6121): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x20b7ee}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=@newlink={0x40, 0x10, 0x49920d862a92153b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GENEVE_COLLECT_METADATA={0x4}, @IFLA_GENEVE_TTL={0x5, 0x3, 0x6}]}}}]}, 0x40}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x13, r0, 0x7ca8e000) writev(r1, &(0x7f0000000080)=[{0x0}], 0x1) 2.371487901s ago: executing program 3 (id=6122): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000002240)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) r4 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_SEND_PRIO(r4, 0x6b, 0x20, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000015c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r5, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000100)=[@in={0x2, 0x0, @loopback}, @in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}], 0x2c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r5, 0x84, 0x65, &(0x7f0000000580)=[@in6={0xa, 0x0, 0x0, @private0}], 0x1c) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000004060104000000000000000000060000050001"], 0x1c}}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x4001, 0xfffffffe, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3d}, 0x1c) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) getsockname(r6, &(0x7f0000000080)=@qipcrtr, &(0x7f0000000100)=0xffffffffffffff03) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) bpf$ENABLE_STATS(0x20, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 1.795687413s ago: executing program 0 (id=6124): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') close(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0xb) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='('], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48241, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0xc020662a, &(0x7f0000000880)={0x2, 0x6, 0x0, 0x0, 0x2, 0x0, [{0x7fffffffffffffff, 0x1, 0xc2, '\x00', 0xc}, {0x1, 0x6, 0xfffffffeffffffff, '\x00', 0x4}]}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETCARRIER(r3, 0x400454e2, &(0x7f0000000100)=0x1) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'ip_vti0\x00', &(0x7f0000000180)={'ip_vti0\x00', 0x0, 0x47c0, 0xf8b0, 0x400, 0x10, {{0x11, 0x4, 0x0, 0x4, 0x44, 0x66, 0x0, 0x81, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@lsrr={0x83, 0x7, 0xa1, [@broadcast]}, @lsrr={0x83, 0x27, 0x3d, [@dev={0xac, 0x14, 0x14, 0x18}, @rand_addr=0x64010100, @multicast1, @private=0xa010101, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, @empty, @remote]}]}}}}}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x1e, 0x4, 0x48, 0x8, 0x11050, 0xffffffffffffffff, 0x7, '\x00', r4, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, @void, @value, @value=r1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x20, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000540)={'gre0\x00', &(0x7f00000004c0)={'erspan0\x00', r4, 0xe2b383b823720530, 0x700, 0x5, 0xd, {{0x15, 0x4, 0x0, 0x4, 0x54, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @multicast1, {[@cipso={0x86, 0x19, 0x1, [{0x7, 0x2}, {0x0, 0x11, "f48cf7c143032d8777e343e1b057a7"}]}, @end, @noop, @lsrr={0x83, 0xf, 0x40, [@private=0xa010102, @local, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}, @end, @generic={0x44, 0x10, "a3ff99118d2fd6cd06a55b866f8e"}]}}}}}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r6, 0x58, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x1a8, r7, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x4000080}, 0x80) 1.719336742s ago: executing program 1 (id=6126): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x5}) r1 = socket(0x10, 0x3, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB="000000000a000100aaaaaaaaaaaa000008000f0000000000"], 0x30}}, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454c9, 0x1) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) 1.718603688s ago: executing program 4 (id=6127): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x50, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x4}, @CTA_TUPLE_REPLY={0x62, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_IP={0x0, 0x1, 0x0, 0x1, @ipv6={{0x0, 0x3, @local}, {0x0, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x40000}, @CTA_SEQ_ADJ_ORIG={0xc, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x4}]}]}, 0x50}}, 0x8800) r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x54) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x2, 0xb, 0xe, 0x8, 0x6, 0x0, 0x70bd25, 0x25dfdbfe, [@sadb_lifetime={0x4, 0x3, 0x4, 0x5, 0xf, 0x10000000000001}]}, 0x30}}, 0x4000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100003800c"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 1.642326845s ago: executing program 2 (id=6128): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca9100000000000b5090100000000009500000000000000b509000002000000639a04fe00000000b509000000000000c39a04fee1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x10, 0xf, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0xa}, {{0x18, 0x1, 0x0}, {}, {}, {0x85, 0x0, 0x0, 0xa0}, {0x7, 0x0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x89}}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000001240)={'wg0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00', 0x0}) r9 = syz_genetlink_get_family_id$team(&(0x7f0000000180), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001700)={0x10c, r9, 0x1, 0x1, 0x25dfdc01, {}, [{{0x8, 0x1, r10}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x80000000}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}]}}]}, 0x10c}, 0x1, 0x400000000000000}, 0x40810) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000001280)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f00000012c0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000001380)={'syztnl2\x00', &(0x7f0000001300)={'ip6gre0\x00', 0x0, 0x11, 0x6, 0xe8, 0x0, 0x78, @private2={0xfc, 0x2, '\x00', 0x1}, @private1, 0x7800, 0x700, 0x3ad, 0x1}}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000013c0)={0x0, @loopback, @local}, &(0x7f0000001400)=0xc) getpeername$packet(0xffffffffffffffff, &(0x7f0000001440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001480)=0x14) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r5, &(0x7f00000016c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001680)={&(0x7f00000014c0)={0x1ac, 0x0, 0x10, 0x70bd2b, 0x25dfdbfc, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}]}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x4808}, 0x40000) r16 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000003040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000002c0)={0x30, r16, 0x1, 0x70bd2b, 0x25dfdbfb, {0x2, 0x0, 0x500}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r17}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000884) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r2, 0x4048587b, &(0x7f0000000dc0)={{r2, &(0x7f0000000400)='\x00', 0x8080, &(0x7f0000000440)={@align, {0x9, 0x8, 0x2, 0x2}}, 0x80000000, &(0x7f0000000480), &(0x7f00000004c0)}, 0x8, &(0x7f0000000cc0)=[{0x1, 0x0, &(0x7f0000000500)='\x00', &(0x7f0000000540)="3f6b3ebe9055a1eee1d47f3b081d7c80ca022c84591e8b8cfe0351c7dae240cd6222499247f31422130dafda029f057843f78c6887cc14f94b2ca06c2eb583fa153cdd40e3f2c5867e455aeeb2a7f04e027fa05a8b047902892b58d98edf1de6446fdb229dfa0fd28d68b5c0a35bff76f089ecdc339a8b48556d721ca84a191a8be7c58f6b4ef178332ca33a8a", 0x8d, 0x22}, {0x3, 0x9, &(0x7f0000000600)='\x00', &(0x7f0000000640), 0x0, 0x32}, {0x1, 0x5, &(0x7f0000000680)='\\[(-.!-%^{(\x00', &(0x7f00000006c0)="28f6668e0c72958c624e11a2e30673ce3172ea8277c6616c4ea0b07b738dc12665a4b0b553fea513514557dc262337129a8240279ac9772414a6333231ed8af42db6b135b55f8c40343e507c1d26fea514a88cc70022ec1323c14e1a30ebf1986be0a74a218f01d32ad7ff74604fb66c20a87b018ea4fd88b1b89ef60b2b63998a5525b716b893d824c644a8655335aabfe500736cbb4139e2445502d89deba1", 0xa0, 0x20}, {0x1, 0x8, &(0x7f0000000780)='\x00', &(0x7f00000007c0)="416b68c3f3905734621c8ed17d90306977a0b90e0b347e539de0d6052d0078c7b175d33a34f84c21f47c8c32f2fbda873db0b45e68e44bf113a725da385278b2918d0c12fd60bc6a9f8dc6830140e98cb9c1246acc3d7f08b42ab342becd22a59cfbce7947211b48e8c999532fce29f8b5721d898dd8ac2fafc84464e7d4fb9d85932777d61a7a9808a73dffe6cb3f2efd367327d2d7a6c940647ab2033867f90dabcba8146adc02266a94ed4003cf99a96e5b5d0a362ef1267040419e5259de976d1e98659f61186014d26cb5e4fa5f14bac01ff99f77938c1d321349df195558513b70d61e6522c996703f35757721084a06b3", 0xf4, 0x6}, {0x3, 0x1, &(0x7f00000008c0)=',\x00', &(0x7f0000000900)="4bb6b917d579bd0b40796edf33e818fb44138436087ef5b964e44ae6bc378d97713543cada89aa3c308ef271cb112a8ce8f9f42da15e86c4cd25516c039a571c7861efd9f09642c8519fe17ca4dab0e1fb26472548897c00446d2fd9c7c26388a5c9074ad24bd29d363e9f369b3da3e36898012acfc08f142756f775674f83afff7bd2caa8d7619b0648cf2d647bf8ca4e615f41e41c63a0d3532c2fcd88191e613476b8eea50a7107bb72", 0xab, 0x3a}, {0x3, 0x2, &(0x7f00000009c0)='\x00', &(0x7f0000000a00)="8437430e46aac5be0bbc087795ca8a0eb1c8b00b5cb59ee6bd6ee54a1d03e9096cf2c6d217aa0f82f0ce73a8d1c1b0caed51a9754dcc7001ae5e0abf5000f5bec3a9d46871b5cc85e86eda03c304ebffd18e1d374b7bb0e349ee0fa430e730a348d9ab178720dd624728d1b0a342b35fa9edbbaa68ebddce6fe9570345ad6e031b1009b8243b0d241445e1d04af44593beec30a59bc2295f812d44e6f68b3c969dbc9d16283f4ed8048f311927744b", 0xaf, 0x18}, {0x3, 0x80000001, &(0x7f0000000ac0)='-(*\x00', &(0x7f0000000b00)="62978ce168f60fcfa55fa176d1ccc95793668250bfa1b73e5da0d5e56a2b2c3aaac295768886a7b1ffe4d563a17c9dbb6342df274fed6031861dd5be7f6471fbd6560fe9d8860f40700ff56f71a37656b6c5328d0e831f33d3fd72b4e3c77245667729f5c33e1a50c48e21cd87692fcf6353f00b8eaee0426d6343041e65bbb5debd484cfbfdd3fe99324ef4591c56276fa7ac8259141220237e6486c6393137", 0xa0, 0x20}, {0x2703e8ba5e1464dd, 0xfffff7b2, &(0x7f0000000bc0)='syzkaller\x00', &(0x7f0000000c00)="094a856c0e91dcf676cc1a4fd2c9208e9ef818658eb3c003330c40d8d17167ae19b8e2c466782ba22e18d408d3ff68f1b2e98b089381a2e4389ed8d9fc417b8552c43cb28f9ee5d2445f10d4f79c3829d3acfdef857ec3d73597089c89deb229f1720f13138e7a3d942f51fc5d6dcd220a7354749c3f0c80a7cf10a242c4bf464916bbd855db4bcbf1004cbbde14a9cf264ffc38cfed0323fa5c3c4a38b651cef4eab013c33b", 0xa6, 0x2}]}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000010c0)={0xffffffffffffffff, 0x20, &(0x7f0000001080)={&(0x7f0000000ec0)=""/192, 0xc0, 0x0, &(0x7f0000000f80)=""/222, 0xde}}, 0x10) r20 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r20, 0x0) r21 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r22 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r22, @ANYRES32=r21, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r22, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r20}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000001180)={0x1d, 0xb, &(0x7f0000000100)=@raw=[@call={0x85, 0x0, 0x0, 0x84}, @map_idx={0x18, 0x9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x195, 0x0, 0x0, 0x0, 0x81}, @exit, @generic={0x0, 0x2, 0x3, 0x3, 0x10001}, @cb_func={0x18, 0x8, 0x4, 0x0, 0xfffffffffffffff8}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x2}], &(0x7f0000000180)='GPL\x00', 0x1, 0xdb, &(0x7f0000000300)=""/219, 0x40f00, 0x48, '\x00', r17, @fallback=0x2b, r18, 0x8, &(0x7f0000000e40)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000e80)={0x1, 0x6, 0x2, 0x5}, 0x10, r19, r2, 0x2, &(0x7f0000001100)=[r22], &(0x7f0000001140)=[{0x5, 0x2, 0x2, 0x4}, {0x1, 0x1, 0x1, 0x6}], 0x10, 0x2041}, 0x94) 1.571472826s ago: executing program 4 (id=6129): r0 = socket$unix(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000200)={0x1d, r1}, 0x10) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$rds(r3, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f00000008c0)=[@rdma_args={0x48, 0x114, 0x1, {{0x2}, {0x0}, &(0x7f0000001880)=[{0x0}], 0x1}}], 0x48, 0x24080080}, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}, 0x1c) r5 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r5, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="5c00000012006bab9e3fe3d86e6c1d000014a10dfe000000000004b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003000601000004000200110000", 0x5b}, {&(0x7f0000000680)='\'', 0x1}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=r2, @ANYRES64=r1, @ANYRES64=r0, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) sendmsg$sock(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002980)=[{&(0x7f0000000900)="b64216f0382dbb5e3a502d19cf5e78f804a5d14c8c60e35d9f2858c9bf", 0x1d}], 0x1}, 0x4) sendmsg$sock(r2, &(0x7f0000001940)={&(0x7f00000002c0)=@sco, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000008c0)}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="580000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000300012800c0001006d6163766c616e00200002800800010010000000080003000000000008000400"], 0x58}}, 0x0) 1.390999685s ago: executing program 3 (id=6130): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r3, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) (async) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r3, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000010010000000ffdbdf2530000000", @ANYRES32=r4, @ANYBLOB="20000000000000001c0012800b0001006d616373656300000c00028005000f"], 0x3c}}, 0x0) 1.318967061s ago: executing program 1 (id=6131): r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000080)=0x1c) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f00000000c0)={'geneve0\x00'}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001540)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {0xc}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) 1.290442697s ago: executing program 2 (id=6132): socket$nl_xfrm(0x10, 0x3, 0x6) 1.09879068s ago: executing program 1 (id=6133): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x80000, @dev={0xfe, 0x80, '\x00', 0x10}, 0x80}, 0x20) syz_emit_ethernet(0x8e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa1acd1f78800d86dd608a37f200587300fe8000000000000000000000000000bbfe8000000000000000000000000000aa00000000", @ANYRES8], 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[], 0x44}, 0x1, 0x1000000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041011}, 0x4048801) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)={0x18c, 0x0, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0xfc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x92e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xbfc9, @mcast2, 0x9}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x10000, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xe8}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x9, @private0, 0x4}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x5, @loopback, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'vlan1\x00'}}]}, @TIPC_NLA_LINK={0x7c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x50c}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x18c}, 0x1, 0x0, 0x0, 0x40000}, 0x24040000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x44, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x37}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000240)="2705020059feff000600002fb96dbcf706e10500070088a800008100accb", 0x1e}, {&(0x7f00000002c0)="88a8", 0x2}, {&(0x7f00000005c0)="ac3788481e439e19a3fab5e73acb3e944e5067314670e86878ea780b34a68a9f01b15a9ff9522b89b6c88218d5f257529aa4e34fab88a671ab48b27ac6a4207fe8a270d3d5b82f100a392980a058dddf565e7deaddd88af7ee746b611a2c5033762a03a3b3e135cf3e1b253385ed8c0de1a820324943afbf72b1509334a4815debe79c5d881fe356404ebd716994cc31b9279965133894ceca066cba08977bfd328ee08749c20449017c661b7cfb27f29f4c2a5ef569403ee926899deada9ab15aba6b7054dc68cf2a65ca130aa11ca288230c24a6f2cd9a865615ce0bdeceb0d07f6a9b693d9aea5629b7578a843b98a8", 0xf1}], 0x3}, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.097992472s ago: executing program 2 (id=6134): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x3a}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x70) (async) r1 = accept$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000100)=0x14) (async) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'macvtap0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2d, 0x4, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0xc, 0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0xffffffff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x44080) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x7, 0x3, 0x0, 0x6, 0x1e06, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x2}, 0x50) ioctl$OCFS2_IOC_GROUP_ADD(r4, 0x40186f02, &(0x7f0000000300)={0x5340, 0x1, 0x3, 0x7}) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0xa4, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x74, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x64, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xc, 0x1, 'rateest\x00'}, @NFTA_MATCH_INFO={0x4c, 0x3, "7e6b92c43235dc7e977221f83c3f179e65022fc067b787cd67b6d9983b1bddafbdf6a37da5ed332cd2ee94b31d2ec330ce34cc676c0783a4bcc1e966554b0470582e870b81e92a63"}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x5}}}, 0xcc}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) (async) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r9, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) (async) connect$packet(r1, &(0x7f0000000140)={0x11, 0x9, r3, 0x1, 0x8, 0x6, @random="7c8d1496b1ab"}, 0x14) 1.0645888s ago: executing program 3 (id=6135): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYRESOCT=r0, @ANYRESOCT], 0x12f4}, 0x1, 0x0, 0x0, 0x81}, 0x180) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405000000000000611064000000000007000020000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x3c) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmsg$xdp(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)=[{0x0}, {0x0}, {&(0x7f0000000440)="5f68affb0e", 0x5}], 0x3, 0x0, 0x0, 0x10}, 0x200040c0) recvmsg$unix(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000240)=""/54, 0x36}, {&(0x7f0000000500)=""/128, 0x80}], 0x2}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x3, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000630121000000000095"], &(0x7f0000000100)='GPL\x00'}, 0x90) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa080045000028006700000a06"], 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f00000001c0)=0x10) r8 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000000)={r9, @in={{0x2, 0x4e24, @empty}}, 0x27c0}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000700)=@newqdisc={0xe4, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xfff3}, {0xfff2, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0xb4, 0x2, {{0x1, 0x8, 0x4361, 0x7, 0x2, 0x3}, [@TCA_NETEM_JITTER64={0xc, 0xb, 0x5d}, @TCA_NETEM_DELAY_DIST={0x36, 0x2, "0523442d0a28214c2951776f9ed25c61daeec20b65aad8c417ecb73fe0a8cd6e88cb51bf72738ba9567887dcc7d30a7d1df3"}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x80000000, 0x4fc, 0x9, 0x7ff}}, @TCA_NETEM_RATE64={0xc, 0x8, 0xdbc8713e853bb7b8}, @TCA_NETEM_ECN={0x8}, @TCA_NETEM_RATE={0x14, 0x6, {0x43, 0xad, 0xdf}}]}}}]}, 0xe4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0x0, 0xd}, {0xf, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) 920.257675ms ago: executing program 1 (id=6136): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1200000004000000040000001200000400000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r1, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r0}, 0x20) recvmmsg(r0, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12060, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0xd, &(0x7f0000000040), 0x4) ioctl$sock_TIOCINQ(r3, 0x541b, &(0x7f00000000c0)) socket$inet6(0xa, 0x5, 0x0) socket$igmp(0x2, 0x3, 0x2) r4 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r6, @ANYBLOB="00000000000000005c001280110001006272696467655f736c617665000000004400058005000500000000000500", @ANYRES8=r4], 0x7c}}, 0x0) 671.091844ms ago: executing program 2 (id=6137): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000380)=0x14) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='%\x00', 0x1, &(0x7f0000000040)={@align=0x1, {0x46fc, 0x1, 0x7fff, 0x1}}, 0x2c, &(0x7f0000000080), &(0x7f00000000c0)=0x6e}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xc1102020}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000008316dd521a07467ea590c72385b6d23e987d035687ab632963024c52644f0bf4bbd2e9d06e6edc40f8a6b6c8f3f0b84e5ee30da17cb285012024200265b680829c1d540a50959bea8100b2427b773b506572e48b0fd4c00fe6610aa09a1d0e271940a60cdf1f5595f99ffbbb19977d33e0982c77b79e55e2da93d9f11e9f067cc975c07ed9d3e6558c259d63d406d93c8cae7a373ffe4d6c0edc28459bf09c3c533a4449fe5b204278d7b88719c3d70c5dd22063fc23580a9d4c267e8d15e3169eb58d674add61807c772f01ca8a167e406be3bfaae208df4", @ANYRES16=r2, @ANYBLOB="000229bd7000fbdbdf25550000000c009900010000004b000000"], 0x20}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) 559.103781ms ago: executing program 4 (id=6138): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000012c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x1, 0x0, 0x9}, 0x8}, [{0x0, 0x0, 0x0, 0x0, 0x0, 0x67}, {0x0, 0x4}, {}, {0x0, 0x40000000}, {}, {}, {}, {0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x80000000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2, 0x40}, {}, {0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0x0, 0x7, 0x7}, {}, {0x0, 0x0, 0x2, 0x0, 0xfffffffc}, {}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x10000}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2, 0x81}, {0x0, 0x0, 0xe4ffffff}, {0x0, 0x2}, {}, {0x80000}, {0x0, 0xfffffffd}, {}, {}, {0x15d, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {0xdff8}, {}, {}, {}, {0x0, 0xfffffffc}, {0x4}, {0x3}, {0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {0xfff}, {}, {0x0, 0x0, 0x0, 0x0, 0x8000000}, {}, {}, {0x0, 0x1000}, {0x0, 0x0, 0x4000000}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xffff, 0x8}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x1}, {}, {0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x0, 0xe}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {0xffffffff}, {}, {0x0, 0x0, 0xd1000000}, {}, {0x800000, 0x0, 0x9}, {0x0, 0x0, 0x0, 0x81, 0x0, 0x400}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff24}, {}, {0x0, 0x0, 0x2000000}, {0x0, 0x3}, {0x0, 0x0, 0x10000}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x1, 0x2}, {0x0, 0x80}, {}, {}, {}, {0x0, 0x0, 0xffffffff, 0x800}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0xd}, {0xfff}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x5}, {0x0, 0x0, 0xfffffffd}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0xda8, 0x2, 0x0, 0x0, 0xa}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x5, 0x1}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {0x0, 0x1}, {0x2}, {}, {}, {0x3}, {}, {0x0, 0x1}, {}, {0x5}, {}, {}, {0x5}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {0x2}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x20040804) 334.938899ms ago: executing program 3 (id=6139): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000080)={0x48, r3, 0x1, 0x70bd2c, 0x40ffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}]}, 0x48}}, 0x20000000) 255.389598ms ago: executing program 4 (id=6140): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$pptp(0x18, 0x1, 0x2) recvmmsg(r1, &(0x7f0000000e00)=[{{0x0, 0x0, 0x0}, 0xac4}], 0x1, 0x40, 0x0) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xfff) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000000406010800797a3100000000e4a588f600"/36], 0x20}, 0x1, 0x0, 0x0, 0x8001}, 0x20044041) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f00000001c0)=@int=0x5470, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) (async) socket$pptp(0x18, 0x1, 0x2) (async) recvmmsg(r1, &(0x7f0000000e00)=[{{0x0, 0x0, 0x0}, 0xac4}], 0x1, 0x40, 0x0) (async) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) (async) listen(r0, 0xfff) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000000406010800797a3100000000e4a588f600"/36], 0x20}, 0x1, 0x0, 0x0, 0x8001}, 0x20044041) (async) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f00000001c0)=@int=0x5470, 0x4) (async) 254.948583ms ago: executing program 2 (id=6141): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e24, @broadcast}}, 0xffff, 0x28, 0x2, 0x40, 0x43, 0x8381, 0x2}, &(0x7f0000000100)=0x9c) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000140)={r1, 0x5}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="280000001900010000000000000002001c140000fe00000101"], 0x28}}, 0x0) 254.068142ms ago: executing program 1 (id=6142): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x24, r1, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c810}, 0x80) pipe(0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_REMOVE(r3, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f0000000e80)={0x268, 0x1, 0x5, 0xb03, 0x0, 0x0, {0x7, 0x0, 0x9}, [{{0x254, 0x1, {{0x0, 0x7ff}, 0xf9, 0x0, 0xc6, 0x81, 0x25, 'syz0\x00', "eecaed75a436442762727e152ca52da2fefec6b03b527deac6ca1130aa3a6586", "0992ca1f46843b87d8eddb88d6ced85504d0ad2030f7f63800f9dac27f2dac7d", [{0x2, 0x0, {0x2, 0x7}}, {0x1, 0x5, {0x2, 0xa45}}, {0x6, 0xa1, {0x0, 0x8}}, {0x7, 0x933, {0xc9a81555307fd5ba, 0xa}}, {0x5, 0x3c1, {0x1, 0xff}}, {0xfff, 0x5, {0x0, 0x4}}, {0x24, 0x912, {0x3, 0xe4}}, {0x9, 0x5, {0x1, 0x4}}, {0xabd, 0x0, {0x1, 0x800000e7}}, {0x80, 0x6, {0x2, 0x9}}, {0x4, 0xd, {0x3, 0x2}}, {0x9, 0x81, {0x0, 0x7}}, {0x81, 0x1, {0x2, 0x200}}, {0x0, 0x1, {0x0, 0x3ff}}, {0x8, 0x40, {0x3}}, {0x6, 0xaa, {0x0, 0x8001}}, {0x9, 0xf885, {0x0, 0x5}}, {0x0, 0xa206, {0x0, 0xb}}, {0x1, 0x1000, {0x2, 0xfffffff9}}, {0x7, 0x1, {0x1, 0x3}}, {0x8, 0x0, {0x0, 0x2}}, {0x8, 0xb, {0x0, 0x4}}, {0x5, 0x1ff, {0x1, 0x8}}, {0xc, 0x7, {0x0, 0x550}}, {0x4e, 0x5, {0x2, 0xa0}}, {0x9, 0x9, {0x2, 0x5}}, {0x200, 0x721, {0x1, 0x1ff}}, {0xfffd, 0x8, {0x1}}, {0xfff7, 0x2, {0x0, 0x1d03}}, {0x7, 0x4, {0x2, 0x7f}}, {0x1ff, 0x5, {0x1, 0x8001}}, {0x1, 0x8, {0x0, 0xe87d}}, {0x8, 0x4, {0x3, 0x3}}, {0x3, 0x8, {0x2, 0x3}}, {0x9, 0xffff, {0x0, 0xd632}}, {0x2, 0x8, {0x2, 0x3}}, {0x0, 0xffff, {0x1, 0x401}}, {0xfffd, 0x7, {0x0, 0x7}}, {0x3, 0x2e27, {0x3, 0x4}}, {0x0, 0xfff, {0x2, 0x4}}]}}}]}, 0x268}, 0x1, 0x0, 0x0, 0x20008005}, 0x8010) ioctl$BTRFS_IOC_BALANCE(r3, 0x5000940c, 0x0) 60.442047ms ago: executing program 0 (id=6143): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000000c0)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xa4, &(0x7f000000cf3d)=""/164, 0x40f00, 0x25, '\x00', 0x0, @sk_reuseport}, 0x94) ioctl$BTRFS_IOC_ENCODED_READ(r0, 0x80809440, &(0x7f0000000100)={&(0x7f0000000080)=[{&(0x7f0000000000)="06c3c103ba314afc88a8dfdb05551af969d76b10546e76586d5a2661e41bdc220cc42f54df35413a2086f1fa1c4a520af38a0e5599579efa122f5c5593f0dc0a14745ee4d3efe241a415ec03f84d2326c624afcd0186ee4955882da6a8", 0x5d}], 0x1, 0x5, 0x0, 0x3400000000000, 0xfffffffffffffffb, 0xfffffffffffffffb, 0x3, 0x10000}) 0s ago: executing program 2 (id=6144): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000160a01020000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800024000000000080001400000000008000740000000015c000000160a01010000000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001"], 0xec}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xb) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newtaction={0x64, 0x30, 0x1, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0x0, 0x0, 0x80000008}, 0x4}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) pipe(&(0x7f0000000200)) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$unix(r6, 0x0, 0x0, 0x800) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES8=0x0, @ANYBLOB="46060900040c01001c00128009000100626f6e64000000000c00028008000b00", @ANYRES32=r3, @ANYBLOB="d6290d626e390c5777cd3c0cbe83a646e8dfc557595c57c2fa0304a3298ea99a58a67cc2b90d"], 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x730, 0x270, 0x190, 0x0, 0x190, 0x0, 0x660, 0x660, 0x660, 0x660, 0x660, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@dccp={{0x30}, {[0x4e24, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x20, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private0, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x790) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r10, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="9800000010001fff29bd70008000000000000000", @ANYRES32=0x0, @ANYBLOB="48310600003f00001c0019800500020000000000050006000600000005000200000000005c0012800b000100626b7461647600004c0002800d0001004241544d414e5f49560000000c0001004241544d414e5f560d0001004241544d414e5f49560000000c0001004241544d414e5f560d0001004241544d414e5f4956000000"], 0x98}, 0x1, 0x0, 0x0, 0x20004081}, 0x40000) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000140)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r13], 0x68}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r13, {0x10, 0xffe0}, {0x10, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x2400c894}, 0x0) kernel console output (not intermixed with test programs): process `syz.4.4641'. [ 624.730091][T16454] xfrm0 speed is unknown, defaulting to 1000 [ 624.827511][T22830] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4646'. [ 624.911618][T22832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4649'. [ 625.016320][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.039219][T22840] tipc: Failed to remove unknown binding: 66,1,1/3273515124:757138699/757138701 [ 625.095457][T22620] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.387472][T22848] netlink: 'syz.1.4654': attribute type 5 has an invalid length. [ 625.744631][T22866] pimreg: entered allmulticast mode [ 625.750224][T22617] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.771523][T22866] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4660'. [ 625.791626][T22867] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4660'. [ 625.830724][T22868] IPVS: length: 134 != 8 [ 625.843973][T22866] IPVS: length: 134 != 8 [ 625.877386][T22871] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4664'. [ 625.898794][T22871] bond0: ARP target 8.4.0.0 is already present [ 625.924281][T22871] bond0: option arp_ip_target: invalid value (1032) [ 626.053553][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 626.072442][T22884] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4665'. [ 626.116855][T22884] netlink: 188 bytes leftover after parsing attributes in process `syz.3.4665'. [ 626.336281][T22896] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4669'. [ 626.354764][T22896] block nbd0: reconnected socket [ 626.371923][T22896] nbd: socks must be embedded in a SOCK_ITEM attr [ 626.384404][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 626.448021][ T50] block nbd0: Receive control failed (result -32) [ 626.528921][T22903] bridge_slave_0: invalid flags given to default FDB implementation [ 627.145005][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 627.272432][ T5738] IPVS: starting estimator thread 0... [ 627.355622][T22932] ip_tunnel: non-ECT from 2.0.0.0 with TOS=0x3 [ 627.404912][T22934] IPVS: using max 27 ests per chain, 64800 per kthread [ 627.557346][T22944] netlink: 'syz.2.4686': attribute type 8 has an invalid length. [ 627.569384][T22948] netlink: 'syz.0.4687': attribute type 1 has an invalid length. [ 627.731928][T22948] bond12: entered promiscuous mode [ 627.738799][T22948] 8021q: adding VLAN 0 to HW filter on device bond12 [ 628.215625][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.484435][T22997] openvswitch: netlink: Key type 36 is out of range max 32 [ 628.532062][T23002] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4699'. [ 628.632947][ T50] block nbd2: Receive control failed (result -107) [ 628.666611][T23011] netlink: zone id is out of range [ 628.696500][T23014] syzkaller0: entered promiscuous mode [ 628.705062][T23014] syzkaller0: entered allmulticast mode [ 628.717839][T23011] netlink: del zone limit has 4 unknown bytes [ 629.246937][T23035] netlink: 'syz.2.4713': attribute type 2 has an invalid length. [ 629.258628][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.822033][T23067] __nla_validate_parse: 6 callbacks suppressed [ 629.822056][T23067] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4721'. [ 629.988963][T23075] netlink: zone id is out of range [ 630.004997][T23075] netlink: zone id is out of range [ 630.013249][T23075] netlink: zone id is out of range [ 630.019141][T23075] netlink: zone id is out of range [ 630.031224][T23075] netlink: zone id is out of range [ 630.226350][T23083] gre2: entered promiscuous mode [ 630.244320][T23080] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4727'. [ 630.265482][T23081] tipc: Enabled bearer , priority 0 [ 630.287100][T23081] syzkaller0: entered promiscuous mode [ 630.304767][T23081] syzkaller0: entered allmulticast mode [ 630.392308][T23081] tipc: Resetting bearer [ 630.431876][T23077] tipc: Resetting bearer [ 630.517514][T23077] tipc: Disabling bearer [ 630.556426][T23102] netlink: 'syz.4.4732': attribute type 1 has an invalid length. [ 630.761034][T23110] FAULT_INJECTION: forcing a failure. [ 630.761034][T23110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 630.790996][T23110] CPU: 0 UID: 0 PID: 23110 Comm: syz.4.4736 Not tainted syzkaller #0 PREEMPT(full) [ 630.791027][T23110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 630.791040][T23110] Call Trace: [ 630.791049][T23110] [ 630.791058][T23110] dump_stack_lvl+0xe8/0x150 [ 630.791098][T23110] should_fail_ex+0x40c/0x560 [ 630.791129][T23110] _copy_from_iter+0x1d3/0x1660 [ 630.791157][T23110] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 630.791186][T23110] ? rcu_is_watching+0x15/0xb0 [ 630.791219][T23110] ? trace_kmem_cache_alloc+0x29/0xe0 [ 630.791248][T23110] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 630.791274][T23110] ? __pfx__copy_from_iter+0x10/0x10 [ 630.791312][T23110] ? __alloc_skb+0x276/0x7a0 [ 630.791360][T23110] ? __alloc_skb+0x276/0x7a0 [ 630.791397][T23110] ? netlink_sendmsg+0x650/0xb40 [ 630.791419][T23110] ? skb_put+0x112/0x210 [ 630.791454][T23110] netlink_sendmsg+0x6c0/0xb40 [ 630.791487][T23110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 630.791514][T23110] ? aa_sock_msg_perm+0xf1/0x1b0 [ 630.791543][T23110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 630.791563][T23110] sock_sendmsg_nosec+0x13a/0x180 [ 630.791595][T23110] ____sys_sendmsg+0x54e/0x850 [ 630.791621][T23110] ? __pfx_____sys_sendmsg+0x10/0x10 [ 630.791653][T23110] ? import_iovec+0x73/0xa0 [ 630.791686][T23110] ___sys_sendmsg+0x2a5/0x360 [ 630.791706][T23110] ? __lock_acquire+0x683/0x2cf0 [ 630.791740][T23110] ? __pfx____sys_sendmsg+0x10/0x10 [ 630.791798][T23110] ? __fget_files+0x2a/0x420 [ 630.791825][T23110] ? __fget_files+0x3a2/0x420 [ 630.791864][T23110] __x64_sys_sendmsg+0x1b1/0x290 [ 630.791889][T23110] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 630.791929][T23110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 630.791954][T23110] do_syscall_64+0x174/0x580 [ 630.791974][T23110] ? trace_irq_disable+0x3b/0x140 [ 630.792001][T23110] ? clear_bhb_loop+0x40/0x90 [ 630.792033][T23110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 630.792055][T23110] RIP: 0033:0x7f521459de99 [ 630.792075][T23110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 630.792094][T23110] RSP: 002b:00007f521539e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 630.792118][T23110] RAX: ffffffffffffffda RBX: 00007f5214825fa0 RCX: 00007f521459de99 [ 630.792134][T23110] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 630.792148][T23110] RBP: 00007f521539e090 R08: 0000000000000000 R09: 0000000000000000 [ 630.792161][T23110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 630.792174][T23110] R13: 00007f5214826038 R14: 00007f5214825fa0 R15: 00007ffd73fb5a38 [ 630.792208][T23110] [ 631.551184][T23148] netlink: 'syz.4.4749': attribute type 1 has an invalid length. [ 631.561745][T23149] netlink: 'syz.4.4749': attribute type 1 has an invalid length. [ 631.681580][T23148] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 631.682691][T23149] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 631.889350][T23168] netlink: 'syz.2.4753': attribute type 1 has an invalid length. [ 632.060796][T23168] 8021q: adding VLAN 0 to HW filter on device bond5 [ 632.161632][T23169] bond5: (slave veth5): Enslaving as an active interface with a down link [ 632.254806][T23171] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 632.290495][T23178] Unsupported ieee802154 address type: 0 [ 632.314758][T23171] bond5: (slave batadv0): making interface the new active one [ 632.356487][T23171] batadv0: entered promiscuous mode [ 632.375318][T23171] bond5: (slave batadv0): Enslaving as an active interface with an up link [ 632.437640][T23181] bridge0: port 1(bridge_slave_0) entered disabled state [ 632.459670][T23185] FAULT_INJECTION: forcing a failure. [ 632.459670][T23185] name failslab, interval 1, probability 0, space 0, times 0 [ 632.513847][T23185] CPU: 0 UID: 0 PID: 23185 Comm: syz.3.4757 Not tainted syzkaller #0 PREEMPT(full) [ 632.513874][T23185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 632.513887][T23185] Call Trace: [ 632.513895][T23185] [ 632.513903][T23185] dump_stack_lvl+0xe8/0x150 [ 632.513936][T23185] should_fail_ex+0x40c/0x560 [ 632.513962][T23185] should_failslab+0xa8/0x100 [ 632.513991][T23185] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 632.514014][T23185] ? skb_clone+0x212/0x3a0 [ 632.514031][T23185] ? skb_clone+0x212/0x3a0 [ 632.514054][T23185] skb_clone+0x212/0x3a0 [ 632.514076][T23185] __netlink_deliver_tap+0x413/0x860 [ 632.514103][T23185] ? netlink_deliver_tap+0x2e/0x1b0 [ 632.514122][T23185] netlink_deliver_tap+0x19c/0x1b0 [ 632.514141][T23185] netlink_unicast+0x77f/0x940 [ 632.514177][T23185] netlink_sendmsg+0x813/0xb40 [ 632.514206][T23185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 632.514233][T23185] ? aa_sock_msg_perm+0xf1/0x1b0 [ 632.514261][T23185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 632.514281][T23185] sock_sendmsg_nosec+0x13a/0x180 [ 632.514311][T23185] ____sys_sendmsg+0x54e/0x850 [ 632.514338][T23185] ? __pfx_____sys_sendmsg+0x10/0x10 [ 632.514369][T23185] ? import_iovec+0x73/0xa0 [ 632.514415][T23185] ___sys_sendmsg+0x2a5/0x360 [ 632.514453][T23185] ? __lock_acquire+0x683/0x2cf0 [ 632.514488][T23185] ? __pfx____sys_sendmsg+0x10/0x10 [ 632.514548][T23185] ? __fget_files+0x2a/0x420 [ 632.514576][T23185] ? __fget_files+0x3a2/0x420 [ 632.514615][T23185] __x64_sys_sendmsg+0x1b1/0x290 [ 632.514640][T23185] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 632.514683][T23185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.514710][T23185] do_syscall_64+0x174/0x580 [ 632.514733][T23185] ? clear_bhb_loop+0x40/0x90 [ 632.514760][T23185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.514782][T23185] RIP: 0033:0x7fc2e679de99 [ 632.514803][T23185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.514821][T23185] RSP: 002b:00007fc2e7603028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 632.514845][T23185] RAX: ffffffffffffffda RBX: 00007fc2e6a25fa0 RCX: 00007fc2e679de99 [ 632.514860][T23185] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 632.514874][T23185] RBP: 00007fc2e7603090 R08: 0000000000000000 R09: 0000000000000000 [ 632.514888][T23185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.514900][T23185] R13: 00007fc2e6a26038 R14: 00007fc2e6a25fa0 R15: 00007ffdc104e158 [ 632.514936][T23185] [ 633.107352][T23203] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4762'. [ 633.470582][T23218] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4767'. [ 633.477026][ T29] net_ratelimit: 5 callbacks suppressed [ 633.477080][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 633.606305][T23222] netlink: 220 bytes leftover after parsing attributes in process `syz.4.4769'. [ 633.622637][T23222] netlink: 'syz.4.4769': attribute type 4 has an invalid length. [ 633.646619][T23222] netlink: 'syz.4.4769': attribute type 4 has an invalid length. [ 633.794639][T23229] ip6erspan0: entered allmulticast mode [ 633.839138][T23229] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4770'. [ 633.909195][T23232] bond0: (slave gre0): refused to change device type [ 634.451849][T23256] netlink: 232 bytes leftover after parsing attributes in process `syz.4.4780'. [ 634.529857][T23259] netlink: 'syz.1.4781': attribute type 22 has an invalid length. [ 634.543964][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.560815][T23259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4781'. [ 634.580501][T23259] netlink: 'syz.1.4781': attribute type 22 has an invalid length. [ 634.618723][T23259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4781'. [ 635.082252][T23274] ip6erspan0: entered allmulticast mode [ 635.175656][T23279] netlink: 'syz.1.4790': attribute type 1 has an invalid length. [ 635.235336][T23263] sctp: [Deprecated]: syz.2.4782 (pid 23263) Use of struct sctp_assoc_value in delayed_ack socket option. [ 635.235336][T23263] Use struct sctp_sack_info instead [ 635.261244][T23286] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4789'. [ 635.565525][T23297] netlink: 'syz.4.4794': attribute type 3 has an invalid length. [ 635.578196][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.600624][T23297] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4794'. [ 635.641188][T23299] netlink: 'syz.4.4794': attribute type 3 has an invalid length. [ 635.827617][T23310] netlink: 'syz.4.4799': attribute type 1 has an invalid length. [ 635.970394][T23324] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 636.545811][T23350] netlink: 92 bytes leftover after parsing attributes in process `syz.3.4811'. [ 636.571027][T23350] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4811'. [ 636.589172][T23355] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4812'. [ 636.622035][ T8473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.631172][T22621] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.645027][ T810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.697302][T23356] syzkaller0: entered promiscuous mode [ 636.716190][T23356] syzkaller0: entered allmulticast mode [ 636.782337][T23356] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4814'. [ 636.881360][ T8473] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x69 [ 637.178357][T23383] netlink: 'syz.3.4822': attribute type 1 has an invalid length. [ 637.186717][T23383] netlink: 'syz.3.4822': attribute type 2 has an invalid length. [ 637.249093][T23386] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4823'. [ 637.260184][T23386] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 637.475508][T23394] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4825'. [ 637.522104][T22617] bond0: (slave bond6): link status definitely down, disabling slave [ 637.637734][T23399] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4827'. [ 637.656055][ T810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.768609][T23403] netlink: 'syz.0.4829': attribute type 1 has an invalid length. [ 637.817583][T23403] veth3: entered allmulticast mode [ 637.829714][T23403] bond13: (slave veth3): Enslaving as an active interface with a down link [ 637.863826][T23403] bond13: (slave veth0_to_bond): making interface the new active one [ 637.878208][T23403] bond13: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 637.946628][T23406] netlink: 180 bytes leftover after parsing attributes in process `syz.0.4830'. [ 638.269860][T23408] netlink: 'syz.3.4831': attribute type 4 has an invalid length. [ 638.279934][T23408] netlink: 'syz.3.4831': attribute type 3 has an invalid length. [ 638.392001][T23413] netlink: 'syz.3.4832': attribute type 1 has an invalid length. [ 638.436287][T23410] macvlan0: entered promiscuous mode [ 638.441719][T23410] macvlan0: entered allmulticast mode [ 638.450737][T23410] bond6: entered promiscuous mode [ 638.460397][T23410] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 638.476512][T23410] bond6: left promiscuous mode [ 638.693932][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.865640][T23424] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.873144][T23424] bridge0: port 2(bridge_slave_1) entered listening state [ 638.880559][T23424] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.887804][T23424] bridge0: port 1(bridge_slave_0) entered listening state [ 638.925541][T23424] veth1_macvtap: entered promiscuous mode [ 638.989647][T23424] 8021q: adding VLAN 0 to HW filter on device bond4 [ 639.007888][T23424] 8021q: adding VLAN 0 to HW filter on device bond6 [ 639.026584][T23427] v: renamed from dummy0 (while UP) [ 639.084249][ T810] ip6_tnl_xmit_ctl: 1 callbacks suppressed [ 639.084274][ T810] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 639.111049][T23425] bond0: entered promiscuous mode [ 639.116671][T23425] bond_slave_0: entered promiscuous mode [ 639.122542][T23425] bond_slave_1: entered promiscuous mode [ 639.128815][T23425] team0: entered promiscuous mode [ 639.135460][T23425] team_slave_0: entered promiscuous mode [ 639.141341][T23425] team_slave_1: entered promiscuous mode [ 639.152938][T23425] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 639.175789][T23425] debugfs: 'hsr1' already exists in 'hsr' [ 639.181674][T23425] Cannot create hsr debugfs directory [ 639.187860][T23425] hsr1: entered promiscuous mode [ 639.193447][T18480] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 639.737771][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.757544][T23365] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 640.125550][T22617] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 640.562626][ T30] audit: type=1804 audit(1784607989.710:20): pid=23471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4846" name="/newroot/412/cgroup.controllers" dev="tmpfs" ino=2119 res=1 errno=0 [ 640.635328][ T30] audit: type=1800 audit(1784607989.720:21): pid=23471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4846" name="cgroup.controllers" dev="tmpfs" ino=2119 res=0 errno=0 [ 640.774088][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.267983][T22617] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 641.282924][T22617] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 641.333039][T23504] __nla_validate_parse: 5 callbacks suppressed [ 641.333060][T23504] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4858'. [ 641.626457][T23518] Bluetooth: MGMT ver 1.23 [ 641.676491][T23516] bond14: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 641.690323][T23516] bond14 (unregistering): Released all slaves [ 641.816264][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.178951][T23544] netlink: 'syz.1.4868': attribute type 3 has an invalid length. [ 642.208096][T23544] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4868'. [ 642.247281][T23544] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4868'. [ 642.301555][ T5738] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 642.312723][T23549] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 642.376965][T22617] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.390584][T22622] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.441607][T22621] bond0: (slave bond_slave_0): interface is now down [ 642.488873][T22621] bond0: no route to arp_ip_target 8.4.0.0 and arp_validate is set [ 642.529047][T22621] bond0: (slave bond_slave_1): interface is now down [ 642.854114][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.901685][T23580] netlink: 'syz.0.4880': attribute type 1 has an invalid length. [ 643.108426][T23580] workqueue: Failed to create a rescuer kthread for wq "bond14": -EINTR [ 643.194655][T23592] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4883'. [ 643.232667][T23600] netlink: 'syz.4.4885': attribute type 1 has an invalid length. [ 643.480222][T23617] netlink: 'syz.3.4888': attribute type 1 has an invalid length. [ 643.900910][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.998530][T22618] batadv0: left promiscuous mode [ 644.162814][T23642] netlink: 'syz.0.4893': attribute type 83 has an invalid length. [ 644.650391][T23678] netlink: 244 bytes leftover after parsing attributes in process `syz.0.4902'. [ 644.824618][T23686] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4904'. [ 644.860138][T23686] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4904'. [ 644.884935][T23686] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4904'. [ 644.920818][T23695] lo: MTU too low for tipc bearer [ 644.934676][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.968256][T23695] tipc: Enabling of bearer rejected, failed to enable media [ 645.093422][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 645.094463][T22618] bond0: (slave bond_slave_0): interface is now down [ 645.148460][T22618] bond0: (slave bond_slave_1): interface is now down [ 645.264564][T22618] bond0: now running without any active interface! [ 645.300311][T23709] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4907'. [ 645.342731][T23709] netlink: 6 bytes leftover after parsing attributes in process `syz.3.4907'. [ 645.527888][T23715] xt_hashlimit: size too large, truncated to 1048576 [ 645.641189][T23719] ipt_REJECT: TCP_RESET invalid for non-tcp [ 645.975208][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.375606][T23756] netlink: 'syz.1.4922': attribute type 2 has an invalid length. [ 646.724710][T23772] syzkaller0: entered promiscuous mode [ 646.734553][T23772] syzkaller0: entered allmulticast mode [ 646.951282][T23782] __nla_validate_parse: 1 callbacks suppressed [ 646.951300][T23782] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4934'. [ 647.014210][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 647.052041][T23783] syzkaller0: entered promiscuous mode [ 647.075707][T23783] syzkaller0: entered allmulticast mode [ 647.180360][T23791] syz.1.4937: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 647.219594][T23791] CPU: 1 UID: 0 PID: 23791 Comm: syz.1.4937 Not tainted syzkaller #0 PREEMPT(full) [ 647.219625][T23791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 647.219638][T23791] Call Trace: [ 647.219648][T23791] [ 647.219657][T23791] dump_stack_lvl+0xe8/0x150 [ 647.219700][T23791] warn_alloc+0x24c/0x270 [ 647.219781][T23791] ? stack_depot_save_flags+0x33/0x800 [ 647.219814][T23791] ? __pfx_warn_alloc+0x10/0x10 [ 647.219844][T23791] ? kasan_save_track+0x3e/0x80 [ 647.219871][T23791] ? __kasan_kmalloc+0x93/0xb0 [ 647.219901][T23791] ? xsk_setsockopt+0x52a/0x960 [ 647.219993][T23791] ? do_sock_setsockopt+0x17c/0x1b0 [ 647.220026][T23791] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 647.220059][T23791] ? do_syscall_64+0x174/0x580 [ 647.220087][T23791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.220122][T23791] __vmalloc_node_range_noprof+0x12c/0x1730 [ 647.220183][T23791] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 647.220215][T23791] ? __kasan_kmalloc+0x93/0xb0 [ 647.220247][T23791] ? __kmalloc_cache_noprof+0x32d/0x660 [ 647.220276][T23791] ? __kmalloc_cache_noprof+0x150/0x660 [ 647.220315][T23791] vmalloc_user_noprof+0xad/0xe0 [ 647.220342][T23791] ? xskq_create+0xbf/0x170 [ 647.220375][T23791] xskq_create+0xbf/0x170 [ 647.220412][T23791] xsk_init_queue+0x8a/0xe0 [ 647.220446][T23791] xsk_setsockopt+0x52a/0x960 [ 647.220475][T23791] ? __fget_files+0x2a/0x420 [ 647.220506][T23791] ? __pfx_xsk_setsockopt+0x10/0x10 [ 647.220536][T23791] ? __pfx_aa_sk_perm+0x10/0x10 [ 647.220575][T23791] ? aa_sock_opt_perm+0xff/0x1a0 [ 647.220601][T23791] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 647.220654][T23791] ? __pfx_xsk_setsockopt+0x10/0x10 [ 647.220687][T23791] do_sock_setsockopt+0x17c/0x1b0 [ 647.220727][T23791] __x64_sys_setsockopt+0x13d/0x1b0 [ 647.220764][T23791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.220789][T23791] do_syscall_64+0x174/0x580 [ 647.220809][T23791] ? trace_irq_disable+0x3b/0x140 [ 647.220837][T23791] ? clear_bhb_loop+0x40/0x90 [ 647.220865][T23791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.220888][T23791] RIP: 0033:0x7fad7a79de99 [ 647.220910][T23791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 647.220928][T23791] RSP: 002b:00007fad7b58e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 647.220952][T23791] RAX: ffffffffffffffda RBX: 00007fad7aa25fa0 RCX: 00007fad7a79de99 [ 647.220967][T23791] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 647.220979][T23791] RBP: 00007fad7a833eaf R08: 0000000000000004 R09: 0000000000000000 [ 647.220993][T23791] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 647.221006][T23791] R13: 00007fad7aa26038 R14: 00007fad7aa25fa0 R15: 00007fff56c83678 [ 647.221040][T23791] [ 647.221156][T23791] Mem-Info: [ 647.513682][T23791] active_anon:6017 inactive_anon:0 isolated_anon:0 [ 647.513682][T23791] active_file:3 inactive_file:43338 isolated_file:0 [ 647.513682][T23791] unevictable:768 dirty:147 writeback:0 [ 647.513682][T23791] slab_reclaimable:11547 slab_unreclaimable:113950 [ 647.513682][T23791] mapped:30637 shmem:1295 pagetables:1670 [ 647.513682][T23791] sec_pagetables:0 bounce:0 [ 647.513682][T23791] kernel_misc_reclaimable:0 [ 647.513682][T23791] free:1305745 free_pcp:8606 free_cma:0 [ 647.564830][T23791] Node 0 active_anon:24068kB inactive_anon:0kB active_file:12kB inactive_file:173144kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122648kB dirty:588kB writeback:0kB shmem:3644kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14752kB pagetables:6560kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 647.601478][T23791] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 647.646858][T23791] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 647.748225][T23802] netlink: 'syz.1.4937': attribute type 12 has an invalid length. [ 647.760232][T23791] lowmem_reserve[]: 0 2488 2489 2489 2489 [ 647.770050][T23791] Node 0 DMA32 free:1266508kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23968kB inactive_anon:0kB active_file:12kB inactive_file:173144kB unevictable:1536kB writepending:588kB zspages:0kB present:3129332kB managed:2548684kB mlocked:0kB bounce:0kB free_pcp:34136kB local_pcp:16660kB free_cma:0kB [ 647.811533][T23805] netlink: 'syz.4.4941': attribute type 3 has an invalid length. [ 647.838379][T23791] lowmem_reserve[]: 0 0 0 0 0 [ 647.853919][T23791] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:260kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 647.944364][T23791] lowmem_reserve[]: 0 0 0 0 0 [ 647.949343][T23791] Node 1 Normal free:3942008kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 647.983811][T23791] lowmem_reserve[]: 0 0 0 0 0 [ 647.989016][T23791] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 648.058052][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.068625][T23791] Node 0 DMA32: 1223*4kB (UME) 790*8kB (UME) 486*16kB (UME) 369*32kB (UME) 404*64kB (UME) 540*128kB (UME) 400*256kB (UME) 257*512kB (UM) 125*1024kB (UM) 7*2048kB (UM) 186*4096kB (UM) = 1263948kB [ 648.110085][T23815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4942'. [ 648.124590][T23791] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 648.137562][ T8473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.169408][T23815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4942'. [ 648.189148][T23807] syzkaller0: entered promiscuous mode [ 648.192803][T23791] Node 1 [ 648.195714][T23807] syzkaller0: entered allmulticast mode [ 648.205351][T23791] Normal: 2*4kB (UM) 2*8kB (UM) 6*16kB (UM) 8*32kB (UM) 8*64kB (UM) 4*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 961*4096kB (M) = 3942008kB [ 648.246386][T23791] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 648.256813][T23791] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 648.268501][T23791] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 648.279823][T23791] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 648.292833][T23791] 44650 total pagecache pages [ 648.316005][T23791] 0 pages in swap cache [ 648.326168][T23791] Free swap = 124996kB [ 648.350227][T23791] Total swap = 124996kB [ 648.392297][T23791] 2097051 pages RAM [ 648.444534][T23791] 0 pages HighMem/MovableOnly [ 648.459114][T23791] 428200 pages reserved [ 648.469355][T23791] 0 pages cma reserved [ 648.677073][T23835] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4948'. [ 648.696305][T23836] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4949'. [ 648.744393][T23838] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 648.866154][T23845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4951'. [ 648.880254][T23845] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4951'. [ 648.891121][T23845] netlink: 'syz.0.4951': attribute type 14 has an invalid length. [ 648.900142][T23845] netlink: 'syz.0.4951': attribute type 13 has an invalid length. [ 649.102486][ T810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 650.140166][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.180025][ T810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.979995][T21970] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.165335][T23838] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 652.189171][T23838] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 652.216675][ T810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.265582][T23838] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 652.298627][T23838] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 652.311556][T23854] netlink: 512 bytes leftover after parsing attributes in process `syz.1.4954'. [ 652.378014][T23838] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 652.402666][T23838] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 652.507251][T23838] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 652.540204][T23838] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 652.569632][T23868] netlink: 'syz.0.4957': attribute type 29 has an invalid length. [ 652.613819][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 652.856539][T23878] netlink: 220 bytes leftover after parsing attributes in process `syz.1.4963'. [ 652.953827][T23888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 653.061523][T23896] bond4: Unable to set down delay as MII monitoring is disabled [ 653.098115][T23896] bond4 (unregistering): Released all slaves [ 653.108422][T23902] IPVS: ip_vs_edit_dest(): server weight less than zero [ 653.244943][T23909] netlink: 'syz.2.4973': attribute type 2 has an invalid length. [ 653.255877][T22617] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 653.264468][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 653.448331][T23919] netlink: 'syz.2.4977': attribute type 1 has an invalid length. [ 653.459892][T23917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4976'. [ 653.473075][T23917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4976'. [ 653.551790][T23919] 8021q: adding VLAN 0 to HW filter on device bond6 [ 653.601957][T23922] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4975'. [ 653.673065][T23931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4979'. [ 653.701400][T23929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4978'. [ 653.736330][T23931] bond5: option xmit_hash_policy: invalid value (64) [ 653.758840][T23931] bond5 (unregistering): Released all slaves [ 653.897796][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 653.930576][T23942] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4980'. [ 653.971191][T23942] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4980'. [ 654.005679][T23942] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4980'. [ 654.291074][T23959] netlink: 'syz.0.4987': attribute type 1 has an invalid length. [ 654.304754][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.518014][T23975] netlink: 'syz.0.4992': attribute type 1 has an invalid length. [ 654.537501][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 654.708821][T23983] netlink: 'syz.3.4995': attribute type 1 has an invalid length. [ 654.767353][T23975] bond14: entered promiscuous mode [ 654.780214][T23975] 8021q: adding VLAN 0 to HW filter on device bond14 [ 654.801495][T23983] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 654.846471][T23988] bond14: (slave bridge4): making interface the new active one [ 654.874827][T23988] bridge4: entered promiscuous mode [ 654.881896][T23988] bond14: (slave bridge4): Enslaving as an active interface with an up link [ 654.968454][T23996] bond7: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-xor(2) [ 654.996959][T23996] bond7 (unregistering): Released all slaves [ 655.148332][T23995] lo: entered promiscuous mode [ 655.224577][T23995] tunl0: entered promiscuous mode [ 655.235443][T23995] gre0: entered promiscuous mode [ 655.300822][T24022] netlink: 'syz.2.5002': attribute type 1 has an invalid length. [ 655.316562][T23995] gretap0: entered promiscuous mode [ 655.334053][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.357541][T23995] erspan0: entered promiscuous mode [ 655.451076][T24015] mac80211_hwsim hwsim28 syzkaller0: entered promiscuous mode [ 655.477182][T24015] mac80211_hwsim hwsim28 syzkaller0: entered allmulticast mode [ 655.506134][T24017] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 655.552810][T24017] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 656.358780][T24079] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 656.375382][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.693917][T24084] bond15: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-xor(2) [ 656.769219][T24101] siw: device registration error -23 [ 656.829745][T24084] bond15 (unregistering): Released all slaves [ 657.413568][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 657.504290][T24133] xt_hashlimit: size too large, truncated to 1048576 [ 657.507265][T24135] syzkaller0: entered promiscuous mode [ 657.537700][T24135] syzkaller0: entered allmulticast mode [ 657.620816][T24140] netlink: 'syz.2.5039': attribute type 10 has an invalid length. [ 657.637596][T24135] tipc: Enabled bearer , priority 0 [ 657.672127][T24145] netlink: 'syz.2.5039': attribute type 10 has an invalid length. [ 657.696919][T24129] tipc: Resetting bearer [ 657.737351][ T8473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 657.758012][T24129] tipc: Disabling bearer [ 657.838059][T24147] __nla_validate_parse: 47 callbacks suppressed [ 657.838079][T24147] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5041'. [ 657.922386][T24148] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5041'. [ 657.961784][T24147] syzkaller1: entered promiscuous mode [ 657.989244][T24147] syzkaller1: entered allmulticast mode [ 658.227708][T24166] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5047'. [ 658.378860][T21970] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.453770][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.774086][T24184] netlink: 64985 bytes leftover after parsing attributes in process `syz.2.5051'. [ 659.071177][T24195] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5057'. [ 659.097145][T24195] nbd: illegal input index -8454144 [ 659.108459][T24196] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5057'. [ 659.135807][T24196] nbd: illegal input index -8454144 [ 659.205380][T24195] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5057'. [ 659.280808][T24208] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 659.370272][T24211] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5061'. [ 659.400882][T24211] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5061'. [ 659.425587][T24211] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5061'. [ 659.493891][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.570850][T24211] syzkaller0: entered promiscuous mode [ 659.593940][T24211] syzkaller0: entered allmulticast mode [ 659.899607][T24239] netlink: 'syz.3.5069': attribute type 1 has an invalid length. [ 660.022045][T24252] sctp: [Deprecated]: syz.2.5070 (pid 24252) Use of struct sctp_assoc_value in delayed_ack socket option. [ 660.022045][T24252] Use struct sctp_sack_info instead [ 660.048990][T24252] xt_CT: You must specify a L4 protocol and not use inversions on it [ 660.067259][T24239] bond10: option mode: invalid value (8) [ 660.096740][T24239] bond10 (unregistering): Released all slaves [ 660.249692][T24249] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 660.369292][T24242] bond7: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 660.396099][T24242] bond7 (unregistering): Released all slaves [ 660.495687][T24269] netlink: 'syz.0.5073': attribute type 1 has an invalid length. [ 660.538768][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.630183][T24269] 8021q: adding VLAN 0 to HW filter on device bond15 [ 661.574025][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.903682][ T30] audit: type=1800 audit(1784608011.050:22): pid=24328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.5087" name=680B20 dev="tmpfs" ino=2363 res=0 errno=0 [ 662.285446][T24353] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 662.348379][T24353] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 662.406137][T24352] sit0: entered promiscuous mode [ 662.571107][T24366] xt_hashlimit: size too large, truncated to 1048576 [ 662.582593][T24368] netlink: 'syz.0.5100': attribute type 2 has an invalid length. [ 662.594641][T24368] netlink: 'syz.0.5100': attribute type 11 has an invalid length. [ 662.614437][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.943657][T24384] bond10: option packets_per_slave: invalid value (18446744073709551615) [ 662.954417][T24384] bond10: option packets_per_slave: allowed values 0 - 65535 [ 662.986324][T24384] bond10 (unregistering): Released all slaves [ 662.988505][T24391] __nla_validate_parse: 7 callbacks suppressed [ 662.988566][T24391] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5108'. [ 663.341244][T24404] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5113'. [ 663.495434][T21970] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 663.653683][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 663.762375][T24424] IPVS: set_ctl: invalid protocol: 255 172.20.20.187:20000 [ 663.940472][T24435] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5124'. [ 663.949773][T24434] netlink: 'syz.3.5124': attribute type 1 has an invalid length. [ 664.047050][T24434] netlink: 'syz.3.5124': attribute type 3 has an invalid length. [ 664.079627][T24434] netlink: 172 bytes leftover after parsing attributes in process `syz.3.5124'. [ 664.109612][T24434] NCSI netlink: No device for ifindex 813332851 [ 664.135023][T22618] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.319402][T24458] erspan0: entered allmulticast mode [ 664.335379][T24459] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5129'. [ 664.376262][T24459] ip6gre1: entered promiscuous mode [ 664.393249][T24459] ip6gre1: entered allmulticast mode [ 664.410962][T24461] netlink: 108 bytes leftover after parsing attributes in process `syz.4.5132'. [ 664.422867][T24462] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5130'. [ 664.447935][T24472] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5134'. [ 664.695830][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.711280][T24480] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5138'. [ 664.738620][T24483] syzkaller0: entered promiscuous mode [ 664.746868][T24483] syzkaller0: entered allmulticast mode [ 664.935012][T24495] netlink: 'syz.1.5142': attribute type 1 has an invalid length. [ 664.961658][T24495] netlink: 'syz.1.5142': attribute type 4 has an invalid length. [ 664.980144][T24494] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5144'. [ 665.166828][T24494] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.220061][T24509] netlink: 'syz.0.5145': attribute type 1 has an invalid length. [ 665.356276][T24509] bond16: peer notification delay (25) is not a multiple of miimon (6149), value rounded to 0 ms [ 665.367966][T24509] bond16: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 665.386657][T24509] bond16 (unregistering): Released all slaves [ 665.435278][T24520] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 665.625042][T24529] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 665.736044][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.308161][T24562] xt_hashlimit: max too large, truncated to 1048576 [ 666.362784][T24562] No such timeout policy "syz1" [ 666.484658][T24578] tipc: Enabled bearer , priority 0 [ 666.571248][T24586] siw: device registration error -23 [ 666.610205][T24588] netlink: 'syz.3.5169': attribute type 1 has an invalid length. [ 666.631762][T24588] netlink: 'syz.3.5169': attribute type 2 has an invalid length. [ 666.649930][T24578] syzkaller0: entered promiscuous mode [ 666.657189][T24578] syzkaller0: entered allmulticast mode [ 666.664208][T24578] tipc: Resetting bearer [ 666.693358][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 666.768456][T24586] 8021q: adding VLAN 0 to HW filter on device bond7 [ 666.781996][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.797017][T24577] tipc: Resetting bearer [ 667.098724][T24611] ieee802154 phy0 wpan0: encryption failed: -22 [ 667.815998][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 668.868914][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 668.971959][T24635] netlink: 'syz.4.5181': attribute type 4 has an invalid length. [ 669.262070][ T8473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.900794][T21970] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.904795][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 669.916217][ C1] bridge0: topology change detected, propagating [ 669.924590][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.498059][T24577] tipc: Disabling bearer [ 670.822836][T24647] ip6t_srh: unknown srh match flags 4000 [ 670.847384][T24647] ip6tnl0: entered promiscuous mode [ 670.868193][T24647] ip6tnl0: entered allmulticast mode [ 670.907546][T24647] __nla_validate_parse: 3 callbacks suppressed [ 670.907585][T24647] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5186'. [ 670.935373][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.305329][T24668] netlink: 220 bytes leftover after parsing attributes in process `syz.4.5193'. [ 671.324977][T24669] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5191'. [ 671.334353][T24665] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5192'. [ 671.542041][T24680] x_tables: duplicate underflow at hook 1 [ 671.768479][T24694] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5200'. [ 671.911619][T24703] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5201'. [ 671.964409][T24705] bridge_slave_1: left promiscuous mode [ 671.977190][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.995055][T24705] bridge0: port 2(bridge_slave_1) entered disabled state [ 672.027970][T24705] bridge_slave_0: left allmulticast mode [ 672.040082][T24705] bridge_slave_0: left promiscuous mode [ 672.047144][T24705] bridge0: port 1(bridge_slave_0) entered disabled state [ 672.066436][T24709] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 672.282875][T24722] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5210'. [ 672.294158][T24722] netlink: 'syz.2.5210': attribute type 1 has an invalid length. [ 672.302124][T24722] netlink: 'syz.2.5210': attribute type 2 has an invalid length. [ 672.468430][T24722] bond8: (slave bond_slave_1): Device is not our slave [ 672.499761][T24722] bond8: option active_slave: invalid value (bond_slave_1) [ 672.527263][T24722] bond8 (unregistering): Released all slaves [ 672.920254][T24752] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5215'. [ 672.931371][T24751] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5218'. [ 673.021934][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 673.137742][T24760] netlink: 'syz.0.5222': attribute type 1 has an invalid length. [ 673.182828][T24760] 8021q: adding VLAN 0 to HW filter on device bond16 [ 673.375796][T24768] bond4: Removing last arp target with arp_interval on [ 673.434030][T24780] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5227'. [ 673.459542][T24764] bond0: Error: Cannot enslave bond to itself. [ 674.057092][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.996039][T24855] netlink: 'syz.0.5252': attribute type 1 has an invalid length. [ 675.016629][T21970] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.025999][T22621] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.078905][T24857] bond13: (slave veth0_to_bond): Releasing active interface [ 675.095309][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.116497][T24857] bond17: (slave veth0_to_bond): making interface the new active one [ 675.127249][T24857] bond17: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 675.168673][T24855] netlink: 'syz.0.5252': attribute type 10 has an invalid length. [ 675.291328][T24855] team0: Port device geneve1 added [ 675.552554][T24877] syzkaller0: entered promiscuous mode [ 675.566683][T24877] syzkaller0: entered allmulticast mode [ 675.767669][T24890] netlink: 'syz.1.5264': attribute type 16 has an invalid length. [ 675.794781][T24890] netlink: 'syz.1.5264': attribute type 3 has an invalid length. [ 676.135313][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.292593][T24912] __nla_validate_parse: 10 callbacks suppressed [ 676.292615][T24912] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5271'. [ 676.368878][T24922] x_tables: duplicate underflow at hook 1 [ 676.599056][T24912] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5271'. [ 676.622730][T24923] netlink: 'syz.0.5270': attribute type 20 has an invalid length. [ 676.646049][T24923] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5270'. [ 676.671482][T24921] netlink: 'syz.2.5273': attribute type 1 has an invalid length. [ 676.679702][T24923] netlink: 'syz.0.5270': attribute type 20 has an invalid length. [ 676.707457][T24923] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5270'. [ 676.749407][T24921] 8021q: adding VLAN 0 to HW filter on device bond8 [ 676.812057][T24931] netlink: 59 bytes leftover after parsing attributes in process `syz.3.5274'. [ 676.880518][T24931] xt_TCPMSS: Only works on TCP SYN packets [ 677.080175][T24944] netlink: 156 bytes leftover after parsing attributes in process `syz.4.5278'. [ 677.175972][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.192605][T24948] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5281'. [ 677.336381][T24958] xt_bpf: check failed: parse error [ 677.470757][T24962] validate_nla: 1 callbacks suppressed [ 677.470778][T24962] netlink: 'syz.0.5287': attribute type 30 has an invalid length. [ 677.530600][T24969] netlink: 1 bytes leftover after parsing attributes in process `syz.2.5290'. [ 677.541059][T24969] xt_policy: neither incoming nor outgoing policy selected [ 677.571773][T24966] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5289'. [ 677.900000][T24985] xt_hashlimit: size too large, truncated to 1048576 [ 677.934144][T24994] netlink: 'syz.0.5294': attribute type 1 has an invalid length. [ 678.021721][T24991] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5297'. [ 678.080130][T25001] netlink: 'syz.2.5298': attribute type 1 has an invalid length. [ 678.213872][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.249860][T24994] 8021q: adding VLAN 0 to HW filter on device bond19 [ 678.333779][T24991] bridge4: entered promiscuous mode [ 678.353842][T24991] bridge4: entered allmulticast mode [ 678.482860][T25001] 8021q: adding VLAN 0 to HW filter on device bond9 [ 678.504484][T25007] vlan2: entered promiscuous mode [ 678.509630][T25007] bond9: entered promiscuous mode [ 678.515566][T25007] vlan2: entered allmulticast mode [ 678.520793][T25007] bond9: entered allmulticast mode [ 678.578618][T25020] netlink: 'syz.3.5303': attribute type 10 has an invalid length. [ 678.592940][T25009] bond9: (slave bridge5): making interface the new active one [ 678.601448][T25009] bridge5: entered promiscuous mode [ 678.607512][T25009] bridge5: entered allmulticast mode [ 678.618536][T25009] bond9: (slave bridge5): Enslaving as an active interface with an up link [ 678.732898][T25020] geneve1: entered promiscuous mode [ 678.761820][T25020] team0: Port device geneve1 added [ 679.255578][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 679.287096][T25040] netlink: 'syz.2.5309': attribute type 1 has an invalid length. [ 679.306008][T25041] netlink: 'syz.0.5310': attribute type 12 has an invalid length. [ 679.511320][T25040] 8021q: adding VLAN 0 to HW filter on device bond10 [ 679.648705][T25050] netlink: 'syz.0.5311': attribute type 1 has an invalid length. [ 679.720086][T25050] bond20: entered promiscuous mode [ 679.734941][T25050] 8021q: adding VLAN 0 to HW filter on device bond20 [ 680.114343][T22622] netdevsim netdevsim2 : set [0, 0] type 1 family 0 port 8472 - 0 [ 680.141461][T22622] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.152167][T22621] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.164785][T22616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.194189][T22622] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.227143][T22622] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.293490][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.925122][T25098] syz.1.5322: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 681.030703][T25098] CPU: 0 UID: 0 PID: 25098 Comm: syz.1.5322 Not tainted syzkaller #0 PREEMPT(full) [ 681.030738][T25098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 681.030753][T25098] Call Trace: [ 681.030763][T25098] [ 681.030773][T25098] dump_stack_lvl+0xe8/0x150 [ 681.030892][T25098] warn_alloc+0x24c/0x270 [ 681.030924][T25098] ? stack_depot_save_flags+0x33/0x800 [ 681.030957][T25098] ? __pfx_warn_alloc+0x10/0x10 [ 681.030986][T25098] ? kasan_save_track+0x3e/0x80 [ 681.031014][T25098] ? __kasan_kmalloc+0x93/0xb0 [ 681.031044][T25098] ? xsk_setsockopt+0x52a/0x960 [ 681.031075][T25098] ? do_sock_setsockopt+0x17c/0x1b0 [ 681.031108][T25098] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 681.031140][T25098] ? do_syscall_64+0x174/0x580 [ 681.031161][T25098] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.031197][T25098] __vmalloc_node_range_noprof+0x12c/0x1730 [ 681.031256][T25098] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 681.031290][T25098] ? __kasan_kmalloc+0x93/0xb0 [ 681.031321][T25098] ? __kmalloc_cache_noprof+0x32d/0x660 [ 681.031351][T25098] ? __kmalloc_cache_noprof+0x150/0x660 [ 681.031383][T25098] vmalloc_user_noprof+0xad/0xe0 [ 681.031412][T25098] ? xskq_create+0xbf/0x170 [ 681.031446][T25098] xskq_create+0xbf/0x170 [ 681.031484][T25098] xsk_init_queue+0x8a/0xe0 [ 681.031519][T25098] xsk_setsockopt+0x52a/0x960 [ 681.031550][T25098] ? __fget_files+0x2a/0x420 [ 681.031582][T25098] ? __pfx_xsk_setsockopt+0x10/0x10 [ 681.031618][T25098] ? __pfx_aa_sk_perm+0x10/0x10 [ 681.031668][T25098] ? aa_sock_opt_perm+0xff/0x1a0 [ 681.031695][T25098] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 681.031720][T25098] ? __pfx_xsk_setsockopt+0x10/0x10 [ 681.031752][T25098] do_sock_setsockopt+0x17c/0x1b0 [ 681.031794][T25098] __x64_sys_setsockopt+0x13d/0x1b0 [ 681.031831][T25098] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.031858][T25098] do_syscall_64+0x174/0x580 [ 681.031878][T25098] ? trace_irq_disable+0x3b/0x140 [ 681.031907][T25098] ? clear_bhb_loop+0x40/0x90 [ 681.031936][T25098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.031960][T25098] RIP: 0033:0x7fad7a79de99 [ 681.031983][T25098] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 681.032003][T25098] RSP: 002b:00007fad7b58e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 681.032029][T25098] RAX: ffffffffffffffda RBX: 00007fad7aa25fa0 RCX: 00007fad7a79de99 [ 681.032045][T25098] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 681.032059][T25098] RBP: 00007fad7a833eaf R08: 0000000000000004 R09: 0000000000000000 [ 681.032074][T25098] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 681.032090][T25098] R13: 00007fad7aa26038 R14: 00007fad7aa25fa0 R15: 00007fff56c83678 [ 681.032128][T25098] [ 681.318684][T25098] Mem-Info: [ 681.321927][T25098] active_anon:5854 inactive_anon:0 isolated_anon:0 [ 681.321927][T25098] active_file:3 inactive_file:43350 isolated_file:0 [ 681.321927][T25098] unevictable:768 dirty:114 writeback:6 [ 681.321927][T25098] slab_reclaimable:11615 slab_unreclaimable:115130 [ 681.321927][T25098] mapped:30619 shmem:1295 pagetables:1626 [ 681.321927][T25098] sec_pagetables:0 bounce:0 [ 681.321927][T25098] kernel_misc_reclaimable:0 [ 681.321927][T25098] free:1302787 free_pcp:9204 free_cma:0 [ 681.368301][T25098] Node 0 active_anon:23416kB inactive_anon:0kB active_file:12kB inactive_file:173192kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122676kB dirty:456kB writeback:24kB shmem:3644kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15576kB pagetables:6384kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 681.403921][T25098] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 681.438124][T25098] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 681.471018][T25098] lowmem_reserve[]: 0 2488 2489 2489 2489 [ 681.477658][T25098] Node 0 DMA32 free:1253780kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23416kB inactive_anon:0kB active_file:12kB inactive_file:173192kB unevictable:1536kB writepending:480kB zspages:0kB present:3129332kB managed:2548684kB mlocked:0kB bounce:0kB free_pcp:36528kB local_pcp:21552kB free_cma:0kB [ 681.512282][T25098] lowmem_reserve[]: 0 0 0 0 0 [ 681.517745][T25098] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:260kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 681.548506][T25098] lowmem_reserve[]: 0 0 0 0 0 [ 681.554304][T25098] Node 1 Normal free:3942008kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 681.587606][T25098] lowmem_reserve[]: 0 0 0 0 0 [ 681.592431][T25098] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 681.607788][T25098] Node 0 DMA32: 1395*4kB (UME) 629*8kB (UME) 525*16kB (UME) 161*32kB (UME) 363*64kB (UME) 541*128kB (UME) 400*256kB (UME) 257*512kB (UM) 124*1024kB (UM) 7*2048kB (UM) 186*4096kB (UM) = 1253796kB [ 681.628623][T25098] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 681.641055][T25098] Node 1 Normal: 2*4kB (UM) 2*8kB (UM) 6*16kB (UM) 8*32kB (UM) 8*64kB (UM) 4*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 961*4096kB (M) = 3942008kB [ 681.659110][T25098] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 681.684125][T25098] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 681.709290][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.718951][T25092] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 681.767597][T25098] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 681.828349][T16454] speed is unknown, defaulting to 1000 [ 681.841684][T16454] sy2: Port: 1 Link DOWN [ 681.847730][T25098] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 681.929104][T25098] 45142 total pagecache pages [ 681.974968][T25098] 0 pages in swap cache [ 681.994021][T25098] Free swap = 124996kB [ 682.015738][T25098] Total swap = 124996kB [ 682.025224][T25125] __nla_validate_parse: 5 callbacks suppressed [ 682.025243][T25125] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5325'. [ 682.027156][T25126] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5326'. [ 682.055697][T25098] 2097051 pages RAM [ 682.069505][T25098] 0 pages HighMem/MovableOnly [ 682.089423][T25098] 428200 pages reserved [ 682.102719][T25098] 0 pages cma reserved [ 682.131111][T25126] netlink: 'syz.2.5326': attribute type 6 has an invalid length. [ 682.290332][T25128] bridge_slave_1: left allmulticast mode [ 682.298171][T25128] bridge_slave_1: left promiscuous mode [ 682.316157][T25128] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.339104][T25141] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5331'. [ 682.339476][T25128] bridge_slave_0: left allmulticast mode [ 682.372187][T25128] bridge_slave_0: left promiscuous mode [ 682.388518][T25128] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.664647][T25154] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5330'. [ 682.775664][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.991668][T25144] netlink: 'syz.1.5332': attribute type 12 has an invalid length. [ 683.287152][T25167] netlink: 'syz.3.5338': attribute type 21 has an invalid length. [ 683.310746][T25167] netlink: 128 bytes leftover after parsing attributes in process `syz.3.5338'. [ 683.348795][T25167] netlink: 'syz.3.5338': attribute type 4 has an invalid length. [ 683.388636][T25167] netlink: 'syz.3.5338': attribute type 5 has an invalid length. [ 683.407069][T25167] netlink: 3 bytes leftover after parsing attributes in process `syz.3.5338'. [ 683.434050][T25171] netlink: 'syz.1.5340': attribute type 1 has an invalid length. [ 683.479934][T25171] netlink: 5120 bytes leftover after parsing attributes in process `syz.1.5340'. [ 683.767456][T25196] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5346'. [ 683.821061][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.968326][T25205] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5349'. [ 683.985922][T25206] netlink: 336 bytes leftover after parsing attributes in process `syz.2.5349'. [ 684.382859][T25200] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.726592][T25200] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 684.781735][T25239] sctp_setsockopt_maxburst: 23 callbacks suppressed [ 684.781854][T25239] sctp: [Deprecated]: syz.4.5359 (pid 25239) Use of int in max_burst socket option deprecated. [ 684.781854][T25239] Use struct sctp_assoc_value instead [ 684.861840][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.186738][T25257] tipc: Enabled bearer , priority 0 [ 685.257208][T22617] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.306010][T25257] tipc: Disabling bearer [ 685.516956][T25280] tc_dump_action: action bad kind [ 685.770243][T25296] openvswitch: netlink: Unknown key attributes 20 [ 685.883488][T25302] syzkaller0: entered promiscuous mode [ 685.894879][T25302] syzkaller0: entered allmulticast mode [ 685.898385][T22618] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.908715][T22618] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.820009][T25360] veth0_macvtap: left promiscuous mode [ 686.934913][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.246621][T25388] __nla_validate_parse: 7 callbacks suppressed [ 687.246645][T25388] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5405'. [ 687.390137][T25392] syzkaller1: entered promiscuous mode [ 687.397362][T25392] syzkaller1: entered allmulticast mode [ 687.409235][T25396] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5406'. [ 687.646051][T25402] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 687.727891][T25405] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5409'. [ 687.755546][T25410] xt_l2tp: v2 tid > 0xffff: 1114244 [ 687.801034][T25410] veth1_to_team: entered promiscuous mode [ 687.824328][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 687.942041][T25405] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5409'. [ 687.982230][T25416] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5412'. [ 687.992050][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.051525][T22618] batadv1: left allmulticast mode [ 688.070786][T22618] batadv1: left promiscuous mode [ 688.082562][T22618] bridge0: port 3(batadv1) entered disabled state [ 688.110010][T22618] bridge_slave_1: left allmulticast mode [ 688.133588][T22618] bridge_slave_1: left promiscuous mode [ 688.141219][T22618] bridge0: port 2(bridge_slave_1) entered disabled state [ 688.172058][T22618] bridge_slave_0: left allmulticast mode [ 688.185768][T22618] bridge_slave_0: left promiscuous mode [ 688.209202][T22618] bridge0: port 1(bridge_slave_0) entered disabled state [ 689.104028][T22618] pim6reg: left allmulticast mode [ 689.109302][T22618] dvmrp8: left allmulticast mode [ 689.256921][T22618] bond3 (unregistering): (slave ip6gretap1): Releasing active interface [ 689.435838][T22618] gretap0 (unregistering): left promiscuous mode [ 689.769395][T22618] bond6 (unregistering): (slave bridge7): Releasing backup interface [ 689.778314][T22618] bridge7 (unregistering): left promiscuous mode [ 689.809890][T22618] bond0 (unregistering): left promiscuous mode [ 689.816406][T22618] bond_slave_0: left promiscuous mode [ 689.822152][T22618] bond_slave_1: left promiscuous mode [ 689.846045][T22618] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 689.859325][T22618] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 689.872510][T22618] bond0 (unregistering): Released all slaves [ 689.887716][T22618] bond1 (unregistering): (slave veth5): Releasing backup interface [ 689.899174][T22618] bond1 (unregistering): Released all slaves [ 689.918127][T22618] bond2 (unregistering): Released all slaves [ 689.936570][T22618] bond3 (unregistering): Released all slaves [ 689.959662][T22618] bond4 (unregistering): Released all slaves [ 689.980007][T22618] bond5 (unregistering): (slave veth0_to_bond): Releasing active interface [ 689.991955][T22618] bond5 (unregistering): Released all slaves [ 690.010109][T22618] bond6 (unregistering): Released all slaves [ 690.326068][T25434] sctp: [Deprecated]: syz.4.5416 (pid 25434) Use of int in maxseg socket option. [ 690.326068][T25434] Use struct sctp_assoc_value instead [ 690.392461][T25441] xt_recent: Unsupported userspace flags (000000b1) [ 691.101526][T25474] netlink: 170676 bytes leftover after parsing attributes in process `syz.0.5427'. [ 691.138483][T25474] openvswitch: netlink: ufid size 41726 bytes exceeds the range (1, 16) [ 691.159519][T25474] openvswitch: netlink: Message has 512 unknown bytes. [ 691.167993][T25475] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5426'. [ 691.204249][T25475] netlink: 96 bytes leftover after parsing attributes in process `syz.4.5426'. [ 691.339709][T25475] 8021q: VLANs not supported on gre0 [ 691.624807][T25497] xt_TCPMSS: Only works on TCP SYN packets [ 691.802103][T22618] hsr_slave_0: left promiscuous mode [ 691.824752][T22618] hsr_slave_1: left promiscuous mode [ 691.902124][T25517] netlink: 'syz.2.5441': attribute type 1 has an invalid length. [ 691.915113][T22618] veth1_vlan: left promiscuous mode [ 692.741000][T25548] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.5445'. [ 692.851936][T25549] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.5445'. [ 693.099259][T25557] netlink: 'syz.4.5447': attribute type 1 has an invalid length. [ 693.132183][T25561] IPVS: set_ctl: invalid protocol: 22 255.255.255.255:20003 [ 693.298232][T25561] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5449'. [ 693.418593][T25574] netlink: 'syz.4.5451': attribute type 16 has an invalid length. [ 693.484592][T25574] netlink: 'syz.4.5451': attribute type 3 has an invalid length. [ 693.510643][T25574] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5451'. [ 693.860923][T25595] netlink: 'syz.3.5458': attribute type 2 has an invalid length. [ 694.009248][T22618] IPVS: stop unused estimator thread 0... [ 694.382767][T25609] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 694.449431][T25609] netdevsim netdevsim0 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 694.478153][T25626] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5467'. [ 694.506577][T25609] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 694.834076][T25639] netdevsim netdevsim4 : renamed from netdevsim0 [ 694.890874][T25642] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5470'. [ 694.927575][T25635] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5468'. [ 694.958260][T25631] syzkaller0: entered promiscuous mode [ 694.965607][T25631] syzkaller0: entered allmulticast mode [ 695.105418][T25659] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5472'. [ 695.189198][T25614] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 695.236499][T25614] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 695.258556][T25614] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.325855][T25670] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5474'. [ 695.376943][T25672] netlink: 'syz.2.5474': attribute type 2 has an invalid length. [ 695.608376][T25684] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5476'. [ 696.133707][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 698.501843][T25684] team0 (unregistering): Port device team_slave_1 removed [ 698.565336][T25684] team0 (unregistering): Port device dummy0 removed [ 698.640436][T25684] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.690132][T25614] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 698.702555][T25614] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 698.714599][T25614] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.939822][T25614] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 698.954784][T25614] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 698.967103][T25614] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.057914][T25723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5483'. [ 699.090720][T25723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5483'. [ 699.138583][T25723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5483'. [ 699.199239][T25723] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5483'. [ 699.280794][T22616] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.298456][T22616] netdevsim netdevsim0 eth0: set [0, 1] type 1 family 0 port 2816 - 0 [ 699.321140][T22616] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.382935][T25739] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5486'. [ 699.486317][T25738] bond11 (unregistering): Released all slaves [ 699.521878][T22616] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.531336][T22616] netdevsim netdevsim0 eth1: set [0, 1] type 1 family 0 port 2816 - 0 [ 699.540590][T22616] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.590272][T25744] nftables ruleset with unbound set [ 699.707704][T21971] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.722951][T21971] netdevsim netdevsim0 eth2: set [0, 1] type 1 family 0 port 2816 - 0 [ 699.736578][T21971] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.775358][T25752] IPv6: NLM_F_CREATE should be specified when creating new route [ 699.794583][T25752] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 699.802051][T25752] IPv6: NLM_F_CREATE should be set when creating new route [ 699.815842][T25754] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.5489'. [ 699.832014][T25754] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5489'. [ 699.849402][T25752] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 699.856862][T25752] IPv6: NLM_F_CREATE should be set when creating new route [ 699.882550][T25756] netlink: 256 bytes leftover after parsing attributes in process `syz.3.5490'. [ 699.960353][T25752] bond11: option packets_per_slave: invalid value (18446744073709551615) [ 699.970706][T25752] bond11: option packets_per_slave: allowed values 0 - 65535 [ 699.996625][T25752] bond11 (unregistering): Released all slaves [ 700.136833][T21971] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 700.156660][T21971] netdevsim netdevsim0 eth3: set [0, 1] type 1 family 0 port 2816 - 0 [ 700.201891][T21971] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 700.486306][T25787] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5499'. [ 700.607388][T25798] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5500'. [ 700.970305][T25817] IPv6: sit3: Disabled Multicast RS [ 700.990069][T25816] netlink: 'syz.2.5505': attribute type 1 has an invalid length. [ 701.004313][T25816] netlink: 'syz.2.5505': attribute type 2 has an invalid length. [ 701.065118][T25816] bridge0: port 2(bridge_slave_1) entered disabled state [ 701.074873][T25816] bridge0: port 1(bridge_slave_0) entered disabled state [ 701.522542][T25845] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 701.567422][T25848] sctp: [Deprecated]: syz.1.5514 (pid 25848) Use of struct sctp_assoc_value in delayed_ack socket option. [ 701.567422][T25848] Use struct sctp_sack_info instead [ 701.613988][T25848] sctp: [Deprecated]: syz.1.5514 (pid 25848) Use of int in max_burst socket option deprecated. [ 701.613988][T25848] Use struct sctp_assoc_value instead [ 701.637326][T25851] xfrm0 speed is unknown, defaulting to 1000 [ 701.665785][T25851] speed is unknown, defaulting to 1000 [ 701.814069][T25855] syzkaller0: entered promiscuous mode [ 701.820912][T25855] syzkaller0: entered allmulticast mode [ 702.321698][T25882] bridge0: port 2(bridge_slave_1) entered blocking state [ 702.329035][T25882] bridge0: port 2(bridge_slave_1) entered listening state [ 702.338405][T25882] bridge0: port 1(bridge_slave_0) entered blocking state [ 702.345643][T25882] bridge0: port 1(bridge_slave_0) entered listening state [ 702.458221][T25882] bridge0: port 2(bridge_slave_1) entered disabled state [ 702.465658][T25882] bridge0: port 1(bridge_slave_0) entered disabled state [ 702.668693][T25901] v: renamed from dummy0 (while UP) [ 702.822931][T25911] gretap0: entered promiscuous mode [ 702.959179][T25916] netlink: 'syz.3.5532': attribute type 1 has an invalid length. [ 702.985766][T25914] netlink: 'syz.3.5532': attribute type 1 has an invalid length. [ 703.101040][T25921] bond2: (slave veth0_to_bond): Releasing active interface [ 703.141209][T25921] bond2: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 703.248940][T25921] bond10: (slave veth0_to_bond): making interface the new active one [ 703.295140][T25921] bond10: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 703.692991][T25947] netlink: 'syz.1.5540': attribute type 1 has an invalid length. [ 703.870024][T25945] xfrm0 speed is unknown, defaulting to 1000 [ 704.008142][T25945] speed is unknown, defaulting to 1000 [ 704.361606][T25979] __nla_validate_parse: 16 callbacks suppressed [ 704.361629][T25979] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5548'. [ 704.419089][T25983] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5549'. [ 704.478734][T25979] netlink: 'syz.2.5548': attribute type 1 has an invalid length. [ 704.621666][ T5632] block nbd3: Receive control failed (result -32) [ 704.630450][T25992] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5548'. [ 704.811053][T25987] geneve3: entered promiscuous mode [ 705.351551][ T5287] veth0_vlan: left promiscuous mode [ 705.379847][T25118] veth0_vlan: entered promiscuous mode [ 749.256065][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 754.373396][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 761.350369][T26131] netlink: 388 bytes leftover after parsing attributes in process `syz.2.5566'. [ 761.378816][T26131] netlink: 'syz.2.5566': attribute type 2 has an invalid length. [ 761.441149][T26131] : entered promiscuous mode [ 761.776825][T26152] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5571'. [ 762.011676][T26167] netlink: 'syz.1.5574': attribute type 4 has an invalid length. [ 762.116970][T26171] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5576'. [ 762.194309][T26171] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5576'. [ 762.639894][T26193] bridge_slave_1: left allmulticast mode [ 762.667151][T26193] bridge_slave_1: left promiscuous mode [ 762.688719][T26193] bridge0: port 2(bridge_slave_1) entered disabled state [ 762.773969][T26193] bridge_slave_0: left allmulticast mode [ 762.780123][T26193] bridge_slave_0: left promiscuous mode [ 762.789146][T26193] bridge0: port 1(bridge_slave_0) entered disabled state [ 762.927032][T26205] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5586'. [ 763.036439][T26209] netlink: 'syz.1.5587': attribute type 1 has an invalid length. [ 763.096104][T26209] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5587'. [ 763.127474][T26213] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5589'. [ 763.137560][T26209] netlink: 'syz.1.5587': attribute type 10 has an invalid length. [ 763.150471][T26209] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5587'. [ 763.165725][T26219] netlink: 'syz.1.5587': attribute type 39 has an invalid length. [ 763.476980][T26237] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5597'. [ 763.704818][T26236] syzkaller0: entered promiscuous mode [ 763.710538][T26236] syzkaller0: entered allmulticast mode [ 763.747441][T26236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5595'. [ 766.837041][T26302] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5614'. [ 767.007519][T26311] netlink: 'syz.3.5618': attribute type 1 has an invalid length. [ 767.147933][T26322] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5620'. [ 767.157337][T26322] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5620'. [ 767.327431][T26339] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5624'. [ 767.381215][T26343] gretap0: left promiscuous mode [ 767.458724][T26344] netlink: 'syz.0.5626': attribute type 83 has an invalid length. [ 767.790654][T26343] team_slave_1: left promiscuous mode [ 767.801879][T26343] team_slave_1: left allmulticast mode [ 767.877625][T26343] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 768.116778][T26343] veth0_macvtap: left allmulticast mode [ 768.129390][T26361] netlink: 100 bytes leftover after parsing attributes in process `syz.2.5629'. [ 768.256056][T26343] gretap1: left promiscuous mode [ 768.261154][T26343] gretap1: left allmulticast mode [ 768.269118][T26343] gretap2: left promiscuous mode [ 768.274849][T26343] ip6gre1: left allmulticast mode [ 768.301680][T26343] h: left promiscuous mode [ 768.340355][T26343] ip6erspan1: left allmulticast mode [ 768.349093][T26343] bond12: left promiscuous mode [ 768.358363][T26343] veth3: left allmulticast mode [ 768.365989][T26343] bond14: left promiscuous mode [ 768.370903][T26343] bridge4: left promiscuous mode [ 768.393903][T26343] bond20: left promiscuous mode [ 768.437997][T22618] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.489799][T22618] netdevsim netdevsim0 eth0: unset [0, 1] type 1 family 0 port 2816 - 0 [ 768.537971][T22618] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.587490][T22618] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.624075][T22618] netdevsim netdevsim0 eth1: unset [0, 1] type 1 family 0 port 2816 - 0 [ 768.641737][T22618] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.668017][T22618] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.696002][T22618] netdevsim netdevsim0 eth2: unset [0, 1] type 1 family 0 port 2816 - 0 [ 768.707092][T26373] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5633'. [ 768.722427][T22618] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.792486][T22618] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.817306][T22618] netdevsim netdevsim0 eth3: unset [0, 1] type 1 family 0 port 2816 - 0 [ 768.828994][T22618] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.848808][T26377] : renamed from bond_slave_0 (while UP) [ 768.972150][T26385] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5636'. [ 769.211809][T26399] netlink: zone id is out of range [ 769.221990][T26399] netlink: del zone limit has 4 unknown bytes [ 769.246040][T26399] netlink: 'syz.4.5641': attribute type 49 has an invalid length. [ 769.271872][T26399] netlink: zone id is out of range [ 769.298436][T26399] netlink: del zone limit has 4 unknown bytes [ 769.571139][T26419] netlink: 112 bytes leftover after parsing attributes in process `syz.3.5645'. [ 769.715246][T26431] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5649'. [ 769.995756][T26446] netlink: 'syz.2.5652': attribute type 1 has an invalid length. [ 770.140339][T26460] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5656'. [ 770.154259][T26460] netlink: 'syz.3.5656': attribute type 3 has an invalid length. [ 770.165004][T26460] netlink: 'syz.3.5656': attribute type 2 has an invalid length. [ 770.176750][T26450] bond4: (slave veth0_to_bond): Releasing active interface [ 770.185067][T26450] veth0_to_bond: left promiscuous mode [ 770.190808][T26450] veth0_to_bond: left allmulticast mode [ 770.201242][T26450] bond11: (slave veth0_to_bond): making interface the new active one [ 770.210966][T26450] bond11: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 770.258477][T26446] macvlan1: entered promiscuous mode [ 770.270309][T26446] macvlan1: entered allmulticast mode [ 770.281284][T26446] bond11: entered promiscuous mode [ 770.287051][T26446] veth0_to_bond: entered promiscuous mode [ 770.298057][T26446] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 770.310067][T26446] bond11: (slave macvlan1): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 770.327649][T26446] bond11: left promiscuous mode [ 770.332647][T26446] veth0_to_bond: left promiscuous mode [ 770.696027][T21970] bond0: (slave bond_slave_0): link status definitely up [ 770.723276][T21970] bond0: active interface up! [ 771.228374][T26529] vlan0: entered promiscuous mode [ 771.464199][T26539] bond0: option miimon: invalid value (18446744071829782528) [ 771.477884][T26539] bond0: option miimon: allowed values 0 - 2147483647 [ 771.737414][T26558] syzkaller0: entered promiscuous mode [ 771.749441][T26558] syzkaller0: entered allmulticast mode [ 771.971258][T26569] __nla_validate_parse: 8 callbacks suppressed [ 771.971277][T26569] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5684'. [ 772.020848][T26571] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5685'. [ 772.032481][T26569] bond0: entered promiscuous mode [ 772.064760][T26569] bond_slave_0: entered promiscuous mode [ 772.076672][T26569] bond_slave_1: entered promiscuous mode [ 772.105352][T26569] bond0: left promiscuous mode [ 772.122688][T26569] bond_slave_0: left promiscuous mode [ 772.138873][T26582] netlink: 'syz.4.5687': attribute type 39 has an invalid length. [ 772.149445][T26569] bond_slave_1: left promiscuous mode [ 772.859896][T26625] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 772.888708][T26625] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 773.219889][T26640] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5701'. [ 773.282824][T26651] syzkaller0: entered promiscuous mode [ 773.321256][T26651] syzkaller0: entered allmulticast mode [ 773.510125][T26666] netlink: 'syz.2.5708': attribute type 83 has an invalid length. [ 773.536087][T26666] openvswitch: netlink: nsh attr 109 is out of range max 3 [ 773.646347][T26670] "syz.0.5709" (26670) uses obsolete ecb(arc4) skcipher [ 773.717332][T26676] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5710'. [ 773.909659][T26694] netlink: 'syz.4.5717': attribute type 2 has an invalid length. [ 773.982296][T26699] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5718'. [ 774.283709][T26716] netlink: 'syz.0.5724': attribute type 6 has an invalid length. [ 774.314735][T26716] netlink: 336 bytes leftover after parsing attributes in process `syz.0.5724'. [ 774.596749][T26736] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5729'. [ 774.610054][T26736] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5729'. [ 774.819964][T26752] xt_ecn: cannot match TCP bits for non-tcp packets [ 774.878001][T26761] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5733'. [ 774.951404][T26762] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 774.985180][T26762] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5736'. [ 775.416302][T26781] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 775.451394][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.464247][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.475217][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.491103][T26787] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 775.524966][T26787] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 775.561960][T26787] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 775.620226][T26787] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 775.670023][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.696185][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.711869][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.735754][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.747758][T26787] wlan1 speed is unknown, defaulting to 1000 [ 775.814529][T22616] bond0: (slave bond_slave_1): interface is now up [ 776.232262][T26832] netlink: 'syz.1.5757': attribute type 1 has an invalid length. [ 776.336644][T26838] sctp: [Deprecated]: syz.4.5760 (pid 26838) Use of struct sctp_assoc_value in delayed_ack socket option. [ 776.336644][T26838] Use struct sctp_sack_info instead [ 776.485836][T26844] bond12: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 776.512167][T26844] bond12 (unregistering): Released all slaves [ 776.547503][T26854] netlink: 'syz.4.5763': attribute type 4 has an invalid length. [ 776.611557][T26860] netlink: 'syz.4.5763': attribute type 4 has an invalid length. [ 777.022609][T26866] __nla_validate_parse: 9 callbacks suppressed [ 777.022632][T26866] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5766'. [ 777.041093][T26870] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5768'. [ 777.649082][T26917] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 777.663443][T26917] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 777.684634][T26921] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5781'. [ 778.181342][T26935] netlink: 'syz.3.5787': attribute type 1 has an invalid length. [ 778.199330][T26940] syz.4.5786: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 778.217337][T26940] CPU: 0 UID: 0 PID: 26940 Comm: syz.4.5786 Not tainted syzkaller #0 PREEMPT(full) [ 778.217369][T26940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 778.217384][T26940] Call Trace: [ 778.217394][T26940] [ 778.217404][T26940] dump_stack_lvl+0xe8/0x150 [ 778.217446][T26940] warn_alloc+0x24c/0x270 [ 778.217478][T26940] ? stack_depot_save_flags+0x33/0x800 [ 778.217536][T26940] ? __pfx_warn_alloc+0x10/0x10 [ 778.217567][T26940] ? kasan_save_track+0x3e/0x80 [ 778.217598][T26940] ? __kasan_kmalloc+0x93/0xb0 [ 778.217628][T26940] ? xsk_setsockopt+0x52a/0x960 [ 778.217660][T26940] ? do_sock_setsockopt+0x17c/0x1b0 [ 778.217693][T26940] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 778.217736][T26940] ? do_syscall_64+0x174/0x580 [ 778.217756][T26940] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.217788][T26940] __vmalloc_node_range_noprof+0x12c/0x1730 [ 778.217844][T26940] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 778.217874][T26940] ? __kasan_kmalloc+0x93/0xb0 [ 778.217904][T26940] ? __kmalloc_cache_noprof+0x32d/0x660 [ 778.217930][T26940] ? __kmalloc_cache_noprof+0x150/0x660 [ 778.217960][T26940] vmalloc_user_noprof+0xad/0xe0 [ 778.217986][T26940] ? xskq_create+0xbf/0x170 [ 778.218018][T26940] xskq_create+0xbf/0x170 [ 778.218051][T26940] xsk_init_queue+0x8a/0xe0 [ 778.218084][T26940] xsk_setsockopt+0x52a/0x960 [ 778.218111][T26940] ? __fget_files+0x2a/0x420 [ 778.218138][T26940] ? __pfx_xsk_setsockopt+0x10/0x10 [ 778.218164][T26940] ? __pfx_aa_sk_perm+0x10/0x10 [ 778.218199][T26940] ? aa_sock_opt_perm+0xff/0x1a0 [ 778.218223][T26940] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 778.218244][T26940] ? __pfx_xsk_setsockopt+0x10/0x10 [ 778.218273][T26940] do_sock_setsockopt+0x17c/0x1b0 [ 778.218312][T26940] __x64_sys_setsockopt+0x13d/0x1b0 [ 778.218346][T26940] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.218454][T26940] do_syscall_64+0x174/0x580 [ 778.218473][T26940] ? trace_irq_disable+0x3b/0x140 [ 778.218509][T26940] ? clear_bhb_loop+0x40/0x90 [ 778.218539][T26940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.218562][T26940] RIP: 0033:0x7f521459de99 [ 778.218583][T26940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 778.218602][T26940] RSP: 002b:00007f521539e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 778.218626][T26940] RAX: ffffffffffffffda RBX: 00007f5214825fa0 RCX: 00007f521459de99 [ 778.218642][T26940] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 778.218655][T26940] RBP: 00007f5214633eaf R08: 0000000000000004 R09: 0000000000000000 [ 778.218668][T26940] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 778.218682][T26940] R13: 00007f5214826038 R14: 00007f5214825fa0 R15: 00007ffd73fb5a38 [ 778.218717][T26940] [ 778.218806][T26940] Mem-Info: [ 778.374307][T22618] bond0: (slave bond_slave_0): interface is now down [ 778.593583][T26940] active_anon:5767 inactive_anon:0 isolated_anon:0 [ 778.593583][T26940] active_file:3 inactive_file:43378 isolated_file:0 [ 778.593583][T26940] unevictable:768 dirty:101 writeback:0 [ 778.593583][T26940] slab_reclaimable:11638 slab_unreclaimable:105899 [ 778.593583][T26940] mapped:30229 shmem:1302 pagetables:1685 [ 778.593583][T26940] sec_pagetables:0 bounce:0 [ 778.593583][T26940] kernel_misc_reclaimable:0 [ 778.593583][T26940] free:1312407 free_pcp:9708 free_cma:0 [ 778.678198][T26940] Node 0 active_anon:23068kB inactive_anon:0kB active_file:12kB inactive_file:173304kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122816kB dirty:404kB writeback:0kB shmem:3672kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14992kB pagetables:6416kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 778.716618][T26940] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 778.750909][T26940] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 778.802971][T26940] lowmem_reserve[]: 0 2488 2489 2489 2489 [ 778.811381][T26940] Node 0 DMA32 free:1292264kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23068kB inactive_anon:0kB active_file:12kB inactive_file:173304kB unevictable:1536kB writepending:404kB zspages:0kB present:3129332kB managed:2548684kB mlocked:0kB bounce:0kB free_pcp:39276kB local_pcp:18900kB free_cma:0kB [ 778.849235][T26940] lowmem_reserve[]: 0 0 0 0 0 [ 778.858451][T26940] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:260kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 778.890126][T26940] lowmem_reserve[]: 0 0 0 0 0 [ 778.896127][T26940] Node 1 Normal free:3942004kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 778.932099][T26940] lowmem_reserve[]: 0 0 0 0 0 [ 778.938100][T26940] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 778.952578][T26940] Node 0 DMA32: 2493*4kB (UME) 1374*8kB (UME) 465*16kB (UM) 861*32kB (UM) 266*64kB (UM) 561*128kB (UME) 399*256kB (UME) 259*512kB (UM) 125*1024kB (UM) 11*2048kB (UM) 186*4096kB (UM) = 1291924kB [ 778.979223][T26940] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 778.992832][T26940] Node 1 Normal: 1*4kB (M) 2*8kB (UM) 6*16kB (UM) 8*32kB (UM) 8*64kB (UM) 4*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 961*4096kB (UM) = 3942004kB [ 779.065059][T26940] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 779.086963][T26940] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 779.117230][T26940] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 779.132623][T26940] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 779.144507][T26940] 44673 total pagecache pages [ 779.149336][T26940] 0 pages in swap cache [ 779.174136][T26940] Free swap = 124996kB [ 779.181786][T26940] Total swap = 124996kB [ 779.192693][T26940] 2097051 pages RAM [ 779.202753][T26940] 0 pages HighMem/MovableOnly [ 779.212748][T26940] 428200 pages reserved [ 779.228290][T26940] 0 pages cma reserved [ 779.322050][T26973] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5797'. [ 779.452441][T26979] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5798'. [ 779.467355][T26979] netlink: 2 bytes leftover after parsing attributes in process `syz.2.5798'. [ 779.486321][T26979] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5798'. [ 779.497351][T26979] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5798'. [ 779.509970][T26979] netlink: 'syz.2.5798': attribute type 15 has an invalid length. [ 779.567286][T22618] netdevsim netdevsim2 : set [0, 1] type 1 family 0 port 256 - 0 [ 779.577643][T26979] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5798'. [ 779.594418][T22618] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 779.610270][T22618] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 779.622708][T26979] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5798'. [ 779.638515][T22618] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 779.667859][T26979] netlink: 'syz.2.5798': attribute type 15 has an invalid length. [ 780.005287][T27001] sctp: [Deprecated]: syz.3.5804 (pid 27001) Use of struct sctp_assoc_value in delayed_ack socket option. [ 780.005287][T27001] Use struct sctp_sack_info instead [ 780.571165][T27035] netlink: 'syz.4.5813': attribute type 1 has an invalid length. [ 780.647288][T27035] 8021q: adding VLAN 0 to HW filter on device bond6 [ 780.804921][T27035] bond6: (slave geneve3): making interface the new active one [ 780.831898][T27035] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 781.639564][T27094] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 781.666144][T27096] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 781.755193][T27093] netlink: 'syz.2.5830': attribute type 5 has an invalid length. [ 781.882261][T27104] sch_fq: defrate 0 ignored. [ 781.981293][T27105] team1: entered promiscuous mode [ 781.992297][T27105] team1: entered allmulticast mode [ 782.311120][T27134] __nla_validate_parse: 5 callbacks suppressed [ 782.311139][T27134] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5841'. [ 782.410089][T27134] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5841'. [ 782.482343][ T30] audit: type=1804 audit(1784608131.640:23): pid=27140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.5843" name="/newroot/535/cgroup.controllers" dev="tmpfs" ino=2728 res=1 errno=0 [ 782.550145][ T30] audit: type=1800 audit(1784608131.640:24): pid=27140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5843" name="cgroup.controllers" dev="tmpfs" ino=2728 res=0 errno=0 [ 782.677319][T27156] netlink: 232 bytes leftover after parsing attributes in process `syz.0.5847'. [ 782.758957][T27159] netlink: 'syz.1.5848': attribute type 2 has an invalid length. [ 782.813706][T27159] : entered promiscuous mode [ 783.090155][ T30] audit: type=1804 audit(1784608132.250:25): pid=27180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.5854" name="/newroot/509/cgroup.controllers" dev="tmpfs" ino=2617 res=1 errno=0 [ 783.128494][T27188] Cannot find del_set index 4 as target [ 783.165834][T27185] sctp: [Deprecated]: syz.0.5855 (pid 27185) Use of int in maxseg socket option. [ 783.165834][T27185] Use struct sctp_assoc_value instead [ 783.168582][ T30] audit: type=1800 audit(1784608132.250:26): pid=27180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5854" name="cgroup.controllers" dev="tmpfs" ino=2617 res=0 errno=0 [ 783.402401][T27210] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5862'. [ 783.417232][T27210] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5862'. [ 783.448338][T27210] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5862'. [ 783.574021][T22622] bond0: (slave bond_slave_1): interface is now down [ 783.581472][T22622] bond0: now running without any active interface! [ 783.932504][T27244] gtp1: entered allmulticast mode [ 783.976996][T27242] gtp1: entered allmulticast mode [ 784.169936][T27255] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5875'. [ 784.220623][T27261] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5878'. [ 784.449027][T27276] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5882'. [ 784.521033][T27279] netlink: 'syz.4.5884': attribute type 49 has an invalid length. [ 784.642158][T27289] xt_CT: You must specify a L4 protocol and not use inversions on it [ 784.782863][T27300] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5890'. [ 784.892778][T27307] netlink: 'syz.3.5892': attribute type 142 has an invalid length. [ 785.299740][T27328] openvswitch: netlink: IP tunnel dst address not specified [ 785.332596][T27328] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 785.496812][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 785.528520][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 785.539004][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 785.547767][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 785.556088][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 785.615263][ T5632] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 785.629670][ T5632] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 785.639121][ T5632] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 785.656190][ T5632] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 785.668889][ T5632] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 786.106413][T27364] netlink: 'syz.2.5907': attribute type 1 has an invalid length. [ 786.387050][T27375] ipt_rpfilter: unknown options [ 786.987843][T27339] xfrm0 speed is unknown, defaulting to 1000 [ 786.996182][T27367] netlink: 'syz.3.5908': attribute type 1 has an invalid length. [ 787.006567][T27339] speed is unknown, defaulting to 1000 [ 787.065526][T27339] wlan1 speed is unknown, defaulting to 1000 [ 787.090033][T27367] bond12: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 787.222153][T27410] xt_CT: You must specify a L4 protocol and not use inversions on it [ 787.647496][T27428] netlink: 'syz.4.5921': attribute type 12 has an invalid length. [ 787.733204][ T5632] Bluetooth: hci3: command tx timeout [ 788.017145][T27339] bridge0: port 1(bridge_slave_0) entered blocking state [ 788.025246][T27339] bridge0: port 1(bridge_slave_0) entered disabled state [ 788.032644][T27339] bridge_slave_0: entered allmulticast mode [ 788.041381][T27339] bridge_slave_0: entered promiscuous mode [ 788.050640][T27339] bridge0: port 2(bridge_slave_1) entered blocking state [ 788.058031][T27339] bridge0: port 2(bridge_slave_1) entered disabled state [ 788.065794][T27339] bridge_slave_1: entered allmulticast mode [ 788.074435][T27339] bridge_slave_1: entered promiscuous mode [ 788.118880][T27339] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 788.133524][T27339] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 788.166254][T27457] __nla_validate_parse: 6 callbacks suppressed [ 788.166272][T27457] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5930'. [ 788.191260][T27339] team0: Port device team_slave_0 added [ 788.311082][T27339] team0: Port device team_slave_1 added [ 788.401300][T27339] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 788.410027][T27339] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 788.445915][T27339] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 788.466030][T27339] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 788.474804][T27339] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 788.510716][T27339] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 788.581958][T27339] hsr_slave_0: entered promiscuous mode [ 788.590662][T27339] hsr_slave_1: entered promiscuous mode [ 788.599218][T27339] debugfs: 'hsr0' already exists in 'hsr' [ 788.606669][T27339] Cannot create hsr debugfs directory [ 789.034244][T27473] syzkaller0: entered promiscuous mode [ 789.051222][T27473] syzkaller0: entered allmulticast mode [ 789.102117][T27493] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5939'. [ 789.823449][ T5632] Bluetooth: hci3: command tx timeout [ 791.855793][T27493] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 791.893528][ T5632] Bluetooth: hci3: command tx timeout [ 791.942320][T27515] macsec2: entered promiscuous mode [ 792.034818][T27517] lo: entered promiscuous mode [ 792.064422][T27517] netlink: 'syz.4.5946': attribute type 2 has an invalid length. [ 792.091784][T27517] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 792.521187][T27547] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 792.572463][T27547] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5954'. [ 792.602900][T27546] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5954'. [ 792.780271][T27526] syzkaller1: entered promiscuous mode [ 792.792692][T27526] syzkaller1: entered allmulticast mode [ 792.852172][T27556] x_tables: ip_tables: REDIRECT target: only valid in nat table, not syzkaller [ 793.291757][T27339] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 793.306563][T27339] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 793.315497][T27339] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 793.332652][T27339] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 793.342411][T27339] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 793.356178][T27339] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 793.371665][T27339] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 793.395986][T27339] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 793.405567][T27580] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5965'. [ 793.551974][T27605] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5970'. [ 793.562412][T27605] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5970'. [ 793.708676][T27339] 8021q: adding VLAN 0 to HW filter on device bond0 [ 793.756719][T27339] 8021q: adding VLAN 0 to HW filter on device team0 [ 793.775385][ T8473] bridge0: port 1(bridge_slave_0) entered blocking state [ 793.782634][ T8473] bridge0: port 1(bridge_slave_0) entered forwarding state [ 793.801713][T22616] bridge0: port 2(bridge_slave_1) entered blocking state [ 793.809079][T22616] bridge0: port 2(bridge_slave_1) entered forwarding state [ 793.985589][ T5632] Bluetooth: hci3: command tx timeout [ 794.142822][T27623] siw: device registration error -23 [ 794.179303][T27623] rB: renamed from lo [ 794.903279][T27339] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 795.212670][T27339] veth0_vlan: entered promiscuous mode [ 795.323174][T27647] xfrm0 speed is unknown, defaulting to 1000 [ 795.338008][T27339] veth1_vlan: entered promiscuous mode [ 795.386335][T27647] speed is unknown, defaulting to 1000 [ 795.456197][T27647] wlan1 speed is unknown, defaulting to 1000 [ 795.686748][T27339] veth0_macvtap: entered promiscuous mode [ 795.742037][T27657] netlink: 'syz.2.5982': attribute type 1 has an invalid length. [ 795.846182][T27663] netlink: 'syz.1.5984': attribute type 49 has an invalid length. [ 795.892222][T27658] bond11: (slave veth0_to_bond): Releasing active interface [ 795.918862][T27658] bond12: (slave veth0_to_bond): making interface the new active one [ 795.935173][T27658] bond12: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 796.077326][T27672] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5982'. [ 796.108881][T27339] veth1_macvtap: entered promiscuous mode [ 796.235336][T27339] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 796.301122][T27339] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 796.321801][T22618] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.347366][T22618] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.377115][T22622] bond0: (slave bond_slave_0): link status definitely up [ 796.389888][T22618] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.444634][T22618] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.465756][T27682] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5988'. [ 796.479222][T27682] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5988'. [ 796.494207][T27684] veth0: entered promiscuous mode [ 796.520854][T27685] veth0: left promiscuous mode [ 796.535065][T27683] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5987'. [ 796.586679][T27688] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5988'. [ 796.617779][T27688] netlink: 'syz.4.5988': attribute type 5 has an invalid length. [ 796.666887][T27692] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5988'. [ 796.683837][T27688] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5988'. [ 796.806801][T27694] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 疽m%AAZZI % [ 796.836735][T27688] geneve4: entered promiscuous mode [ 796.851230][T27688] geneve4: entered allmulticast mode [ 796.885723][ T79] netdevsim netdevsim4 : set [1, 1] type 2 family 0 port 256 - 0 [ 796.919245][ T79] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 796.928301][ T79] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 796.957935][ T79] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 797.104877][T22622] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 797.136811][T22622] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 797.220604][T22621] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 797.249833][T22621] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 798.447887][ T50] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 798.460207][ T50] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 798.470091][ T50] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 798.479824][ T50] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 798.495830][ T50] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 798.935738][T22616] bond0: (slave bond_slave_0): link status definitely up [ 798.968506][T27764] xfrm0 speed is unknown, defaulting to 1000 [ 798.981007][T27764] speed is unknown, defaulting to 1000 [ 798.989263][T27764] wlan1 speed is unknown, defaulting to 1000 [ 799.271866][T27764] bridge0: port 1(bridge_slave_0) entered blocking state [ 799.280038][T27764] bridge0: port 1(bridge_slave_0) entered disabled state [ 799.288109][T27764] bridge_slave_0: entered allmulticast mode [ 799.296808][T27764] bridge_slave_0: entered promiscuous mode [ 799.306559][T27764] bridge0: port 2(bridge_slave_1) entered blocking state [ 799.314541][T27764] bridge0: port 2(bridge_slave_1) entered disabled state [ 799.321994][T27764] bridge_slave_1: entered allmulticast mode [ 799.330487][T27764] bridge_slave_1: entered promiscuous mode [ 799.370058][T27764] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 799.382416][T27764] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 799.418487][T27764] team0: Port device team_slave_0 added [ 799.427824][T27764] team0: Port device team_slave_1 added [ 799.461717][T27764] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 799.469208][T27764] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 799.497463][T27764] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 799.510926][T27764] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 799.518208][T27764] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 799.546049][T27764] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 799.602032][T27764] hsr_slave_0: entered promiscuous mode [ 799.609726][T27764] hsr_slave_1: entered promiscuous mode [ 799.617094][T27764] debugfs: 'hsr0' already exists in 'hsr' [ 799.622874][T27764] Cannot create hsr debugfs directory [ 799.862159][T27764] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 799.876174][T27764] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.988703][T27764] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 799.999317][T27764] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 800.118033][T27764] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 800.129470][T27764] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 800.204226][T27764] netdevsim netdevsim1  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 800.214200][T27764] netdevsim netdevsim1  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 800.591220][T27721] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 800.614690][ T5632] Bluetooth: hci5: command tx timeout [ 800.652328][T27764] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 800.735788][T27764] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 800.780863][T27764] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 800.849893][T27764] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 800.860576][T27789] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 800.875034][T27764] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 800.897134][T27790] __nla_validate_parse: 5 callbacks suppressed [ 800.897153][T27790] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6011'. [ 800.938245][T27764] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 800.950272][T27764] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 800.988394][T27764] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 801.339745][T27764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 801.421023][T27815] openvswitch: netlink: Duplicate or invalid key (type 0). [ 801.451395][T27764] 8021q: adding VLAN 0 to HW filter on device team0 [ 801.472376][T27815] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 801.493526][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.503726][T22621] bridge0: port 1(bridge_slave_0) entered blocking state [ 801.504177][T22621] bridge0: port 1(bridge_slave_0) entered forwarding state [ 801.609303][T22621] bridge0: port 2(bridge_slave_1) entered blocking state [ 801.616629][T22621] bridge0: port 2(bridge_slave_1) entered forwarding state [ 801.692720][T27821] netlink: 'syz.2.6020': attribute type 142 has an invalid length. [ 801.900529][T27829] netlink: 220 bytes leftover after parsing attributes in process `syz.4.6022'. [ 801.975982][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.275275][T27845] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6027'. [ 802.346637][T27849] netlink: 'syz.3.6028': attribute type 4 has an invalid length. [ 802.370585][T27849] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6028'. [ 802.388517][T22616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.399512][T25119] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.415854][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.695342][ T5632] Bluetooth: hci5: command tx timeout [ 802.767651][T27866] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6032'. [ 802.778463][T27866] netlink: 'syz.2.6032': attribute type 7 has an invalid length. [ 802.786917][T27866] netlink: 'syz.2.6032': attribute type 8 has an invalid length. [ 802.797950][T27866] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6032'. [ 802.969904][T27868] xfrm0 speed is unknown, defaulting to 1000 [ 802.998812][T27764] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 803.013701][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.018152][T27868] speed is unknown, defaulting to 1000 [ 803.032861][T27883] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6036'. [ 803.064415][T27868] wlan1 speed is unknown, defaulting to 1000 [ 803.289517][T27893] openvswitch: netlink: VXLAN extension 1 has unexpected len 16 expected 4 [ 803.390008][T27764] veth0_vlan: entered promiscuous mode [ 803.509058][T27764] veth1_vlan: entered promiscuous mode [ 803.606780][T27901] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6042'. [ 803.641709][T27764] veth0_macvtap: entered promiscuous mode [ 803.662831][T27903] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6041'. [ 803.714533][T27764] veth1_macvtap: entered promiscuous mode [ 803.720522][T27903] netlink: 43 bytes leftover after parsing attributes in process `syz.0.6041'. [ 803.765984][T27903] netlink: 'syz.0.6041': attribute type 5 has an invalid length. [ 803.789205][T27764] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 803.808568][T27764] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 803.871716][T22621] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 803.904449][T22621] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 803.917871][T22621] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 803.935685][T22621] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.100644][T27914] pim6reg527: entered allmulticast mode [ 804.238900][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 804.268776][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 804.430921][T22622] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 804.472241][T22622] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 804.704264][T27932] netlink: 'syz.4.6052': attribute type 10 has an invalid length. [ 804.773628][ T5632] Bluetooth: hci5: command tx timeout [ 804.879672][T27944] netlink: 'syz.1.6054': attribute type 3 has an invalid length. [ 804.916938][T27946] netlink: 'syz.0.6055': attribute type 10 has an invalid length. [ 804.917252][T27947] netlink: 'syz.0.6055': attribute type 10 has an invalid length. [ 806.133797][T24027] net_ratelimit: 5 callbacks suppressed [ 806.133820][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.856105][ T5632] Bluetooth: hci5: command tx timeout [ 807.183285][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.672608][T27934] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 807.931043][T27966] bridge0: port 3(gretap0) entered blocking state [ 807.954335][T27966] bridge0: port 3(gretap0) entered disabled state [ 807.970374][T27966] gretap0: entered allmulticast mode [ 807.992563][T27966] gretap0: entered promiscuous mode [ 808.217176][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.349545][T27992] netlink: 'syz.3.6069': attribute type 1 has an invalid length. [ 808.358239][T27992] netlink: 'syz.3.6069': attribute type 1 has an invalid length. [ 808.367734][T27992] netlink: 'syz.3.6069': attribute type 2 has an invalid length. [ 808.376819][T27992] netlink: 'syz.3.6069': attribute type 1 has an invalid length. [ 808.535984][T25119] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.562425][T27989] veth1_macvtap: left promiscuous mode [ 808.588306][T27989] macsec0: entered promiscuous mode [ 808.629953][T27989] xt_hashlimit: size too large, truncated to 1048576 [ 808.773764][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.821481][T28008] xt_hashlimit: size too large, truncated to 1048576 [ 809.254425][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.349125][T28023] ip6gre2: entered allmulticast mode [ 809.418162][T25119] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.561110][T28036] netlink: 'syz.3.6081': attribute type 1 has an invalid length. [ 809.767551][T28051] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 810.057677][T25122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.078639][T25119] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.304804][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.707546][T28109] __nla_validate_parse: 5 callbacks suppressed [ 810.707567][T28109] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6096'. [ 810.866347][T28117] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6099'. [ 811.183861][T28132] netlink: 'syz.3.6102': attribute type 1 has an invalid length. [ 811.229233][T28132] 8021q: adding VLAN 0 to HW filter on device bond14 [ 811.305561][T28134] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6101'. [ 811.314795][T28134] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6101'. [ 811.349683][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.468110][T28132] bond14: (slave bridge8): making interface the new active one [ 811.488827][T28132] bond14: (slave bridge8): Enslaving as an active interface with an up link [ 811.510818][T28141] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 811.650562][T28142] netlink: 'syz.4.6104': attribute type 1 has an invalid length. [ 811.682326][T28144] syzkaller1: entered promiscuous mode [ 811.699363][T28144] syzkaller1: entered allmulticast mode [ 812.075045][T28170] siw: device registration error -23 [ 812.120567][T28172] syzkaller0: entered promiscuous mode [ 812.130833][T28172] syzkaller0: entered allmulticast mode [ 812.373375][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.576688][T28184] syzkaller0: entered promiscuous mode [ 812.604122][T28184] syzkaller0: entered allmulticast mode [ 813.058069][T28192] tipc: Enabled bearer , priority 10 [ 813.066115][T28196] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6120'. [ 813.094395][ T5755] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.260779][T28209] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 813.278113][T28209] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 813.361574][T28211] tun0: tun_chr_ioctl cmd 1074025675 [ 813.408824][T28211] tun0: persist disabled [ 813.423436][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.659209][T28225] tipc: Started in network mode [ 813.675236][T28225] tipc: Node identity ac14140f, cluster identity 4711 [ 813.694442][T28225] tipc: Enabled bearer , priority 10 [ 813.709415][T28226] tipc: Enabling of bearer rejected, already enabled [ 813.738849][T28225] veth1_macvtap: left promiscuous mode [ 814.202043][T28243] syzkaller0: entered promiscuous mode [ 814.229658][T28243] syzkaller0: entered allmulticast mode [ 814.434817][T28254] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6136'. [ 814.461983][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.803891][ T5755] tipc: Node number set to 2886997007 [ 814.826418][T28272] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6141'. [ 814.886601][T28274] sctp: [Deprecated]: syz.4.6140 (pid 28274) Use of int in max_burst socket option deprecated. [ 814.886601][T28274] Use struct sctp_assoc_value instead [ 815.043119][T28266] [ 815.045624][T28266] ====================================================== [ 815.052733][T28266] WARNING: possible circular locking dependency detected [ 815.059839][T28266] syzkaller #0 Not tainted [ 815.064317][T28266] ------------------------------------------------------ [ 815.071412][T28266] syz.3.6139/28266 is trying to acquire lock: [ 815.077505][T28266] ffff888026b9a178 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 815.087070][T28266] [ 815.087070][T28266] but task is already holding lock: [ 815.094498][T28266] ffff888026b99c50 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 815.104765][T28266] [ 815.104765][T28266] which lock already depends on the new lock. [ 815.104765][T28266] [ 815.117772][T28266] [ 815.117772][T28266] the existing dependency chain (in reverse order) is: [ 815.126840][T28266] [ 815.126840][T28266] -> #6 (&q->q_usage_counter(io)#53){++++}-{0:0}: [ 815.135617][T28266] blk_alloc_queue+0x544/0x690 [ 815.140933][T28266] __blk_mq_alloc_disk+0x194/0x390 [ 815.146636][T28266] nbd_dev_add+0x494/0xb60 [ 815.151764][T28266] nbd_init+0x15f/0x1e0 [ 815.156536][T28266] do_one_initcall+0x250/0x870 [ 815.161851][T28266] do_initcall_level+0x10a/0x1a0 [ 815.167336][T28266] do_initcalls+0x59/0xa0 [ 815.172202][T28266] kernel_init_freeable+0x29d/0x3e0 [ 815.177938][T28266] kernel_init+0x1d/0x1d0 [ 815.182817][T28266] ret_from_fork+0x514/0xb70 [ 815.188014][T28266] ret_from_fork_asm+0x1a/0x30 [ 815.193419][T28266] [ 815.193419][T28266] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 815.200748][T28266] fs_reclaim_acquire+0x71/0x100 [ 815.206236][T28266] __kmalloc_cache_node_noprof+0x66/0x630 [ 815.212508][T28266] create_worker+0x112/0x7b0 [ 815.217637][T28266] workqueue_prepare_cpu+0xe4/0x170 [ 815.223378][T28266] cpuhp_invoke_callback+0x434/0x810 [ 815.229248][T28266] _cpu_up+0x2ce/0x5b0 [ 815.233854][T28266] cpu_up+0x1d2/0x220 [ 815.238382][T28266] cpuhp_bringup_mask+0xb2/0x1a0 [ 815.243883][T28266] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 815.250236][T28266] bringup_nonboot_cpus+0x17/0x30 [ 815.255801][T28266] smp_init+0x32/0x110 [ 815.260404][T28266] kernel_init_freeable+0x27f/0x3e0 [ 815.266149][T28266] kernel_init+0x1d/0x1d0 [ 815.271033][T28266] ret_from_fork+0x514/0xb70 [ 815.276168][T28266] ret_from_fork_asm+0x1a/0x30 [ 815.283572][T28266] [ 815.283572][T28266] -> #4 (cpu_hotplug_lock){++++}-{0:0}: [ 815.291345][T28266] cpus_read_lock+0x42/0x160 [ 815.296486][T28266] static_key_slow_inc+0x12/0x30 [ 815.302018][T28266] nbd_genl_reconfigure+0x1301/0x1e80 [ 815.307971][T28266] genl_family_rcv_msg_doit+0x233/0x340 [ 815.314065][T28266] genl_rcv_msg+0x614/0x7a0 [ 815.319122][T28266] netlink_rcv_skb+0x226/0x4a0 [ 815.324441][T28266] genl_rcv+0x28/0x40 [ 815.329002][T28266] netlink_unicast+0x7bb/0x940 [ 815.334318][T28266] netlink_sendmsg+0x813/0xb40 [ 815.339629][T28266] sock_sendmsg_nosec+0x13a/0x180 [ 815.345196][T28266] ____sys_sendmsg+0x54e/0x850 [ 815.350495][T28266] ___sys_sendmsg+0x2a5/0x360 [ 815.355722][T28266] __x64_sys_sendmsg+0x1b1/0x290 [ 815.361201][T28266] do_syscall_64+0x174/0x580 [ 815.366321][T28266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.372765][T28266] [ 815.372765][T28266] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 815.380435][T28266] __mutex_lock+0x19d/0x1550 [ 815.385568][T28266] nbd_queue_rq+0x373/0x1150 [ 815.390712][T28266] blk_mq_dispatch_rq_list+0x499/0x1990 [ 815.396804][T28266] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 815.403676][T28266] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 815.410207][T28266] blk_mq_run_work_fn+0x16c/0x300 [ 815.415774][T28266] process_scheduled_works+0xa8e/0x14e0 [ 815.421863][T28266] worker_thread+0xa47/0xfb0 [ 815.426988][T28266] kthread+0x388/0x470 [ 815.431595][T28266] ret_from_fork+0x514/0xb70 [ 815.436725][T28266] ret_from_fork_asm+0x1a/0x30 [ 815.442022][T28266] [ 815.442022][T28266] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 815.449252][T28266] __mutex_lock+0x19d/0x1550 [ 815.454382][T28266] nbd_queue_rq+0xc1/0x1150 [ 815.459436][T28266] blk_mq_dispatch_rq_list+0x499/0x1990 [ 815.465592][T28266] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 815.472455][T28266] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 815.478975][T28266] blk_mq_run_work_fn+0x16c/0x300 [ 815.484538][T28266] process_scheduled_works+0xa8e/0x14e0 [ 815.490632][T28266] worker_thread+0xa47/0xfb0 [ 815.495761][T28266] kthread+0x388/0x470 [ 815.500371][T28266] ret_from_fork+0x514/0xb70 [ 815.505503][T28266] ret_from_fork_asm+0x1a/0x30 [ 815.510804][T28266] [ 815.510804][T28266] -> #1 (set->srcu){.+.+}-{0:0}: [ 815.517934][T28266] __synchronize_srcu+0xc9/0x2f0 [ 815.523410][T28266] elevator_switch+0x1e8/0x7b0 [ 815.528745][T28266] elevator_change+0x2fa/0x480 [ 815.534064][T28266] elevator_set_default+0x375/0x440 [ 815.539812][T28266] blk_register_queue+0x3f3/0x4e0 [ 815.545384][T28266] __add_disk+0x6cb/0xe30 [ 815.550272][T28266] add_disk_fwnode+0x100/0x3a0 [ 815.555566][T28266] nbd_dev_add+0x733/0xb60 [ 815.560525][T28266] nbd_init+0x15f/0x1e0 [ 815.565223][T28266] do_one_initcall+0x250/0x870 [ 815.570535][T28266] do_initcall_level+0x10a/0x1a0 [ 815.576016][T28266] do_initcalls+0x59/0xa0 [ 815.580882][T28266] kernel_init_freeable+0x29d/0x3e0 [ 815.586629][T28266] kernel_init+0x1d/0x1d0 [ 815.591517][T28266] ret_from_fork+0x514/0xb70 [ 815.596647][T28266] ret_from_fork_asm+0x1a/0x30 [ 815.601944][T28266] [ 815.601944][T28266] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 815.609784][T28266] __lock_acquire+0x1520/0x2cf0 [ 815.615192][T28266] lock_acquire+0x106/0x350 [ 815.620235][T28266] __mutex_lock+0x19d/0x1550 [ 815.625355][T28266] elevator_change+0x1af/0x480 [ 815.630672][T28266] elevator_set_none+0xb5/0x140 [ 815.636065][T28266] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 815.642418][T28266] nbd_start_device+0x189/0xb30 [ 815.647815][T28266] nbd_genl_connect+0x1597/0x1c10 [ 815.653378][T28266] genl_family_rcv_msg_doit+0x233/0x340 [ 815.659488][T28266] genl_rcv_msg+0x614/0x7a0 [ 815.664533][T28266] netlink_rcv_skb+0x226/0x4a0 [ 815.669856][T28266] genl_rcv+0x28/0x40 [ 815.674384][T28266] netlink_unicast+0x7bb/0x940 [ 815.679706][T28266] netlink_sendmsg+0x813/0xb40 [ 815.685007][T28266] sock_sendmsg_nosec+0x13a/0x180 [ 815.690570][T28266] ____sys_sendmsg+0x54e/0x850 [ 815.695879][T28266] ___sys_sendmsg+0x2a5/0x360 [ 815.701084][T28266] __x64_sys_sendmsg+0x1b1/0x290 [ 815.706570][T28266] do_syscall_64+0x174/0x580 [ 815.711698][T28266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.718265][T28266] [ 815.718265][T28266] other info that might help us debug this: [ 815.718265][T28266] [ 815.728502][T28266] Chain exists of: [ 815.728502][T28266] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#53 [ 815.728502][T28266] [ 815.742373][T28266] Possible unsafe locking scenario: [ 815.742373][T28266] [ 815.749890][T28266] CPU0 CPU1 [ 815.755319][T28266] ---- ---- [ 815.760695][T28266] lock(&q->q_usage_counter(io)#53); [ 815.766090][T28266] lock(fs_reclaim); [ 815.772611][T28266] lock(&q->q_usage_counter(io)#53); [ 815.780523][T28266] lock(&q->elevator_lock); [ 815.785132][T28266] [ 815.785132][T28266] *** DEADLOCK *** [ 815.785132][T28266] [ 815.793281][T28266] 6 locks held by syz.3.6139/28266: [ 815.798495][T28266] #0: ffffffff9009d588 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 815.806793][T28266] #1: ffffffff9009d3c0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 815.815868][T28266] #2: ffff8880270529c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xab/0x19f0 [ 815.827395][T28266] #3: ffff8880270528d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xbe/0x19f0 [ 815.838377][T28266] #4: ffff888026b99c50 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 815.849026][T28266] #5: ffff888026b99c88 (&q->q_usage_counter(queue)#37){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 815.859952][T28266] [ 815.859952][T28266] stack backtrace: [ 815.865863][T28266] CPU: 1 UID: 0 PID: 28266 Comm: syz.3.6139 Not tainted syzkaller #0 PREEMPT(full) [ 815.865890][T28266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 815.865903][T28266] Call Trace: [ 815.865914][T28266] [ 815.865923][T28266] dump_stack_lvl+0xe8/0x150 [ 815.865955][T28266] print_circular_bug+0x2e1/0x300 [ 815.865975][T28266] check_noncircular+0x12e/0x150 [ 815.866005][T28266] __lock_acquire+0x1520/0x2cf0 [ 815.866038][T28266] ? elevator_change+0x1af/0x480 [ 815.866060][T28266] lock_acquire+0x106/0x350 [ 815.866081][T28266] ? elevator_change+0x1af/0x480 [ 815.866108][T28266] __mutex_lock+0x19d/0x1550 [ 815.866131][T28266] ? elevator_change+0x1af/0x480 [ 815.866154][T28266] ? rcu_is_watching+0x15/0xb0 [ 815.866183][T28266] ? elevator_change+0x1af/0x480 [ 815.866205][T28266] ? __pfx___mutex_lock+0x10/0x10 [ 815.866232][T28266] ? enable_work+0x17f/0x230 [ 815.866253][T28266] ? lockdep_hardirqs_on+0x7a/0x110 [ 815.866292][T28266] ? __cancel_work_sync+0xf7/0x110 [ 815.866313][T28266] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 815.866337][T28266] elevator_change+0x1af/0x480 [ 815.866360][T28266] elevator_set_none+0xb5/0x140 [ 815.866381][T28266] ? __pfx_elevator_set_none+0x10/0x10 [ 815.866403][T28266] ? xa_load+0x1db/0x210 [ 815.866421][T28266] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 815.866446][T28266] ? kernfs_add_one+0x480/0x5e0 [ 815.866531][T28266] ? nbd_start_device+0x17d/0xb30 [ 815.866558][T28266] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 815.866587][T28266] ? sysfs_add_file_mode_ns+0x258/0x300 [ 815.866644][T28266] nbd_start_device+0x189/0xb30 [ 815.866670][T28266] ? device_create_file+0xf4/0x1b0 [ 815.866713][T28266] nbd_genl_connect+0x1597/0x1c10 [ 815.866740][T28266] ? __pfx_nbd_genl_connect+0x10/0x10 [ 815.866764][T28266] ? rcu_is_watching+0x15/0xb0 [ 815.866787][T28266] ? trace_kmalloc+0x2a/0xf0 [ 815.866806][T28266] ? __kmalloc_noprof+0x396/0x720 [ 815.866826][T28266] ? __nla_parse+0x40/0x60 [ 815.866848][T28266] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 815.866870][T28266] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 815.866893][T28266] genl_family_rcv_msg_doit+0x233/0x340 [ 815.866917][T28266] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 815.866941][T28266] ? __lock_acquire+0x683/0x2cf0 [ 815.866965][T28266] genl_rcv_msg+0x614/0x7a0 [ 815.866986][T28266] ? __pfx_genl_rcv_msg+0x10/0x10 [ 815.867006][T28266] ? __pfx_nbd_genl_connect+0x10/0x10 [ 815.867033][T28266] netlink_rcv_skb+0x226/0x4a0 [ 815.867049][T28266] ? __pfx_genl_rcv_msg+0x10/0x10 [ 815.867069][T28266] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 815.867089][T28266] ? down_read+0x2be/0x330 [ 815.867105][T28266] genl_rcv+0x28/0x40 [ 815.867127][T28266] netlink_unicast+0x7bb/0x940 [ 815.867154][T28266] netlink_sendmsg+0x813/0xb40 [ 815.867174][T28266] ? __pfx_netlink_sendmsg+0x10/0x10 [ 815.867191][T28266] ? aa_sock_msg_perm+0xf1/0x1b0 [ 815.867208][T28266] ? __pfx_netlink_sendmsg+0x10/0x10 [ 815.867223][T28266] sock_sendmsg_nosec+0x13a/0x180 [ 815.867244][T28266] ____sys_sendmsg+0x54e/0x850 [ 815.867261][T28266] ? __pfx_____sys_sendmsg+0x10/0x10 [ 815.867278][T28266] ? import_iovec+0x73/0xa0 [ 815.867306][T28266] ___sys_sendmsg+0x2a5/0x360 [ 815.867320][T28266] ? __lock_acquire+0x683/0x2cf0 [ 815.867342][T28266] ? __pfx____sys_sendmsg+0x10/0x10 [ 815.867357][T28266] ? futex_wait+0x2a2/0x390 [ 815.867413][T28266] ? __fget_files+0x2a/0x420 [ 815.867436][T28266] ? __fget_files+0x3a2/0x420 [ 815.867460][T28266] __x64_sys_sendmsg+0x1b1/0x290 [ 815.867475][T28266] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 815.867497][T28266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.867513][T28266] do_syscall_64+0x174/0x580 [ 815.867527][T28266] ? trace_irq_disable+0x3b/0x140 [ 815.867546][T28266] ? clear_bhb_loop+0x40/0x90 [ 815.867564][T28266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.867580][T28266] RIP: 0033:0x7fc2e679de99 [ 815.867595][T28266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 815.867609][T28266] RSP: 002b:00007fc2e7603028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 815.867662][T28266] RAX: ffffffffffffffda RBX: 00007fc2e6a25fa0 RCX: 00007fc2e679de99 [ 815.867675][T28266] RDX: 0000000020000000 RSI: 0000200000000400 RDI: 0000000000000006 [ 815.867686][T28266] RBP: 00007fc2e6833eaf R08: 0000000000000000 R09: 0000000000000000 [ 815.867696][T28266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 815.867705][T28266] R13: 00007fc2e6a26038 R14: 00007fc2e6a25fa0 R15: 00007ffdc104e158 [ 815.867723][T28266] [ 816.355784][ T5755] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.369371][T28287] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6144'. [ 816.399651][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.464917][T28285] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6144'. [ 816.518802][T28285] tipc: Resetting bearer [ 816.549152][T28285] veth0_macvtap: left promiscuous mode [ 816.593258][T28285] tipc: Disabling bearer [ 817.417121][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.461696][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.414018][ T5755] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.497697][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.653426][T25122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.293610][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.548218][T24027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.576450][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 822.619268][ T810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.334599][T25122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.656317][ T810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 824.133397][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 824.697011][T18480] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog