last executing test programs: 4.375247025s ago: executing program 0 (id=4145): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f0000000040)=@ethtool_rxnfc={0x2e, 0xb, 0xb, {0x1, @sctp_ip6_spec={@ipv4={'\x00', '\xff\xff', @multicast1}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4e24, 0x4e24, 0x6}, {0x0, @multicast, 0xfff7, 0xe, [0x8, 0xe936]}, @sctp_ip4_spec={@private=0xa010102, @private=0xa010101, 0x4e24, 0x4e24, 0x12}, {0x0, @local, 0x0, 0x1, [0xffffffe8, 0x8]}, 0x6b, 0x2}}}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001240), 0x20000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@newtfilter={0x114, 0x2c, 0xd2b, 0x70b52a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0x6}, {}, {0xe, 0xfff2}}, [@filter_kind_options=@f_u32={{0x8}, {0xe8, 0x2, [@TCA_U32_SEL={0xe4, 0x5, {0x5, 0x5, 0xd, 0x5, 0x6, 0x0, 0x1, 0x1ff, [{0x3, 0x10001, 0x5, 0x67}, {0xf9af, 0x1, 0x1000, 0x7}, {0xfba, 0x44, 0xc3cc, 0x200}, {0xffffffff, 0x4, 0x1ff, 0x9}, {0x5, 0xfffffe00, 0x5, 0x5}, {0x8, 0x4fa, 0xe, 0x3}, {0x10001, 0xffffffff, 0x1, 0x173}, {0x2, 0x4, 0x66, 0x5}, {0x5, 0x2a, 0x8, 0x2}, {0x3, 0x1, 0x9, 0x5}, {0x3, 0x5, 0xfffffffe, 0xba}, {0x5, 0x8000, 0x4, 0x30}, {0x43a2aef2, 0xff, 0x3, 0xfff}]}}]}}]}, 0x114}, 0x1, 0x0, 0x0, 0x893}, 0x20040084) 4.157054692s ago: executing program 0 (id=4149): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='rdma.current\x00', 0x26e1, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8b19, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000240)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f0, 0x148, 0x4c, 0x1a, 0x148, 0x73, 0x220, 0x258, 0x258, 0x220, 0x258, 0x3, 0x0, {[{{@ipv6={@private0, @local, [], [], 'dvmrp1\x00', 'macvlan1\x00', {}, {}, 0x73}, 0x0, 0x100, 0x148, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x1, 0x3}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x0, 0x0, 0x0, 'syz0\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x20}, {0x0, 0x20}, 0x14}}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x5400}}, {0x28}}}}, 0x350) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000001, 0x50, r1, 0x42690000) 4.030431928s ago: executing program 0 (id=4151): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000900)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000001c0)="5bdbd57a8e65688996f9937f561de9b944d1e381fed329742e239cb13cf2af711d03d2f15b3118abd8fd087f117830209a631f9dfbe75cbbbb2216a2d87dfb0d7dd906c594125a10053c8e288ac4445ff0e999d423cc250e31e8650d248e49ba5fb3be8db01db38acf5a4455630ecb10f753530ada6598a1bf4c727f30db4778beff4805370a5cebf05e199368871b2751c242633419d13a6b05a390d21ab1d44be1254385b3d882c646f9762bf3480e05e98c9cc655adb7caa279e66709794e3b93cda0b9a14794e6d020cc68ea70e71a083e1a2b375591203ce218e8d244cf32f5dd7af0ee1ed032d3b59e4d571366677d06d4fac17627d5e9a3b11480388704dd57cc9085d04950f490aeb624eaae6a6f69fe60ee81062c1fdf71cf0e051b44d8dab1ca20cc577f29359c1d532a9d813c210ec5f5ac1d59728c192575c5b2f5a0251fae6329b0ade7cf82cb083ee14bd21468efeb65694a16898f3d2f55190ca9fd0475d0128fa1498b3171d945249ebc1f482b2050dc97e95ce86475410464f346c24a80ee2c56d2885c5275f8f8e02f9bff61b3dcbfa4bb3a0bac5edbc87e1dd6", 0x1a3}, {&(0x7f0000000000)="ff7791000dc7777cb951ca638ea0e1b5d280548c882aa59a68cd17c0e7f23d6d56a03be6caa272b3505e304463179c4d7768d9c3e5c21f3a9963ffde6682e5ecfe30b771e51c8d", 0x47}], 0x2, 0x0, 0x0, 0x816}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000000ac0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000080)=""/64, 0x40}, {&(0x7f0000000440)=""/247, 0xf7}], 0x2}, 0x7fff}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000400)=""/32, 0x20}], 0x1}, 0x1}], 0x2, 0x2101, 0x0) 3.961546348s ago: executing program 0 (id=4153): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000280)="f5", 0x1) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000080)={0x3, {{0x2, 0x4e23, @rand_addr=0x64010102}}}, 0x88) 3.677809662s ago: executing program 0 (id=4156): socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r0, 0x0, &(0x7f0000000080)) recvmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000000100)=@nfc_llcp, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000440)=""/75, 0x4b}, 0x8}], 0x1, 0x40002102, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000005000400000000000900020073797a30000000001400078008000840000028590800064000000000050005000000400005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'veth0_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@gettclass={0xfffffffffffffe73, 0x2a, 0x8, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xc, 0xf}, {0xfff2, 0x4}, {0x0, 0xc}}, ["", "", "", "", "", ""]}, 0x24}}, 0x20000000) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f00000000c0)='cpu.stat\x00', 0x275a, 0x0) getpeername$unix(r0, &(0x7f0000000380)=@abs, &(0x7f0000000400)=0x6e) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r7) sendmsg$NLBL_CIPSOV4_C_ADD(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="50b2c13571e226ff00c492868eca0a00fe16", @ANYRES16=r8, @ANYBLOB="010000000000010000000100000008000100020000002c000480050003000500000005000300010000000500030005000000050003000100000005000300050000000800020002000000"], 0x50}, 0x1, 0x0, 0x0, 0xc082}, 0x24004080) preadv(r6, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/13, 0xc}], 0x100000000000004b, 0x4, 0xfffffffe) 3.282177981s ago: executing program 3 (id=4160): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00', 0x0}) (async) r2 = socket$qrtr(0x2a, 0x2, 0x0) (async) close(0x3) (async) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$XFS_IOC_SET_RESBLKS(r0, 0xc0105872, &(0x7f0000000180)={0x4, 0x7}) (async) connect$netrom(r3, &(0x7f0000000300)={{0x6, @rose, 0x8}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default]}, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd604dd31800180400fc010000000000000000000000000003feee"], 0x0) (async) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000240)={0xffffffffffffffff}) read(r4, &(0x7f0000000380)=""/220, 0xdc) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r5, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @default, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r5, 0x80) accept$netrom(r5, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000600)="5604f6f26829c6f060e68bdc8ddb9322d3344d61aca733d30b8d219637f1f3f5bdbf7cb8bf642c4598ffa1c4e845f039180be6cdb035fe0026970f952b7ed495a11be052449de12a6b418a47227e38daa1036bf8c45b34f07e6dab67fdf6e0dd293c9562321624ce5781e307eaec2867009055c6218cf6161db9de5289017dafec90e68db5cb0f9395c7ec8a769a5c81e62916ac652e512bf8cb41e4c05137387cc5e831fc3cac34864b1d4c1a7c595dd099a858bf33557f58e70526ac80bbe4e2cb21c4f8afc5a5374bf05e9fd57dd4bda84cc944cb8e327c64612d40e45676253ab97466d4e394bc450e93a6708fa931b4ef6432e0eabdb3c9af7f09e7970003a6907f8a033a48e923796162ade52c39bf646a0147537f894ac21c34290fa946616cd1db886e9974a9bd8561f10d1603c2d7985de680c8db669ec8f602969b27cca3c05fe8465a03bb9156e09451734347d45dab48e885f3af1f56032d6532aaa59d9f2db63a38d4a8eba78953a3ec1f84a43d73efd3f45aabf9319743d04e08eaa96e703767c9af64cc27c63428c456c2b0b6c2f1a013bcd546929cebce98deb23d6d399d39a70c42d5d6e62206e9bea2272d19e41ad2f59235d01b58d4919bf42fac094b1456079276e9dc93f302835ad51775054330915f67d3002cf8ec1149c86adeaeba8ef12932423efea6122f6f8050b6c23dcd6107866fb885f8bf55e5aa96448b1bdf9c2bb072f24640ab65e9059c62003b10f736779ef29c69daaac388233d8d6f44d70ce691ce617a5a82436f1e6835c7bf99a244633020e3e242e4ee9bfc522b3f2d11dfd5a93fb9737729e3a20e03ec4917b70dd261bd14a877393a3d877239486c7f8cad31974f3966f7064947618a45c5f63f23987d4860ac9c3d64a19f356bf4fb70e276887de95aefb85aa36e388d61befaf8a59bcac9df3714f554a41c0c54471d6910d4c66f9c4aab01c96d8db815b8a9d3cdc7ff3025530559433db27253d89a1fbc43c0d422f0bb51380062320fe6e5ffea5942e09269e88ae28598d9f87de9dd6d5dadde1627f62e9830dab359320df293753623d818a17c8d62f7c3197e54a0ec11e2c958fd3e69ca9a0b73c6a1525df3ad2b227687adfd4b27a5725be895177470712682f78dcdefcbbfeca93839277524d8a0953bb7d6f34cca8404a835ebd3c0ca15973249217be610de08dd90e8bd403fbc1907a86ea5494cd66d90186f8047ea4d67dca33b84dbf1c2932e9bc0d64041959ad2c8e1d2b5fbfeef837ba014a6934c2384349a4b226710d292c366e50d23a4b5fdaf1742eac93b49f214da8cf60e0d11b495c03e3c290fbb749d20967606701439e9d8b803a66261005f332770b41eb4ca91784916320c1e4d0932638c91c8bfcc5e2b89a0c91296db0dab34131d99a2431faa7c829855ae3f1085c83bf68c90539530ccd2d7e7f52f09f4149a5ef5c60045ba60a835ec564f4e6ff9c0a37dbe88a948b5def013063d8a2ef1e6b0ae7d4b9e23038f5837d1c2bb95436c5d82704b616b7ca95ab015db7b78251c37070f158c6e98301a2c8b8a18ee70cc7f20fa41c98ead96c6ad09b94f822efeeca4a51fa30b6ee059430de52f0b0ce9219411ef00e0c9f420c8cf79c06921519bc3d90af03117997595a134e6acc1f889d630122030ed76619522b1676da69e819bcd999fbd1b2e34e0f357c57698a09e86474cf11d327784958e4721cfb8e6af6d671b83303a42496c58a024f8b070d161bbf12f33187e8226088e2f80bae176ebb77826029ac12e2ad190d4b347feddfdd1b739734e988fed9ccba821598eab92d63b555e9d598bed9f9f03d6bb14ca8448cb5a89f8131b88c5f06f0bb3b995c66e79d9e248181000faeb3c758833c7431765d680a99c6850b5baa028f3f14a73a9677afa9c565cb4e322ce0fed5c3f101fb0921ad18ff433aae02b04005295d81d39ab9328b80a8d4e5b1742305a20622b531def331453b42ca2fca37b7d10a48c9ebdefac88e1c90108a0358efaf130fe91e0e47ee21e793dd71fba6c8b0d20097a339c17fd546a72b29a25aee55b9aa2760745066704a2700bc645be82ee0563ea8876f8233a17c42a07f80ff97b4a3f30fc55e6354138efd441389e44bcf4e5ef8b7a55808f55b9cbf5148dde862ce9679069ed63fd771de66b60aa560cefb2667777b078a84a6239ec3e9760ffbfcbc0140d6144bcecedfed22a476f337f4fda44a39f2a1f39d5ce22d39845825592cda56382122aa6dc07977089a5cd6a86370f530341f1178fc6406963e97edbc73f9747cd733d52e3ed16e2a94c510611646af2c2067c4a82f95024c5a3d05360c781607219cc10cad98a0829e1089daeca77207e8b4c2577e7384010d9ff80f0ee0a39990639f6a57c80c652c60100468aff7814980eaa0455c58f86ecac0861d308e032ddab5e23c235c9239a8a01ba4681762660ab1287a016d32edf17fff563cb516b19ec099184932949abbc5554306114ef5bcbe26cd6810230271bed06052078f1b615b10720399bb20e7954c58924ab972243f0cfe25d030149dc533ba483aaef340e37918308a52547cd66db4ef04e50aab0158d12f6839a18d0ee717e0d5c22225127c7054fddb40e3139cdb9d04024b13dfc37b0bbde6f66a39e22bfab5eeb922f8de237e799f80f7b55171c9d35a15860dcf1e7c4d2f674d19ad16bee6206dd8f413bf20403dd5a6a3ecd3aaaca788219c6fb064f123cf1242002854b21bce6dc01e017102b315b4ca9e86be9a690f6ba1d19738b6e2292d621b1d8a4d00808ccb98a3059c5e21cc4c9410d6630993d6afaba3b05662343fdb655d735b48a7a15d7b4834492503e84a49eb35377d94ce2ed1231ba21233adcbbe63414dff60dd508b98c90ee8e3e48256739a1377646218764a145e7810da91ccacdcf2b139cc4b4fb95271b86f04f403ec31b7ccd2a4cd361987b189fa0910d96d8a3d78491e39fe9ce4a95c8570db6ddfcf962dcb2780af3bd19ddbb3b3a1aa15d22bda321295ae2a21165347b55560599375bd794dd91c7cf767ffaf7cf46152c2aff795d454edbc4110b422af42074160e8e8d2616640f5ec59c495fb0fd0b739d2ddca329f6ce9377d8b8095baa5712d84f62adfe6bc720817414af3713e97fb2b619cd489e0a305635bb7398e7851ccb67d685524fb3db541f69b2702491c36dd84a654d35d344432e472be1ab80ccf7b33fd79f8cbfecc3546b50bf7492a8ecec7d1242876993f70ce7243b2246e5ad287805b7da5d7f1b17da3a46a9f86f1ad41521a4454a996a69810b0e63624b43f58bbfae4b54126856fb9ef044a309148695ba33dd57f4c1c4c45bf5e63df8ec93324f7450766bd17bbde44413bcfe75ea19f2647f2b2d58cbeb358f00a4c609badfe711f83c40a612af11cf91fa88432690e5cb6e15d0759cc6c85daa95067a7aaa2972d261d248ac241218659f817331b0df4ede695f3b79ab7a997eb7dcb3c2de19a061a68971e63f5ca87e6a0271c4e2923be0a3afba79838f054e3086b5530f7aaa3a85cf034da98c0d6a52747fd14565c68e41b7df327ad3f03d5f3b8de65b632c493b23577f206b4be431", 0xa01}, {0x0}], 0x2) (async) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0x8) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r6, 0xf501, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_subtree(r7, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000080)={[{0x2b, 'pids'}]}, 0x6) (async) r9 = syz_genetlink_get_family_id$team(&(0x7f0000000140), r0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01000100000001dcdf250100000008000100", @ANYRES32=r10, @ANYBLOB="44000280400001002400010071756575655f6964000000000000000000000000000000000000000000000000050003000300000008000400dd09000008000600ac60e015fcd993778a41524d91cd27b0d221157838e4f1e4cefe0c4df64df7be4471f210fded", @ANYRES32=r1, @ANYBLOB], 0x60}, 0x1, 0x400000000000000}, 0x40810) 3.28184517s ago: executing program 0 (id=4161): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010100000000000000000a0000080900010073797a30000000005c000000030a1b0000000000000000000a0000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000440)={@ipv4={'\x00', '\xff\xff', @loopback}, @private0={0xfc, 0x0, '\x00', 0xfd}, @mcast1={0xff, 0x5}, 0x200004, 0x5, 0x6, 0x500, 0xfc8, 0x20c200a3}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="ad00"/16, 0x10) recvmmsg(r3, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) mmap(&(0x7f0000389000/0x3000)=nil, 0x3000, 0xb635773f05ebbee1, 0x8031, r4, 0x910bc000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x1e, 0x4, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x10, 0x8, 0xfb, 0x8001, {{0x5, 0x4, 0x3, 0x5, 0x14, 0x65, 0x0, 0x2, 0x29, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x29, 0x9, 0x8, 0x802, 0x10, @mcast2, @empty, 0x10, 0x0, 0xe7, 0x2}}) r7 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r7, 0x89fb, &(0x7f0000000540)={'ip6gre0\x00', 0x0}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) getsockopt$netlink(r5, 0x10e, 0x9, 0x0, &(0x7f0000000100)) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x70bd28, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_LINK_NETNSID={0x8, 0x25, 0xfffffffe}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) 2.914189812s ago: executing program 3 (id=4164): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000003000000003800000700000011000000", @ANYRES32, @ANYBLOB="4079470a77ccffffffffffffffff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x38) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r1, 0x84, 0x85, &(0x7f0000000100)=""/4100, &(0x7f00000000c0)=0x1004) r2 = socket(0x10, 0x3, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) listen(r2, 0xfffffe01) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000001c0)={0x1d, r4}, 0x10) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r0, 0x6628) write(r3, &(0x7f00000002c0)="1948896db371f0513422080b07", 0xd) sendmsg$tipc(r2, &(0x7f0000000400)={&(0x7f0000000080)=@id={0x1e, 0x3, 0x3, {0x4e66, 0x1}}, 0x10, &(0x7f0000000280)=[{&(0x7f00000000c0)="6f57384c0e0f982c9a77bd387048018dc119ffae53a56240dfbc0ba42e51b3db201c3b966c6472b44b11b8d89a23926a5938fdfe3a4c6b31b61d75073c3e2df8c0e65e40651d2c4f", 0x48}, {&(0x7f0000000200)="9093c4eaaf8eaa009fa1c46f01cd3b83bba8a1f2f543285c12820e578d6ef82987ffe66ef3c5e4efcd6205b489fc10f255fb1ce56ae37641405216ff2457e63a2757f3427309f8d3f89f52a167", 0x2b}], 0x2, &(0x7f00000003c0)="aa51c168cbcda5fd44ef43687bea6a10000000007687783b000000090000000000000000", 0x24, 0x70008001}, 0x40a0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="09000000170000000a0000004000000042000000", @ANYRES32=0x1, @ANYBLOB="05000004000000000000000000f2000000000000", @ANYRES32=r3, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000580), 0x1000, r6}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={r6, &(0x7f00000017c0), &(0x7f0000001480)=""/93}, 0x20) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000001140)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newtfilter={0x60, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0x7}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x30, 0x2, [@TCA_BASIC_EMATCHES={0x2c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_META={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_LVALUE={0x4, 0x2, [@TCF_META_TYPE_VAR]}, @TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0x6, 0x2}, {0x5, 0x40}}}]}}]}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$netlink(0x10, 0x3, 0x4) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T4(r8, 0x103, 0x6, 0x0, 0x0) ioctl$sock_netrom_SIOCADDRT(r8, 0x890b, &(0x7f0000000300)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x9, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x82e, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005000100040000000600180000100000060019"], 0x4c}}, 0x0) 2.619486785s ago: executing program 3 (id=4166): socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000100000000200000cc00000000000011"], 0xfdef) 2.394160143s ago: executing program 3 (id=4169): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmsg$sock(r0, &(0x7f0000003280)={0x0, 0x0, &(0x7f00000031c0)=[{&(0x7f0000000200)}, {&(0x7f0000000580)="d3aff98c799e1117fc0c4b05c9301ad5a9d900c068df1e79f1ef15206839a5f75aa514710cc8d87079da4aba8c888927d658f1389b9ed9094479527e7756573769ac7437116c0e92de321a91af2c7f7fe5ddf53b4813a3d79b50b513addcc3dc263ef59d3016a441f122049148435a0d50a50273cfad26ce743600b9f949fc413eee2526cba054bba338096a847596846874e7c8e24f9f79", 0x98}, {&(0x7f00000007c0)="efa22c92f1b98896dd645065f664b4c40ff60aa73ad6bed84cffce272109f017e72023252313e9c54477bae160bceac7617378f51248ee5e9f5aa58574f5ce885d098c7460136dabff4088311f758f23d450b893d45ca6be1a19547c70962d0bfff49e6966466f4ccf7a0504b22964d0826b550b583298a873076a854c79c8579ef6a45a426b16d76e836033ee474bad59aacb7d6e6420068f943502d5a5043f37db22c7ff0424129b31e3d370168e161c397d4bbb4738e04f", 0xb9}, {&(0x7f0000000880)="0f669f76f33c5229331eaa29f5b297e44f0509d11a76cae2890fa8d683c7", 0x1e}, {&(0x7f0000002180)="4039f5b15c6da1d68b5c8add50349ae5039c4457edfe9969a7174a4814c273158acd6b243d4c7000740ce6e640688a0b292b9551aac5c7f8c2fb20a408269b612c975d65df4bbc69c81f26443b513edf7bc900f9c02372f52829b68c3fff7e86d16a24bc60cda2ebb238dc3ebf13a6a1b1c45fe1a376605d286991e31a7ecd639066a919671665e78eb1ed2690db55f3482022efe90544ea64e6eeb01b23d3124ccd97131efe1fe092ad479094f4a8fa991186a3ba9d3ca7689e202d6645a42c3239a67a6a29fbd2e6fee1cb4345b7e9a7a12147a3eda9f596edf65ff479fea715fd3b1f80a4161e6a41c45aed70701b1bb1a53f235727d20c1f6a91d4d010d53f1b293a531cc23c2f231ae24ba06688e48af3823ae695782f7d95267b2a3dde5e551bbbae443503151b4f5cb523545247a55f1a51bccb55dd6a472ffae440255cde3e432e6da2ed37b79951bbac678d843028a6a93a590c0fca92f6f26220b3157c82fa43bd64b1e44e4f812d94bb22bfdbd4a931f6510a5f9a01bf8e5f8ca47b6bb3020d366819e5be47f534807432175576a0230f513ca567fdedf4b8fc5ee45f0842130e2857d42a2a666afd848ffc142e0a8c141067cef04ca2361a699dc8226e8f2f2efd5015149d61b6976519bb550ef633fdfe5879a519fb20c0b54d16b3a015e50c54f064", 0x1e9}], 0x5, &(0x7f0000003240)}, 0x4000000) 2.166074355s ago: executing program 1 (id=4172): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x114}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x3, @mcast1={0xff, 0x4}}, 0x1c) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="a0"], 0xffd8}}, 0x4000000) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000580)={0x44, 0x1, 0x1, 0x101, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xd}]}]}, 0x44}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x5, &(0x7f0000000040)=0x7, 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000071041d000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x58, r6, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback=0xac1414aa}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x58}}, 0x0) bind$alg(r4, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r7 = accept4(r4, 0x0, 0x0, 0x80000) sendmsg$alg(r7, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r7, &(0x7f0000004600)=[{{0x0, 0x0, &(0x7f0000002100)=[{0x0, 0xd}], 0x36}, 0x3b83}], 0x1, 0x20001000, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r8, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r3, 0x0, 0x0) sendmsg$tipc(r8, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}, 0x8820) close(r3) 2.165366312s ago: executing program 2 (id=4174): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x13, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe000000007110b900000000001d300200000000004704000001ed030407030000030000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c", @ANYRESOCT=0x0, @ANYRESDEC], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4}, 0x8, 0x10, &(0x7f0000000000)={0x4}, 0x10}, 0x43) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x8000, @multicast2}, 0x10) (async, rerun: 32) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@empty, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x20, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x0, 0x1}, {}, 0x0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x0, 0x33}, 0x2, @in6=@loopback, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) (rerun: 32) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0700000004000000000100000100000028000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000005554fca6f8b954c6d00000000000"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r1, &(0x7f0000000300), 0x0}, 0x20) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000f00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async, rerun: 64) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) (rerun: 64) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32=0x1, @ANYRES32=r5, @ANYBLOB='.\x00\x00\x00'], 0x20) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)=ANY=[], 0x20) r6 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), r6) (async) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="740000000206010300000000000000000a004000120003006269746d61703a69702c6d616300dfbf05000400000000000900020073797a3000000000280007801800028014000240ff0100000000000000000000000000010c00018008000140ac1414aa05000500020000000500010007"], 0x74}}, 0x8000) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x50, 0x24, 0x200, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0x1ff, 0x4, 0x0, 0x0, 0xfffffffd, 0x8}, [@TCA_NETEM_LOSS={0x4}]}}}]}, 0x50}}, 0x0) sendto$packet(r2, &(0x7f00000002c0)="44c33b69ebc9e05e9bdec0c288a8", 0x12, 0x830, &(0x7f0000000440)={0x11, 0x0, r8, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xe}}, 0x14) (async, rerun: 32) r9 = socket$can_raw(0x1d, 0x3, 0x1) (rerun: 32) setsockopt$CAN_RAW_ERR_FILTER(r9, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) (async) setsockopt$CAN_RAW_FD_FRAMES(r9, 0x65, 0x5, &(0x7f0000000200)=0x1, 0x4) (async, rerun: 32) socket$packet(0x11, 0x2, 0x300) (rerun: 32) 1.82797217s ago: executing program 1 (id=4176): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000003000000003800000700000011000000", @ANYRES32, @ANYBLOB="4079470a77ccffffffffffffffff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x38) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r1, 0x84, 0x85, &(0x7f0000000100)=""/4100, &(0x7f00000000c0)=0x1004) r2 = socket(0x10, 0x3, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) listen(r2, 0xfffffe01) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000001c0)={0x1d, r4}, 0x10) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r0, 0x6628) write(r3, &(0x7f00000002c0)="1948896db371f0513422080b07", 0xd) sendmsg$tipc(r2, &(0x7f0000000400)={&(0x7f0000000080)=@id={0x1e, 0x3, 0x3, {0x4e66, 0x1}}, 0x10, &(0x7f0000000280)=[{&(0x7f00000000c0)="6f57384c0e0f982c9a77bd387048018dc119ffae53a56240dfbc0ba42e51b3db201c3b966c6472b44b11b8d89a23926a5938fdfe3a4c6b31b61d75073c3e2df8c0e65e40651d2c4f", 0x48}, {&(0x7f0000000200)="9093c4eaaf8eaa009fa1c46f01cd3b83bba8a1f2f543285c12820e578d6ef82987ffe66ef3c5e4efcd6205b489fc10f255fb1ce56ae37641405216ff2457e63a2757f3427309f8d3f89f52a167", 0x2b}], 0x2, &(0x7f00000003c0)="aa51c168cbcda5fd44ef43687bea6a10000000007687783b000000090000000000000000", 0x24, 0x70008001}, 0x40a0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="09000000170000000a0000004000000042000000", @ANYRES32=0x1, @ANYBLOB="05000004000000000000000000f2000000000000", @ANYRES32=r3, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000580), 0x1000, r6}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={r6, &(0x7f00000017c0), &(0x7f0000001480)=""/93}, 0x20) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000001140)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newtfilter={0x60, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0x7}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x30, 0x2, [@TCA_BASIC_EMATCHES={0x2c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_META={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_LVALUE={0x4, 0x2, [@TCF_META_TYPE_VAR]}, @TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0x6, 0x2}, {0x5, 0x40}}}]}}]}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$netlink(0x10, 0x3, 0x4) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T4(r8, 0x103, 0x6, 0x0, 0x0) ioctl$sock_netrom_SIOCADDRT(r8, 0x890b, &(0x7f0000000300)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x9, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x82e, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005000100040000000600180000100000060019"], 0x4c}}, 0x0) 1.641338324s ago: executing program 2 (id=4179): socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001000000ff800000cc00000000000011"], 0xfdef) 1.474351084s ago: executing program 3 (id=4181): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @broadcast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200504, 0x0) close(r4) r5 = socket$unix(0x1, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r8, &(0x7f0000000140)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x0, @local}}, 0x24) bind$rxrpc(r8, &(0x7f0000000100)=@in4={0x21, 0x400, 0x2, 0x10, {0x2, 0x0, @private=0xa010103}}, 0x24) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000)=0x0, &(0x7f0000000200)=0x4) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@getqdisc={0x28, 0x26, 0x20, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x9, 0xe}, {0xfff1, 0xfff1}, {0xffe0, 0xfff3}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0x3, 0xb}, {0xfff3, 0x6}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xb, 0x8, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x6008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.47360484s ago: executing program 1 (id=4182): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x800}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x30, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r1 = socket$inet(0x2, 0xa, 0x3) getsockname$inet(r1, 0x0, &(0x7f0000000040)) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0xc0) ioctl$XFS_IOC_GETBMAPA(r3, 0xc020582c, &(0x7f0000000180)={0x6, 0x2, 0x200, 0x8, 0x4}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.377280275s ago: executing program 2 (id=4184): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fbffffff000000000000000085000000a40000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) (async) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg(r2, &(0x7f0000002cc0)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000000)="8f4b", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001640)="a919fb1d", 0x4}], 0x1, &(0x7f0000001a40)=[{0x10, 0x1, 0x8}], 0x10}}], 0x2, 0x20) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newqdisc={0x178, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x148, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_LIMIT={0x8, 0x5, 0x7}, @TCA_GRED_PARMS={0x38, 0x1, {0x0, 0x5, 0x642f, 0xa, 0xb, 0x4, 0x2, 0xc, 0x7, 0x2, 0x19, 0xc, 0x19, 0x1, 0x401, 0x81}}]}}]}, 0x178}}, 0x24008004) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000009c0), r6) sendmsg$NLBL_MGMT_C_REMOVE(r6, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000a00)={0x14, r7, 0x1, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x8405d22596f37403}, 0x4054) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x4c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_FEATURES_WANTED={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}]}]}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r10 = socket$inet_udp(0x2, 0x2, 0x0) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002300)={0x1c, 0x34, 0x107, 0xffffffff, 0xfffffffe, {0x4, 0x7c}, [@nested={0x8, 0x4, 0x0, 0x1, [@nested={0x4, 0x149}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) setsockopt$inet_int(r10, 0x0, 0x17, &(0x7f0000000180)=0xfff, 0x2) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000640)={r1, &(0x7f0000000340)="1a3711d309d2a5c08317552f729ac6b828b6d590a24f2b56f97ad1b2df3e1d1a864655a8d2ac0cdb89dea4ede629bbe56ebce7ac89b79848b5e5cf7a60aea061558dbb14958dbc77016ebb8f6f0766a76c30097301955e61fd06b8dfbd60c554b274639505fee4a388ac318798d5f25042ef32a047fb2a5da933432d3116cf7ce0d2e5c50c71d40fede5a14e2817aed6e8529e7474d132d6c53cc62e7b5dee68990f2c0a1d351b7150680de1d55d358b8eb7e6642e70e26fac281801f71dc3a831b9ba1c2eb65812d7b507d4c01aca9011685a01422ccc6af3bfd45652082e3c75695c1e2d3f6c1d", &(0x7f0000000580)=""/160}, 0x20) (async) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000100)={0x0, 0x7}, &(0x7f0000000140)=0x8) (async) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) (async) r14 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x403, 0xfffffff9, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x19c04, 0x55007}, [@IFLA_NET_NS_PID={0x8}, @IFLA_IFNAME={0xfffffff3, 0x3, 'veth0_virt_wifi\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4802}, 0x0) setsockopt$inet_buf(r14, 0x0, 0x2a, &(0x7f0000000200)="cf48eb3607b2d0015417129147fcc54f71089d98fe9dada6fe572df4b44e52d9f283951e40b5c53f8fb2098337d1bd51", 0x30) (async) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000280)={r12, 0xb3, "3dd7d67dafa730d0d2ca71d0908e60735e2054477c90e2c76cbefd1f2d0780619718418199a40d44d58a46fb25f939f4cc60dd03104006de584882111d6ec60cdec352391386bb6d8188f1356ab50406092bf938b215bae2f6e8b01976714fd2ff669eb1dc14ccd180c3f0e757b369c167598bfe071ab123a3970c008df871dc907ac6e125142fb29ebfbf3ffedcab06cacd8662c1f1c8ca139d57ab91f27d68e2f182021f83aa174546a0ee5e4399185b23bd"}, &(0x7f0000000180)=0xbb) 1.287578404s ago: executing program 1 (id=4185): r0 = epoll_create(0x9) epoll_pwait(r0, &(0x7f0000000180)=[{}], 0x1, 0x3, &(0x7f0000000200)={[0xff]}, 0x8) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000100)) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000440)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0x7, 0x0, 0x2}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x100000}]}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x58}}, 0x8000) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000000000)) (async) ioctl$PPPIOCSACTIVE(r2, 0x40107446, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x1, 0x8eb4}]}) close(0x3) (async) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0xffffffff, [{0x1, 0x3, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x3a, 0x0, 0x6}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x5, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0xef}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x2a}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x8000) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) (async) recvmmsg(r1, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) 1.227273157s ago: executing program 2 (id=4186): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000498000/0x4000)=nil, 0x4000, 0x2000002, 0x13, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r1, 0x913e0000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d5000/0x2000)=nil, 0x2000, 0x3, 0x28011, r2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x3c, 0x68, 0x1, 0x0, 0x25dfdbfd, {0x2}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x4}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @LWTUNNEL_IP6_HOPLIMIT={0x5, 0x4, 0x1}}, @NHA_ID={0x8, 0x6, 0xf2}, @NHA_OIF={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4402}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd1400fcdbdf250900020073797a30000000000800410072786500140033006c6f00"/56], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) setsockopt$inet_tcp_int(r6, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r6, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x2c020400) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f00000000c0)=0x3, 0x4) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000580)={'veth1_to_bond\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r8, r10, 0x25, 0x2, @val=@perf_event={0x11}}, 0x18) r11 = socket$igmp(0x2, 0x3, 0x2) setsockopt$IP_VS_SO_SET_STOPDAEMON(r11, 0x0, 0x48c, &(0x7f00000011c0)={0x2, 'veth0_to_hsr\x00'}, 0x18) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002a40), r12) sendmsg$NLBL_MGMT_C_REMOVEDEF(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00', @ANYRES16=r13, @ANYBLOB="010039bd7000fedbdf250500000017bf401ba547deb67bd58fc4ec2bade4dc82b708000000bcd1157533d1709193932e3df8135470c048daf2df28f4c3035c6305827ae6270af7fcd7b6845f8118159f7ffcd7adecdbf5bbef681e60cc3aed6778400c8514f6827072e172feda934c28b877be01234a794940db7c794db5776c3625ad8d80461a742bc072e55dded3850420bbb08c4e1a2067ad3bb294a492e1056bb40609fd4cd6574846f9c36ec2665bb0dd135cea4a2afe53936b9c0d3e48c5562e97524b0630d299240c5fdca1ff1df2d1880236e22a6c3c9c0b03f00c3200000000"], 0x14}, 0x1, 0x0, 0x0, 0x4044080}, 0x4c080) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={0x20, 0x1418, 0x1, 0x2, 0x3, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x8}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) 1.03965454s ago: executing program 3 (id=4187): socket$packet(0x11, 0x3, 0x300) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x439, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, 0x49811, 0x49841}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @local}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x40}}, 0x0) r2 = socket(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000050000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa10000e3ffffff06010000f8ffffffb7020000050000000000000000008500000072000000850000000e0000009500000000000000e6013d895cfac0e319f7233cc3da4759dce2fb4050605e1dc8a6897c30e5bd5d3d821e34a62a61f2b346823e31a3c3f2860735f733af196823b0f4c899dc6c407f67c301b5acceaa4e304bf9fdc80fc8cd8db6bc0aaab50fe807e1b086268f7eb4612b6263acec43a93dc2c353c217c5fa162134f16169ad4274ae736a3f06cdeaf0a9281ec6fd4684372c23c86f2701ef0b9c00004221c4ee1288"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000480)={r3}, 0xc) r4 = socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000d30000/0x3000)=nil, 0x3000, 0x0, 0x12, r5, 0x0) mmap(&(0x7f0000f6e000/0x1000)=nil, 0x1000, 0x3000006, 0x12, r5, 0x5c2a7000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x275a, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000003, 0x28011, r6, 0xac9d4000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9, 0x32, 0xffffffffffffffff, 0x59449000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d40)=@newqdisc={0x80, 0x24, 0x100, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x50, 0x2, {{0x80, 0x0, 0x8004, 0x3, 0xffffbc6e}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x1000, 0x7, 0x0, 0x7, 0x2, 0xfffffffffffffffb}}, @TCA_NETEM_ECN={0x8, 0x7, 0x1}]}}}]}, 0x80}}, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e01, 0x5, @loopback, 0xa}}, 0x0, 0x0, 0x3d, 0x0, "bb02a3c364ca41d6357e544524474004000b42a21d7214bf92494925208a0e2f964e0000c534a6324d6193fcf19b2df3ee818afaa4ff1f56c54dc46d8b6d2ccd008aa0cc1dc2767bbe00"}, 0xd8) r8 = socket$kcm(0x23, 0x5, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r8, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r8, 0x800) syz_emit_ethernet(0x5e, &(0x7f00000003c0)=ANY=[@ANYBLOB="e33110495bfdaaaaaaaaaa0001000000000000803afffe"], 0x0) accept4(r8, 0x0, 0x0, 0x80000) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) 949.293572ms ago: executing program 2 (id=4188): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8}]}, @NFT_MSG_DELSET={0x2c, 0xb, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x90}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 882.239528ms ago: executing program 1 (id=4189): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYRESHEX=r0], 0x2c}}, 0x41) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x4, 0x2, 0x2, 0x0, 0x1}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x2020600) r3 = socket(0x28, 0x5, 0x0) r4 = socket(0x28, 0x805, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0xfffffffe, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x1d}, {@in6=@private1, 0xfe, 0x32}, @in=@remote, {0x0, 0x0, 0x0, 0x8, 0x0, 0x9, 0x0, 0x543}, {0x4, 0x7fffffffffffffff}, {0x2}, 0x70bd2c, 0x3500, 0xa, 0x1, 0x0, 0x50}, [@encap={0x1c, 0x4, {0x2, 0x4e24, 0x4e24, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r4, 0x7) connect$vsock_stream(r3, &(0x7f0000000000), 0x10) r6 = accept4$unix(r4, 0x0, 0x0, 0x0) recvfrom$unix(r6, &(0x7f0000000140)=""/129, 0x81, 0x40000002, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r7], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r8, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b00860000f900437a00000000", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000800000091104e000000000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 881.947476ms ago: executing program 4 (id=4190): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@alg={0xe8, 0x10, 0x1, 0x70bd2d, 0x25dfdbfd, {{'xts(twofish)\x00'}, '\x00', '\x00', 0x400, 0x3000}, [{0x8, 0x1, 0x80000001}]}, 0xe8}, 0x1, 0x0, 0x0, 0x44}, 0x80) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x8, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5}, @IFLA_GTP_LOCAL6={0x14, 0x8, @empty}]}}}]}, 0x4c}}, 0x40) 797.62358ms ago: executing program 2 (id=4191): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmsg$sock(r0, &(0x7f0000003280)={0x0, 0x0, &(0x7f00000031c0)=[{&(0x7f0000000200)}, {&(0x7f0000000580)="d3aff98c799e1117fc0c4b05c9301ad5a9d900c068df1e79f1ef15206839a5f75aa514710cc8d87079da4aba8c888927d658f1389b9ed9094479527e7756573769ac7437116c0e92de321a91af2c7f7fe5ddf53b4813a3d79b50b513addcc3dc263ef59d3016a441f122049148435a0d50a50273cfad26ce743600b9f949fc413eee2526cba054bba338096a847596846874e7c8e24f9f79", 0x98}, {&(0x7f00000007c0)="efa22c92f1b98896dd645065f664b4c40ff60aa73ad6bed84cffce272109f017e72023252313e9c54477bae160bceac7617378f51248ee5e9f5aa58574f5ce885d098c7460136dabff4088311f758f23d450b893d45ca6be1a19547c70962d0bfff49e6966466f4ccf7a0504b22964d0826b550b583298a873076a854c79c8579ef6a45a426b16d76e836033ee474bad59aacb7d6e6420068f943502d5a5043f37db22c7ff0424129b31e3d370168e161c397d4bbb4738e04f", 0xb9}, {&(0x7f0000000880)="0f669f76f33c5229331eaa29f5b297e44f0509d11a76cae2890fa8d683c7", 0x1e}, {&(0x7f0000002180)="4039f5b15c6da1d68b5c8add50349ae5039c4457edfe9969a7174a4814c273158acd6b243d4c7000740ce6e640688a0b292b9551aac5c7f8c2fb20a408269b612c975d65df4bbc69c81f26443b513edf7bc900f9c02372f52829b68c3fff7e86d16a24bc60cda2ebb238dc3ebf13a6a1b1c45fe1a376605d286991e31a7ecd639066a919671665e78eb1ed2690db55f3482022efe90544ea64e6eeb01b23d3124ccd97131efe1fe092ad479094f4a8fa991186a3ba9d3ca7689e202d6645a42c3239a67a6a29fbd2e6fee1cb4345b7e9a7a12147a3eda9f596edf65ff479fea715fd3b1f80a4161e6a41c45aed70701b1bb1a53f235727d20c1f6a91d4d010d53f1b293a531cc23c2f231ae24ba06688e48af3823ae695782f7d95267b2a3dde5e551bbbae443503151b4f5cb523545247a55f1a51bccb55dd6a472ffae440255cde3e432e6da2ed37b79951bbac678d843028a6a93a590c0fca92f6f26220b3157c82fa43bd64b1e44e4f812d94bb22bfdbd4a931f6510a5f9a01bf8e5f8ca47b6bb3020d366819e5be47f534807432175576a0230f513ca567fdedf4b8fc5ee45f0842130e2857d42a2a666afd848ffc142e0a8c141067cef04ca2361a699dc8226e8f2f2efd5015149d61b6976519bb550ef633fdfe5879a519fb20c0b54d16b3a015e50c54f064", 0x1e9}], 0x5, &(0x7f0000003240)}, 0x4000000) 772.068639ms ago: executing program 4 (id=4192): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000140)={0x3, 0xf0d, 0x54, 0x1}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) setsockopt$MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000180)={{0xa, 0x4e22, 0x40, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6e8e}, {0xa, 0x4e21, 0x1ff, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x800}, 0x1, {[0x1, 0x8, 0x7f, 0x1, 0x5, 0x1, 0x2, 0x3]}}, 0x5c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0x0) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r4, &(0x7f0000000240)={@val={0x2f3a, 0x800}, @val={0x0, 0x3, 0x5, 0x1}, @ipv4=@tcp={{0x5, 0x4, 0x2, 0x2, 0xfc0, 0x68, 0x0, 0x5, 0x6, 0x0, @initdev={0xac, 0x1e, 0x3, 0x0}, @broadcast}, {{0x4e20, 0x4e21, 0x41424344, 0x41424344, 0x1, 0x0, 0x8, 0x2, 0x141a, 0x0, 0x15f1, {[@mptcp=@syn={0x1e, 0xc, 0x2, 0x1, 0x9, 0x4}]}}, {"b898f48a5203aec1c20360cd2ef7d58da55b659aa6992f305f3fb5d188f517abf96e559cce7d2282a54862bc80a51035e81c9f2d030a6cd6e7c83ed735fe91a467f79be2c7d85f7529eff6f03e92199b12eae0ad8d098f78165de6ccd711c6be47076c700a8a74e5b91a9355bb250b70cc5af2c4219f1cf2fa23910722a02956f3612fc9f024e77b9d745b22dacc05c41e125d6487e6ffd4ca8db7a1f2befb5708d551a43ad989dc418b24f8fefc9febd72b8504db532be5759ec8a0e4e48662c5f29dd566101c64946a9c9b8e12fd22f56093a80f345a106dc2b95ccb043f0131602e6ef13caddcc9fcfa2e40ab3b603ff5881f4fba3c8bbfffd05510a5952a6335b6e02fe85927bd050bfc265b2afd2735345a9380f5af87e6a3d2479fc06afc9252d7d28710570837daa46d2b942be5433f46ca6cc0efe65e5b874fede589d6026c20e28749a857eb0b9bd9157a247cde360572592da40909d903ef6c4c10cc06f59b45d0e0991bc820bfef700ca4e2b6aad5c32d2a8a807e9333e0eddec1c0ed393deb690e1b827db9f5da75dbc32874e5fcc5c76c05c0ec2fb1e8d5918cd09023865e9008cca311ed9672237bcf925fa09ae410683726998bf0ef51937e764e55a09e009429c8eeae288eda500541b7a33d29d492493084ba2c0a89dc61126d3fae08440bb57473adfdeadb98bdada889ebc36ae25649e5b7187e0d2dd011b39e037f3cad6e0e2161ab344173e125545945b1debe71f24213f581df639d486bf77ccc6da56997708b76eb6cbde470ad004fbfb84e8d1495a2d7bb544f282dad56316b50472015c74847e3209ef4a6edbff327ec99dd0288214d9329f433bc71698808201bf0a769d608fac5faf16c32a09c34750040d9d19aa8b4071c051338527952e5afcfd2e33a14d9f123c6dd5f1a3c47583ff6e3c154eff46c1942bbc357add5253d96f5b6dc6e440271a377b03db190ed081e2989dec4a839e1c2d7fecfaa2459f62151b9ef4716fbc15fd86812763fbaf38e4d5af6d0c8b830436770819361104f30bd8ba795f9104dfb7370d1c6940819d6432b159fbbe633a093ff4dc3c44c4623e16eddb6151ef904fc96b87957ab22230dd6c2458fbaa438d3c222c055ce4253db8fdda2077f0159fddc1306b0277d122c51cc577b2b6dee459f1bf28c6d94178a0fc3e382f6b58e1db6cda5eca7dc0720e61d59ec794a02295ccdeedc811457e30e8548a8be271c69f0cbfd08fdcfa281ec3b1ea7bb2ff784be0a732344cc0978b37507d448330149537f1de512d4952e2d6a8901be7bf9c8497ffdc3910096e2ef5c2d056f909621f1c8c90702c9469fcfb9ccda91123da96c4c8381718624e74948ce35b4ddc47982d392d84fe377a0e4edcf34f4bc814d12a5fee04ed6750b074fd046a47c59b84c6d465bce16101ced3d8f6b8a9d1d8b96f730569dd4bce831c188c236b5c600349932d42d846dbd6d5ecd07a89c6f535237567aebd4eb12bbfe5120e0c0e5f077005394e71772d796bbe82be4e014c63c8a1c4bbbddf186d94eb73313e91a97ce8ade5c6ec3defd412842f1afc7c642bbb94ce29a16ea298291519a5f5a6f5782a17fcd9af20699f70307270c5b6f88606c986aae6766130d63278b64a09fa4850ec92b72d2e19f1b8a305c237061af9f85ea6d2d33ea5c77754eaaa0b221e7883da6e95d6f031f033df057faa24c078a7ad1e922f371b076d7b492d5837f6f4a0980f882b160f581f2fdd551baf1fdccfb2677871eb55bdaf8c6c158bb9ae0684fec562045ba365ff7443c60e7381d0ffa426b98640bc6f95b8191dc2e14cec948871d5fbbfe46c6f669c1a4f98dc4cfdebe8bca4fd627acb475c9c80875d766c976116e7a2245088cc70a51242756710a6164e417d4fe7f2bb4f878df548598021f246492211d9c780a9d66b47c19e4924f2ba392a54ddbf73d61eab4c45dfa3510f705bd23c0ecc7210b3f982e328142f74e10edce9677990b862965594b9c671dc0e7c193b7df65de53f953e53ec0789a36c0895cf063ff0d2711b28e177d457192493454d07ad162c8f4a2db7db5761928fdb45311a44be6af7e170b3dd38783ceb9c5745deb957f6fc1cc073d7abe2cc5c58c29136b89c745085304457ce9e1394b1c4de3c664fa843c5183e45f65137e57b627a9938dfcb3cdf60829e5d8014534df04da80c53613a419d8811a4cc9f8a483a3488f942b1e9f69730f9861b70d6e42efbb147ce969854a56877c64a9c5e7e3852994d8d36b86aadc74c3b765307af433c23b0e963f95966beb7cc859bcf9217a52df243a41532cb4b0b316677db0104f12aca9fee6fd5908169451b0fcccf0cfdfbf3de802cc2488a532d5d7de6582c5645160c5ef673d2c95d5b8b2d99ed9486c069798f13c14eab4c99fd509fa9f879d18a5f0bdefd8f44ad0c9280ca9335ed661cb6cc22264f95e1f3443b41a044e4a15ab73f20bed9f6caa6bf231351fd882c11320e40f61718d4c43e99f98a72b459e9ce6eab66903a4ca67560e6c3579c558140e9a035d380b21064f70ed5ad62be784e4f75619fe92a4b6c22438a5907bb234570b962389228a9a454caa0579253a8d697dd890663f0bbed83e2c249dcab4db3d4124202abed769bbc90aa21ae521d9153352bec7eb6e0623fe9486bb2c1dbda0726daa64343304e6b878f768404848e5df3be0f1838f71a232cc8737fbc62172c7ee73306edf0b621e76ef35d76c86473926f47bfaaf943abcf63a81449006583ecfbbc3c498f5dd176bbff6e4e51134ffa5b92dcf4719cb789c9fec63955607da72b335ef7fe1c12dc9cdf44a9e83d7ab5a51977ba1168354a1e89bc5e420329c5864393bd3c72cd9f2c9d7b8e79f661a37f4a03105e77aaa28f4978f44abc4f89c458080e93cfaa043c105f396badc033d12dbed823a2e4d24406c7b77cd33630e6257d21a27857beaad037c1031a319d79e6103e1b7600ad9d418e5af02d372d0ddd5e328edf7245b7907632eae607992a8048a24721e8ce32a5be8adc4704c58de99613bf254d0448c452b7e81fdfd8b3c1b3ff8d573678448aef089e5477e1174bc424c77b08bf81144faadd289d04a02fc19cab03ff2cee402693fb215c4b4b12afcbc532646eed43aa6408df1b2d738e611d5082053882b5a69e0e6ae967c89ebb2980c933c04337acac94130de8e1e99acb3878685a4d0e3f7c95179f4e8d6674ced26a91099da84fa0ff485a0cab23b35de4f8091a22e22a969d1daf17549b092b0353468b3d0918f514a1248a3d4a19767bf037cff673771fa22c6ee4952728a8126eac03e50aece013d0c59bb9bc230c48f3115b37a482bae47ca56f8b10419f78195ec89dbd381a04a7ffb645ad53f60783d4997d7cab42591735ad56d565d33325715e2fc29ed8c64869485fd6e14136f4a5f66681668b519c749a790b6417a853ef04015aeeefc48bd85aa351186f728b5f1b0183c03d2168d52dbed1ce13aa3c673458dabeed746d513593b6c561a79f399b498396fd94473aa2acea127591eeeff8f691dddf95288e06203c1e779ba7f5b2b7764e8aad4a44e547d5470193acfbfac984bdda75d8b35eb2258abdcf47ee7df549d499204d19c0b89a91f1aef847f375b5cf1f0829d538d14361327073c0edb6605810f330c401270c8eb35eb97aed751feb21211a51a9031ed386fa1598618a38ae9a1c86ae64c84727b1864f64b4da71a7a3195c2757fed49945d63458d89cf5c536bdd441f3f265fc9d61a554087a9b2b83660c0c17e15d9d1d40065ba244453fb08b4ea027e3301ea254513633704ca1a496c7ad2227ca99cf07c58b1c11deb9216e940e2e1243d75b4a6882e84581cc727bcfea0d20d39cb545830a99da07659b347922df1f29ca7496e493826fac4b8f1d641fee7460e99fccd8672473e59a6c240d09a541e460e5f2945776c707212bb33a5ee5051961f21592d9ea3ae018b8fbc2140e6151f14ff033a6dbb1afbddd684b6a9d5f29b7f273b430dab91c53cd89e191adc78c7ce20bb4340425531cfc23f119a5eab1d7c73bc703b7fba48c8038c068df1f77eda5e18b2f2609d9d99de2768349987ba51cb98f698797051844c0c8637bf2f7ffac991ccf95e1b5eae9d7d25e7f3e0bdc788d99754a8be1baddafc4f0914f1a05bf8bec1a40bd2135539150da59d4163c67a575bc6dd7f2f786114c372842795601e8569e28c949e8bdc96e5a43cb6639dedf1ef1f054e0d42589a16d30e296b6dfdac6e13a6c68e03bd39dc172b6007b01793ceafa13c6379d2b820e98e9e87891e3bbdc688f62c56ef80c67ad066a53e36141af58fa9734429498580dc6d32d1c2e8cc722b4f9dd9d165d07b7b536c398df39dee06f48ad422492fe1777619f49e153ad276c86fbf8f607e7b1e9d6040889f166eb8a73ddba4668d6618b31c36b6427b1cd3cb97ef268ec1f1b049a35bceddff9147fde7309db0c474be42a6d54150172df4d5614106ea5f134cf543a70105a0a75f649d6de1a9bd3858bcccf3b220886ea6a7702dbe7f17e03a022a0ffc5145da4895bcb41da3fc5a2a10bc7b2a70a3a86ef8fa600d24894260cdbbf3c36313f3b1e9e8096921b625cb9c7f3ab8423277c9b80743a2185c95e9e7fb3f6d63669257fac197b7a73c5a4a2c4a2df52af705b46b56ade64c8a4265373a770676ec7fe3738843402f63a79f0ddb59e4bf439e4eac709a0127e9588e1538872af3916a12a1a850206392c16e17fab5a7d72bc3e9caad7bab64481728861016c124888210d06e31005ffbd39a65abbf69ce1683de2bb9f90e4955deb7afd23e90e3e11fcbd55627ab48cea806cf5da35e094bbaab42dbbdb454599a6659c2ce10845dc2beba123ae01f043c8c13c463634546e3fc913360adf2441ce3753840af235b0828ee6f74bac40d08d7b8dd8828af44a577e52e9adc86d895e1e561881320091c18bf7c466c945c4872dfc884858f5d710e0f9786878e09a906896308135097da35e465e140f22171878a42f3fe2f0872656b4ffbacc54dd99baef3c58450f1d585e3e3b8c1a9bf0f6afb9858fd6f58791382ff65d926d49f5e02abc84bd4df49ed5beec83517fbf782f983353398063831a1a4668afd7bbe2275c712497686ccff4c447f34cb4dd6b5af0f2e517fea11783d265db2c6dacb393fa3e2d484c3a62c516fe24294ca324bea8095265d560c6f68ae278c7bc34afb7309eb96fbf851af3616fd07e335d010804e60e44a57d38a2d79a19a5f9b22daec534d0379b3fe8a3a6cd8c63b585dcf00abef832b402fd3c0dd95037bb5be517b14ac6627408ba35f15cc4aa0fa96d888baa2d82b4efdf27a018330cca8a83eb587ca8a2536bdd5ab7d783044c76166d27c15299cbe3d82a612236157d25c73b19a3f454309500822206d9ea91f77ea58291d3527f85fcd7f44f1dd4bec1fdd26ee5bbc11620a62fc8c6887904b9f3bde3c640b7e4ba801f49f90e191ade5df7d39f0999a2b5e32f3385c0ec657c6ea6da3bc3d417b3b3856f92bcbbf0eb30ef02715a53dfece840180678d156e79d8149987a1172212529cec710a2bed59478371ab88b8c769ae17b8cf8b1f3d"}}}}, 0xfce) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001c00357428bd7000fed3df2502000000", @ANYRES32=r7, @ANYBLOB="080026040a000100000000000000000008000f0005"], 0x30}, 0x1, 0x0, 0x0, 0x240400c0}, 0x80c0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r9 = socket$rds(0x15, 0x5, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) r11 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r10, 0x890b, &(0x7f0000000440)={@private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x5, 0x0, 0x600, 0x3, 0x20d70022, r12}) bind$rds(r9, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r9, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0xfffffedf}], 0x1}, 0x0) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r13, 0x84, 0x24, &(0x7f0000000040)=ANY=[], 0x1000f) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newtaction={0x64, 0x30, 0x9e54f29ff072a93b, 0x0, 0x0, {}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x32, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x13, 0x1, {{0x0, 0x0, 0x0, 0x12000000, 0x6}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) syz_emit_ethernet(0x131, &(0x7f0000000800)=ANY=[@ANYBLOB="104e5875ff62ffffffffffff08004fec012300680000ff329078e0000001ac1414bb0727a7ac1414aa0a41010000000000e0000001ac1e0101e0000001ac1e0101ffffffff000000000085c194a88a812ea1e62bade7a0e8eddf5ebe00b6b51808d15104b0d56e76023a59c574bf52e266b4274f95cfc12ce1c35cdaedd3297b9727da81e0287876c298828fa83a359fbd686231898be379f7cfc8edf2f6ba9a7481c2f31a47115b8a51ee4c9fd11b5880f46e459161e819cc776c9237565c892949cc793ca82095e11527096c4734c32336f14d66b293d4a8c05e41d6b1cf18065a1da01fec8c7a83e5a367fa83d594e4284ffdb6533c548964d5dbe1e9804348d72f69256a8eb77aa607ec632f1f553eb1b1b95a30aac11ec93a0d200ff4c72019917b15ead2d2132793f6b1037fbb089bdbbd8a0380396f26fb9f0601d2baebee269e89d940ca87e656632a7a42414efa47e12733da46d4271d72097b7cbcc389aa66718c61e857ae9b91ea262554cf41b79de39215ebde19b7f501ab114baa986affd01f381462aa8a2c0e451838ef5d110a92680d7a0dcfeffafc88"], &(0x7f0000000600)={0x0, 0x1, [0xee9, 0xa7, 0x4d6, 0xf1e]}) 561.795762ms ago: executing program 4 (id=4193): r0 = socket(0xa, 0x3, 0xff) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000240)=0x40c8, 0x4) (async) sendmsg$inet6(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0xa, 0xa, 0x8, @dev={0xfe, 0x80, '\x00', 0x28}, 0x6}, 0x1c, &(0x7f0000000480)}, 0x20008b88) (async) recvfrom(r0, &(0x7f0000000000)=""/97, 0x61, 0x10062, &(0x7f0000000180)=@in6={0xa, 0x4e22, 0x1, @private1, 0x10}, 0x80) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) (async) r6 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/net\x00') sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010c25bd7000ffdbdf251400000008001d00", @ANYRES32=r6, @ANYBLOB="08000300", @ANYRES32=r5], 0x24}, 0x1, 0x0, 0x0, 0x20040801}, 0x20000004) sendmsg$NL802154_CMD_SET_CHANNEL(r1, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, r2, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x13}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000}, 0xc080) (async) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a00)=@newqdisc={0x1b4, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xffff}, {0xfff2, 0xc}}, [@qdisc_kind_options=@q_mq={0x7}, @TCA_STAB={0x128, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xb, 0x7, 0x1, 0x6, 0x2, 0x0, 0x3, 0x5}}, {0xe, 0x2, [0xfff8, 0x7, 0x900, 0xffda, 0x6]}}, {{0x1c, 0x1, {0x0, 0x10, 0xf6cf, 0x3, 0x0, 0x3ff, 0x5e, 0x3}}, {0xa, 0x2, [0x10, 0xc47, 0x1]}}, {{0x1c, 0x1, {0x7, 0xac, 0x1, 0x10001, 0x2, 0x5a1a, 0x1ff, 0x5}}, {0xe, 0x2, [0x101, 0x3, 0x6, 0x5a, 0x7]}}, {{0x1c, 0x1, {0x0, 0x2, 0x12, 0xfff, 0x2, 0x5, 0xa, 0x1}}, {0x6, 0x2, [0x8]}}, {{0x1c, 0x1, {0x6, 0x7, 0xfff8, 0x4, 0x0, 0x4, 0x9, 0x6}}, {0x10, 0x2, [0x9, 0x0, 0x9, 0x0, 0x2d15, 0xba]}}, {{0x1c, 0x1, {0x7, 0x4e, 0x7ff, 0x7ff, 0x1, 0xc, 0x6, 0x6}}, {0x10, 0x2, [0x2, 0x1000, 0x794, 0x2, 0x0, 0x8]}}, {{0x1c, 0x1, {0xc, 0xf2, 0x4, 0x5, 0x0, 0x3, 0xffff8000, 0x4}}, {0xc, 0x2, [0x800, 0xebb, 0x8001, 0x8000]}}]}, @TCA_STAB={0x58, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0xd, 0x3f, 0x0, 0x8, 0xfff, 0x5}}, {0xe, 0x2, [0x9, 0x2, 0x4, 0x9, 0xfffb]}}, {{0x2a, 0x1, {0x0, 0xff, 0x9, 0x26b2, 0x2, 0x7, 0x5, 0x3}}, {0xa, 0x2, [0x5d57, 0xfb, 0x5]}}]}, @TCA_RATE={0x6, 0x5, {0x1, 0x8}}]}, 0x1b4}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) syz_emit_ethernet(0x4e, &(0x7f0000000680)={@multicast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x18, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @local}}}}}}, 0x0) 476.219248ms ago: executing program 4 (id=4194): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000080)={@local, @rand_addr=0x64010102, 0x10, 0x3}}) unshare(0x400) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x2d, 0x2, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000880)={r2, @in6={{0x2, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x66}}, 0x1}}}, &(0x7f0000000300)=0x90) connect$qrtr(r1, &(0x7f00000000c0)={0x2d, 0xfffffffffffffff9, 0x7fff}, 0xc) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140)={[{0x2b, 'devices'}, {0x2d, 'rlimit'}]}, 0x11) 328.951858ms ago: executing program 4 (id=4195): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r1 = socket$kcm(0x2d, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) r3 = socket$packet(0x11, 0x3, 0x300) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="18110000", @ANYRES32, @ANYBLOB="0000000000000000b702000004000000850000008600000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="19000000090000000000000008000000811581000000005e3757ccac8ebe05e0"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000040)=r4, 0x4) write(r2, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000090d5a3650126942b30e67", @ANYRES32=r0, @ANYRESOCT=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0x60, &(0x7f00000005c0)=ANY=[@ANYRES64=r1, @ANYBLOB="a7f80fa25f5a927e8ca2bd0a3e12a1e9c464c4423fd3ea76422e9484ea87ffa9827d16ed56309ea9fbf9ade75b7181978f5346bdd90debf024935cc76ca803d8bf57f341f6adbec3563a7efacfab28b2500be3995eb916b257ae0b39ad9b65aa2e8254df376ef7e6abf6f4e9a6063d27811f32dd463482e654ec4d05fdec9799acda8d3368a1fdfcf369fabcbc4d1cdddbb3ebe8c21f3b6dc72e50f5ea74687adba3cf78f806dd9c5b767ea786", @ANYBLOB="a2e150ae21f83dda56a6029de8bf5513fab3b40e", @ANYRES16=r0, @ANYRESOCT=r6], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030031000b05d25a806c8c6f94f90224fc600e0007000a000200053582c1", 0x20}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="bb00000031000b63ddd2006c8c6f59bab50100d0c96ffc6010", 0x19}], 0x1}, 0x4000000) r7 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000000040)=ANY=[], 0x18) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) socket$inet6_sctp(0xa, 0x7, 0x84) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket(0x2, 0x80000, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRES32=0x0, @ANYRES64=0x0], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x40000) socket$key(0xf, 0x3, 0x2) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$inet(r8, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) 1.635411ms ago: executing program 4 (id=4196): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmmsg(r1, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000840)=""/234, 0xea}, {&(0x7f0000003380)=""/4094, 0xffe}], 0x2}, 0xfffffffc}, {{0x0, 0x0, 0x0}}], 0x3, 0x42, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000008000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000feffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x30, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0xc0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 0s ago: executing program 1 (id=4197): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='freezer.state\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r2) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000040000fcffffef1000000008000600000000001800018014000200776c616e310000000000000000000000080007"], 0x3c}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) openat$cgroup_ro(r2, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x0, 0x0) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) r5 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20000000}, [@call={0x85, 0x0, 0x0, 0x2e}, @printk={@lx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r9}, &(0x7f0000000280), &(0x7f0000000240)=r6}, 0x20) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f00000000c0)=r10, 0x4) sendmsg$inet(r8, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="02"], 0x10}}, 0x40044) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000304000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="00000000140000002400128009000100626f6e6400000000140002800500130d0000000008001e"], 0x44}, 0x1, 0x2000000000000000}, 0x0) splice(r0, 0x0, r5, 0x0, 0x10d00, 0xf) kernel console output (not intermixed with test programs): T15063] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2661'. [ 329.423146][T15063] nbd: illegal input index -1135344845 [ 329.432352][T15063] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2661'. [ 330.147380][T15094] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2669'. [ 330.283451][T15097] netlink: 'syz.1.2670': attribute type 1 has an invalid length. [ 330.335204][T15097] bond20: (slave vxcan1): The slave device specified does not support setting the MAC address [ 330.347431][T15097] bond20: (slave vxcan1): Error -95 calling set_mac_address [ 330.395574][T15099] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2670'. [ 330.411969][T15099] macvlan2: entered promiscuous mode [ 330.422331][T15099] macvlan2: entered allmulticast mode [ 330.435556][T15099] bond20: entered promiscuous mode [ 330.454237][T15099] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 330.472393][T15099] bond20: left promiscuous mode [ 330.650595][T15107] netlink: 'syz.4.2674': attribute type 1 has an invalid length. [ 331.023959][T15125] vlan4: entered promiscuous mode [ 331.041520][T15125] bond0: entered promiscuous mode [ 331.050537][T15125] bond_slave_0: entered promiscuous mode [ 331.062796][T15125] bond_slave_1: entered promiscuous mode [ 331.075488][T15125] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode [ 331.529772][T15138] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 331.800041][T15153] netlink: 'syz.4.2688': attribute type 61 has an invalid length. [ 331.818868][T15150] bond14 (unregistering): Released all slaves [ 331.885271][T15153] netlink: 'syz.4.2688': attribute type 1 has an invalid length. [ 331.922921][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 331.931018][ C1] lec:lec_tx_timeout: lec0 [ 331.935721][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 332.263102][ T30] audit: type=1107 audit(1776019030.932:5): pid=15166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 332.534692][T15187] bond14: (slave bond_slave_1): Device is not bonding slave [ 332.548067][T15187] bond14: option active_slave: invalid value (bond_slave_1) [ 332.564827][T15187] bond14 (unregistering): Released all slaves [ 332.647200][T15189] syzkaller0: entered promiscuous mode [ 332.652806][T15189] syzkaller0: entered allmulticast mode [ 333.464168][T15211] __nla_validate_parse: 9 callbacks suppressed [ 333.464189][T15211] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2704'. [ 333.931655][T15219] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2707'. [ 333.944496][T15220] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2707'. [ 334.836317][T15228] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2709'. [ 334.930067][T15236] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 335.029096][T15245] xt_hashlimit: overflow, try lower: 18446744073709551615/32 [ 335.327770][T15269] netlink: 240 bytes leftover after parsing attributes in process `syz.4.2722'. [ 335.534351][T15280] netlink: 176 bytes leftover after parsing attributes in process `syz.3.2725'. [ 335.965764][T15318] syzkaller1: entered promiscuous mode [ 335.971410][T15318] syzkaller1: entered allmulticast mode [ 336.290106][T15333] netlink: 'syz.2.2743': attribute type 1 has an invalid length. [ 336.298774][T15333] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 336.314844][ T5153] lo speed is unknown, defaulting to 1000 [ 336.323923][T15335] netlink: 'syz.2.2743': attribute type 1 has an invalid length. [ 336.326345][ T5153] syz2: Port: 1 Link DOWN [ 336.340503][T15335] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 336.760447][T15354] netlink: 'syz.3.2750': attribute type 8 has an invalid length. [ 336.778667][T15354] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2750'. [ 336.814849][T15354] gretap0: entered promiscuous mode [ 336.839117][T15357] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2751'. [ 336.851058][T15357] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 336.858628][T15357] IPv6: NLM_F_CREATE should be set when creating new route [ 336.865998][T15357] IPv6: NLM_F_CREATE should be set when creating new route [ 336.876029][T15354] gretap0: left promiscuous mode [ 336.942378][T15354] netlink: 268 bytes leftover after parsing attributes in process `syz.3.2750'. [ 336.952905][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 336.961006][ C1] lec:lec_tx_timeout: lec0 [ 336.965700][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 336.974864][T15354] netlink: 136 bytes leftover after parsing attributes in process `syz.3.2750'. [ 337.509808][T15393] ip6erspan0: left promiscuous mode [ 337.516469][T15393] ip6erspan0: left allmulticast mode [ 337.522063][T15393] gretap4: left promiscuous mode [ 337.527245][T15393] gretap4: left allmulticast mode [ 337.668843][T15412] bond14: ARP target 9.0.0.0 is already present [ 337.741283][T15412] bond14: option arp_ip_target: invalid value (9) [ 337.752771][T15412] bond14 (unregistering): Released all slaves [ 337.787291][T15424] netlink: 'syz.4.2767': attribute type 2 has an invalid length. [ 337.956203][T15428] netlink: 'syz.0.2768': attribute type 1 has an invalid length. [ 338.091424][T15441] bond15: (slave vxcan5): The slave device specified does not support setting the MAC address [ 338.102686][T15441] bond15: (slave vxcan5): Error -95 calling set_mac_address [ 338.229103][T15428] macvlan2: entered promiscuous mode [ 338.235151][T15428] macvlan2: entered allmulticast mode [ 338.257830][T15428] bond15: entered promiscuous mode [ 338.284000][T15428] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 338.317417][T15428] bond15: left promiscuous mode [ 338.564584][T15462] lo speed is unknown, defaulting to 1000 [ 338.725342][T15458] xt_CT: No such helper "syz1" [ 338.766294][T15479] ieee802154 phy0 wpan0: encryption failed: -22 [ 339.035670][T15487] __nla_validate_parse: 5 callbacks suppressed [ 339.035690][T15487] netlink: 332 bytes leftover after parsing attributes in process `syz.1.2787'. [ 339.083214][T15487] netlink: 'syz.1.2787': attribute type 9 has an invalid length. [ 339.091012][T15487] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2787'. [ 339.100665][T15487] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2787'. [ 339.114261][T15491] netlink: 'syz.2.2789': attribute type 1 has an invalid length. [ 339.142519][T15491] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 339.169174][T15491] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2789'. [ 339.260861][T15498] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2788'. [ 339.270398][T15498] netem: change failed [ 339.427174][T15506] netlink: 'syz.4.2792': attribute type 12 has an invalid length. [ 339.452079][T15506] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2792'. [ 339.531670][T15504] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 339.615550][T15515] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 339.731688][T15519] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2796'. [ 339.972698][T15536] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.2802'. [ 339.983689][T15536] batadv_slave_0: Caught tx_queue_len zero misconfig [ 339.992743][T15536] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.2802'. [ 340.136609][T15544] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 340.161891][T15545] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 340.179708][T15545] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 340.202078][T15544] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 340.215967][T15551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2807'. [ 340.257104][T15551] syzkaller0: entered promiscuous mode [ 340.273048][T15551] syzkaller0: entered allmulticast mode [ 340.293216][T15554] netlink: 'syz.3.2809': attribute type 39 has an invalid length. [ 340.410001][T15558] syzkaller0: entered promiscuous mode [ 340.415670][T15558] syzkaller0: entered allmulticast mode [ 340.601080][T15573] netlink: 'syz.4.2814': attribute type 7 has an invalid length. [ 341.794282][T15573] netlink: 'syz.4.2814': attribute type 7 has an invalid length. [ 341.824837][T15583] sctp: [Deprecated]: syz.3.2816 (pid 15583) Use of int in max_burst socket option. [ 341.824837][T15583] Use struct sctp_assoc_value instead [ 341.902994][T15587] sctp: [Deprecated]: syz.3.2816 (pid 15587) Use of int in max_burst socket option. [ 341.902994][T15587] Use struct sctp_assoc_value instead [ 341.972937][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 341.981191][ C1] lec:lec_tx_timeout: lec0 [ 341.986393][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 341.998037][T15594] syzkaller0: entered promiscuous mode [ 342.005369][T15594] syzkaller0: entered allmulticast mode [ 342.182027][T15607] netlink: 'syz.1.2824': attribute type 1 has an invalid length. [ 342.194772][T15602] batadv_slave_1: entered promiscuous mode [ 342.242794][T15607] bond21: (slave vxcan1): The slave device specified does not support setting the MAC address [ 342.254017][T15607] bond21: (slave vxcan1): Error -95 calling set_mac_address [ 342.409621][T15617] macvlan2: entered promiscuous mode [ 342.456455][T15617] macvlan2: entered allmulticast mode [ 342.501313][T15617] bond21: entered promiscuous mode [ 342.553777][T15617] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 342.580474][T15617] bond21: left promiscuous mode [ 342.608764][T15604] batadv_slave_1: left promiscuous mode [ 342.823873][T15638] FAULT_INJECTION: forcing a failure. [ 342.823873][T15638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 342.863115][T15638] CPU: 0 UID: 0 PID: 15638 Comm: syz.2.2828 Not tainted syzkaller #0 PREEMPT(full) [ 342.863146][T15638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 342.863160][T15638] Call Trace: [ 342.863169][T15638] [ 342.863178][T15638] dump_stack_lvl+0xe8/0x150 [ 342.863216][T15638] should_fail_ex+0x412/0x560 [ 342.863263][T15638] _copy_from_user+0x2d/0xb0 [ 342.863290][T15638] ____sys_sendmsg+0x308/0x9f0 [ 342.863333][T15638] ? __pfx_____sys_sendmsg+0x10/0x10 [ 342.863381][T15638] ? import_iovec+0x73/0xa0 [ 342.863411][T15638] ___sys_sendmsg+0x2a5/0x360 [ 342.863449][T15638] ? __pfx____sys_sendmsg+0x10/0x10 [ 342.863520][T15638] ? __fget_files+0x2a/0x420 [ 342.863539][T15638] ? __fget_files+0x3a0/0x420 [ 342.863570][T15638] __x64_sys_sendmsg+0x1bd/0x2a0 [ 342.863607][T15638] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 342.863650][T15638] ? __pfx_ksys_write+0x10/0x10 [ 342.863700][T15638] do_syscall_64+0x14d/0xf80 [ 342.863720][T15638] ? trace_irq_disable+0x3b/0x150 [ 342.863739][T15638] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.863761][T15638] ? clear_bhb_loop+0x40/0x90 [ 342.863786][T15638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.863807][T15638] RIP: 0033:0x7ff8a1b9c819 [ 342.863827][T15638] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 342.863846][T15638] RSP: 002b:00007ff8a2973028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 342.863868][T15638] RAX: ffffffffffffffda RBX: 00007ff8a1e16090 RCX: 00007ff8a1b9c819 [ 342.863883][T15638] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 342.863896][T15638] RBP: 00007ff8a2973090 R08: 0000000000000000 R09: 0000000000000000 [ 342.863908][T15638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.863920][T15638] R13: 00007ff8a1e16128 R14: 00007ff8a1e16090 R15: 00007fffeaa245d8 [ 342.863953][T15638] [ 343.084502][T15641] netlink: 'syz.0.2833': attribute type 35 has an invalid length. [ 343.398831][T15654] xt_TPROXY: Can be used only with -p tcp or -p udp [ 344.045298][T15699] FAULT_INJECTION: forcing a failure. [ 344.045298][T15699] name failslab, interval 1, probability 0, space 0, times 0 [ 344.072703][T15699] CPU: 0 UID: 0 PID: 15699 Comm: syz.1.2853 Not tainted syzkaller #0 PREEMPT(full) [ 344.072733][T15699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 344.072747][T15699] Call Trace: [ 344.072756][T15699] [ 344.072765][T15699] dump_stack_lvl+0xe8/0x150 [ 344.072802][T15699] should_fail_ex+0x412/0x560 [ 344.072843][T15699] should_failslab+0xa8/0x100 [ 344.072879][T15699] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 344.072907][T15699] ? __alloc_skb+0x1d0/0x7d0 [ 344.072933][T15699] ? __local_bh_enable_ip+0xd0/0x130 [ 344.072968][T15699] __alloc_skb+0x1d0/0x7d0 [ 344.073002][T15699] _sctp_make_chunk+0x59/0x290 [ 344.073030][T15699] sctp_make_abort_user+0x97/0x630 [ 344.073060][T15699] ? __pfx_sctp_make_abort_user+0x10/0x10 [ 344.073092][T15699] sctp_sendmsg_check_sflags+0x1cb/0x330 [ 344.073125][T15699] sctp_sendmsg+0x1921/0x2c10 [ 344.073177][T15699] ? __pfx_sctp_sendmsg+0x10/0x10 [ 344.073207][T15699] ? aa_sk_perm+0x6d5/0x900 [ 344.073249][T15699] ? __pfx_aa_sk_perm+0x10/0x10 [ 344.073285][T15699] ? sock_rps_record_flow+0x19/0x350 [ 344.073319][T15699] ? inet_sendmsg+0x2f4/0x370 [ 344.073348][T15699] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 344.073378][T15699] ____sys_sendmsg+0x80a/0x9f0 [ 344.073421][T15699] ? __pfx_____sys_sendmsg+0x10/0x10 [ 344.073464][T15699] ? import_iovec+0x73/0xa0 [ 344.073495][T15699] ___sys_sendmsg+0x2a5/0x360 [ 344.073535][T15699] ? __pfx____sys_sendmsg+0x10/0x10 [ 344.073608][T15699] ? __fget_files+0x2a/0x420 [ 344.073627][T15699] ? __fget_files+0x3a0/0x420 [ 344.073658][T15699] __x64_sys_sendmsg+0x1bd/0x2a0 [ 344.073707][T15699] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 344.073749][T15699] ? __pfx_ksys_write+0x10/0x10 [ 344.073786][T15699] do_syscall_64+0x14d/0xf80 [ 344.073818][T15699] ? trace_irq_disable+0x3b/0x150 [ 344.073835][T15699] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.073874][T15699] ? clear_bhb_loop+0x40/0x90 [ 344.073901][T15699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.073922][T15699] RIP: 0033:0x7fda26b9c819 [ 344.073942][T15699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 344.073960][T15699] RSP: 002b:00007fda24df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 344.073982][T15699] RAX: ffffffffffffffda RBX: 00007fda26e16090 RCX: 00007fda26b9c819 [ 344.073998][T15699] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 344.074011][T15699] RBP: 00007fda24df6090 R08: 0000000000000000 R09: 0000000000000000 [ 344.074024][T15699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 344.074036][T15699] R13: 00007fda26e16128 R14: 00007fda26e16090 R15: 00007ffedc03b628 [ 344.074070][T15699] [ 344.375046][T15702] lo speed is unknown, defaulting to 1000 [ 344.693523][T15724] tipc: Enabling of bearer rejected, failed to enable media [ 344.719860][T15724] netlink: 'syz.3.2862': attribute type 16 has an invalid length. [ 344.748125][T15724] netlink: 'syz.3.2862': attribute type 17 has an invalid length. [ 344.807889][T15728] __nla_validate_parse: 19 callbacks suppressed [ 344.807909][T15728] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2863'. [ 344.827477][T15732] pimreg: entered allmulticast mode [ 345.313076][ T5832] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 345.463423][T15778] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2878'. [ 345.481083][T15778] xfrm0: entered promiscuous mode [ 345.487323][T15778] xfrm0: entered allmulticast mode [ 345.493181][T15778] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2878'. [ 345.627129][T15792] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.2882'. [ 345.637838][T15792] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.2882'. [ 345.814051][T15804] netlink: 'syz.1.2885': attribute type 1 has an invalid length. [ 345.924726][T15808] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2885'. [ 346.032941][ T5832] Bluetooth: hci4: command 0x0405 tx timeout [ 346.248963][T15826] netlink: 'syz.1.2890': attribute type 1 has an invalid length. [ 346.357818][T15826] bond23: (slave vxcan1): The slave device specified does not support setting the MAC address [ 346.369254][T15826] bond23: (slave vxcan1): Error -95 calling set_mac_address [ 346.396226][T15835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2890'. [ 346.452276][T15835] macvlan2: entered promiscuous mode [ 346.478464][T15835] macvlan2: entered allmulticast mode [ 346.498781][T15835] bond23: entered promiscuous mode [ 346.506294][T15835] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 346.576847][T15835] bond23: left promiscuous mode [ 346.613394][T15844] ip6tnl0: Caught tx_queue_len zero misconfig [ 346.739296][T15846] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2895'. [ 346.896148][T15856] FAULT_INJECTION: forcing a failure. [ 346.896148][T15856] name failslab, interval 1, probability 0, space 0, times 0 [ 346.941834][T15857] lo speed is unknown, defaulting to 1000 [ 346.959979][T15856] CPU: 0 UID: 0 PID: 15856 Comm: syz.4.2899 Not tainted syzkaller #0 PREEMPT(full) [ 346.960006][T15856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 346.960020][T15856] Call Trace: [ 346.960028][T15856] [ 346.960037][T15856] dump_stack_lvl+0xe8/0x150 [ 346.960074][T15856] should_fail_ex+0x412/0x560 [ 346.960113][T15856] should_failslab+0xa8/0x100 [ 346.960148][T15856] ? sctp_chunkify+0x5a/0x260 [ 346.960171][T15856] kmem_cache_alloc_noprof+0x87/0x650 [ 346.960204][T15856] sctp_chunkify+0x5a/0x260 [ 346.960230][T15856] _sctp_make_chunk+0x122/0x290 [ 346.960256][T15856] sctp_make_abort_user+0x97/0x630 [ 346.960285][T15856] ? __pfx_sctp_make_abort_user+0x10/0x10 [ 346.960321][T15856] sctp_sendmsg_check_sflags+0x1cb/0x330 [ 346.960353][T15856] sctp_sendmsg+0x1921/0x2c10 [ 346.960395][T15856] ? __pfx_sctp_sendmsg+0x10/0x10 [ 346.960425][T15856] ? aa_sk_perm+0x6d5/0x900 [ 346.960466][T15856] ? __pfx_aa_sk_perm+0x10/0x10 [ 346.960502][T15856] ? sock_rps_record_flow+0x19/0x350 [ 346.960537][T15856] ? inet_sendmsg+0x2f4/0x370 [ 346.960566][T15856] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 346.960595][T15856] ____sys_sendmsg+0x80a/0x9f0 [ 346.960636][T15856] ? __pfx_____sys_sendmsg+0x10/0x10 [ 346.960678][T15856] ? import_iovec+0x73/0xa0 [ 346.960707][T15856] ___sys_sendmsg+0x2a5/0x360 [ 346.960746][T15856] ? __pfx____sys_sendmsg+0x10/0x10 [ 346.960816][T15856] ? __fget_files+0x2a/0x420 [ 346.960835][T15856] ? __fget_files+0x3a0/0x420 [ 346.960866][T15856] __x64_sys_sendmsg+0x1bd/0x2a0 [ 346.960902][T15856] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 346.960945][T15856] ? __pfx_ksys_write+0x10/0x10 [ 346.960983][T15856] do_syscall_64+0x14d/0xf80 [ 346.961003][T15856] ? trace_irq_disable+0x3b/0x150 [ 346.961021][T15856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.961043][T15856] ? clear_bhb_loop+0x40/0x90 [ 346.961070][T15856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.961091][T15856] RIP: 0033:0x7f48b419c819 [ 346.961110][T15856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.961136][T15856] RSP: 002b:00007f48b50dc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 346.961158][T15856] RAX: ffffffffffffffda RBX: 00007f48b4416090 RCX: 00007f48b419c819 [ 346.961174][T15856] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 346.961187][T15856] RBP: 00007f48b50dc090 R08: 0000000000000000 R09: 0000000000000000 [ 346.961200][T15856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 346.961213][T15856] R13: 00007f48b4416128 R14: 00007f48b4416090 R15: 00007fff307201d8 [ 346.961247][T15856] [ 347.023240][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5040 ms [ 347.034005][T15857] lo speed is unknown, defaulting to 1000 [ 347.038531][ C1] lec:lec_tx_timeout: lec0 [ 347.045826][T15857] lo speed is unknown, defaulting to 1000 [ 347.050187][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 347.263958][T15865] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2902'. [ 347.351796][T15870] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2905'. [ 347.491561][T15878] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 347.738343][T10958] lo speed is unknown, defaulting to 1000 [ 347.752934][T15857] infiniband syz0: set down [ 347.764353][T15857] infiniband syz0: added lo [ 347.885351][T15857] RDS/IB: syz0: added [ 347.895038][T15857] smc: adding ib device syz0 with port count 1 [ 347.901813][T15857] smc: ib device syz0 port 1 has no pnetid [ 347.927275][T10958] lo speed is unknown, defaulting to 1000 [ 347.937259][T15897] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 347.947388][T15857] lo speed is unknown, defaulting to 1000 [ 348.036032][T15897] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 348.288621][T15912] x_tables: duplicate underflow at hook 2 [ 348.498098][T15857] lo speed is unknown, defaulting to 1000 [ 348.845142][T15923] bridge0: port 3(dummy0) entered disabled state [ 348.931545][T15923] team0: left promiscuous mode [ 348.937145][T15923] team_slave_0: left promiscuous mode [ 348.942978][T15923] team_slave_1: left promiscuous mode [ 348.968816][T15923] 0ªX¹¦À: left allmulticast mode [ 348.977176][T15923] veth1: left promiscuous mode [ 348.990019][T15923] veth1: left allmulticast mode [ 349.002364][T15923] veth0_to_hsr: left allmulticast mode [ 349.170388][T15923] ip6tnl1: left allmulticast mode [ 349.176886][T15923] bond11: left promiscuous mode [ 349.186765][T15923] bond11: left allmulticast mode [ 349.207250][T15923] vlan4: left allmulticast mode [ 349.217119][T15923] bridge7: left allmulticast mode [ 349.227778][T15923] erspan2: left promiscuous mode [ 349.234112][T15923] erspan2: left allmulticast mode [ 349.262683][T15857] lo speed is unknown, defaulting to 1000 [ 349.756492][T15957] ipvlan2: entered promiscuous mode [ 349.797441][T15957] bridge0: port 4(ipvlan2) entered blocking state [ 349.812758][T15957] bridge0: port 4(ipvlan2) entered disabled state [ 349.824060][T15957] ipvlan2: entered allmulticast mode [ 349.829410][T15957] bridge0: entered allmulticast mode [ 349.844739][T15957] ipvlan2: left allmulticast mode [ 349.863743][T15957] bridge0: left allmulticast mode [ 349.892779][T15857] lo speed is unknown, defaulting to 1000 [ 349.977018][T15973] ieee802154 phy0 wpan0: encryption failed: -22 [ 350.047511][T15976] __nla_validate_parse: 3 callbacks suppressed [ 350.047532][T15976] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2936'. [ 350.156875][T15981] netlink: 'syz.1.2938': attribute type 1 has an invalid length. [ 350.236193][T15985] bond24: (slave vxcan1): The slave device specified does not support setting the MAC address [ 350.247515][T15985] bond24: (slave vxcan1): Error -95 calling set_mac_address [ 350.273020][T15857] lo speed is unknown, defaulting to 1000 [ 350.276816][T15981] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2938'. [ 350.407439][T15987] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2940'. [ 350.419727][T15987] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2940'. [ 350.429640][T15987] tc_dump_action: action bad kind [ 350.499114][T15989] netlink: 'syz.1.2939': attribute type 1 has an invalid length. [ 350.595463][T15989] bond25: (slave vxcan1): The slave device specified does not support setting the MAC address [ 350.649516][T15989] bond25: (slave vxcan1): Error -95 calling set_mac_address [ 350.685936][T15995] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2939'. [ 350.743426][T15998] IPVS: length: 35 != 24 [ 350.800401][T15997] macvlan2: entered promiscuous mode [ 350.823009][T15997] macvlan2: entered allmulticast mode [ 350.874586][T15997] bond25: entered promiscuous mode [ 350.880625][T15997] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 350.953981][T15997] bond25: left promiscuous mode [ 351.019545][T16008] 8021q: VLANs not supported on ip6_vti0 [ 351.252381][T16018] netlink: 'syz.4.2949': attribute type 1 has an invalid length. [ 351.370800][T16030] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2949'. [ 351.387280][T16029] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2952'. [ 351.397061][T16029] netlink: 'syz.1.2952': attribute type 7 has an invalid length. [ 351.409532][T16029] netlink: 'syz.1.2952': attribute type 8 has an invalid length. [ 351.423621][T16029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2952'. [ 352.289834][T16065] bond18: (slave bond_slave_1): Device is not our slave [ 352.299086][T16065] bond18: option active_slave: invalid value (bond_slave_1) [ 352.310562][T16065] bond18 (unregistering): Released all slaves [ 352.572811][T16078] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2967'. [ 352.735888][T16087] netlink: 'syz.4.2971': attribute type 3 has an invalid length. [ 352.832905][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5580 ms [ 352.841008][ C1] lec:lec_tx_timeout: lec0 [ 352.845720][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 352.861550][T16095] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2974'. [ 352.930188][T16100] netlink: 'syz.2.2975': attribute type 1 has an invalid length. [ 353.084901][T16108] bond14: (slave vxcan1): The slave device specified does not support setting the MAC address [ 353.100157][T16108] bond14: (slave vxcan1): Error -95 calling set_mac_address [ 353.149848][T16100] macvlan0: entered promiscuous mode [ 353.156481][T16100] macvlan0: entered allmulticast mode [ 353.171737][T16100] bond14: entered promiscuous mode [ 353.203400][T16100] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 353.227924][T16100] bond14: left promiscuous mode [ 353.261503][T16113] : entered promiscuous mode [ 353.406805][T16121] netlink: 'syz.4.2979': attribute type 1 has an invalid length. [ 353.772682][T16134] bond18: (slave bond_slave_1): Device is not our slave [ 353.782487][T16134] bond18: option active_slave: invalid value (bond_slave_1) [ 353.798778][T16134] bond18 (unregistering): Released all slaves [ 354.002181][T16141] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 354.076832][T16143] rdma_rxe: rxe_newlink: failed to add lo [ 354.262335][T16145] lo speed is unknown, defaulting to 1000 [ 354.291543][T16145] lo speed is unknown, defaulting to 1000 [ 354.664945][T16158] netlink: Unknown conntrack attr (type=2304, max=9) [ 354.699439][T16160] tipc: Invalid UDP bearer configuration [ 354.699491][T16160] tipc: Enabling of bearer rejected, failed to enable media [ 354.856792][T16166] batadv1: entered promiscuous mode [ 354.865729][T16166] batadv1: entered allmulticast mode [ 354.875224][T16166] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 354.897545][T16164] hsr0: entered promiscuous mode [ 355.026903][T16176] netlink: 'syz.2.2995': attribute type 1 has an invalid length. [ 355.221950][T16180] rdma_rxe: rxe_newlink: failed to add lo [ 356.002262][T16207] bond18: (slave bond_slave_1): Device is not our slave [ 356.038900][T16207] bond18: option active_slave: invalid value (bond_slave_1) [ 356.056767][T16207] bond18 (unregistering): Released all slaves [ 356.259089][T16221] __nla_validate_parse: 6 callbacks suppressed [ 356.259110][T16221] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3007'. [ 356.278048][T16221] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3007'. [ 356.291104][T16223] netlink: 'syz.2.3008': attribute type 7 has an invalid length. [ 356.299525][T16223] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3008'. [ 356.318399][T16223] netlink: 'syz.2.3008': attribute type 7 has an invalid length. [ 356.319287][ T49] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.357128][ T49] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.383980][ T49] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.385026][T16223] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3008'. [ 356.434289][ T87] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.520813][T16230] rdma_rxe: rxe_newlink: failed to add lo [ 356.630476][T16232] bond15: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 356.672196][T16240] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3013'. [ 356.731015][T16232] bond15: (slave lo): Enslaving as an active interface with an up link [ 356.749249][T16232] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 356.802727][T16200] lo speed is unknown, defaulting to 1000 [ 356.810130][T16191] lo speed is unknown, defaulting to 1000 [ 356.829739][T16200] syz2: Port: 1 Link ACTIVE [ 356.933566][T16253] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3016'. [ 356.942594][T16253] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3016'. [ 357.296757][T16281] netlink: 'syz.0.3027': attribute type 1 has an invalid length. [ 357.305468][T16277] vxcan0: entered allmulticast mode [ 357.407375][T16288] bond16: (slave vxcan7): The slave device specified does not support setting the MAC address [ 357.437234][T16288] bond16: (slave vxcan7): Error -95 calling set_mac_address [ 357.476994][T16281] macvlan2: entered promiscuous mode [ 357.482355][T16281] macvlan2: entered allmulticast mode [ 357.490492][T16281] bond16: entered promiscuous mode [ 357.498086][T16281] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 357.515302][T16281] bond16: left promiscuous mode [ 357.547201][T16286] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3028'. [ 357.741350][T16298] lo speed is unknown, defaulting to 1000 [ 357.755928][T16299] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3030'. [ 357.766061][T16298] lo speed is unknown, defaulting to 1000 [ 357.873054][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 357.881141][ C1] lec:lec_tx_timeout: lec0 [ 357.886115][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 357.896816][T16315] batadv_slave_1: entered promiscuous mode [ 357.916878][T16315] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3033'. [ 357.944294][T16315] batadv_slave_1 (unregistering): left promiscuous mode [ 357.963501][T16315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 358.064635][T16340] netlink: 'syz.0.3036': attribute type 1 has an invalid length. [ 358.210956][T16340] bond17: (slave vxcan7): The slave device specified does not support setting the MAC address [ 358.226022][T16340] bond17: (slave vxcan7): Error -95 calling set_mac_address [ 358.335049][T16346] macvlan2: entered promiscuous mode [ 358.354701][T16346] macvlan2: entered allmulticast mode [ 358.362146][T16346] bond17: entered promiscuous mode [ 358.398412][T16346] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 358.434183][T16346] bond17: left promiscuous mode [ 358.946290][T16388] Cannot find add_set index 2 as target [ 359.472769][T16417] netlink: 'syz.3.3052': attribute type 1 has an invalid length. [ 359.483889][T16411] bond23: (slave bond_slave_1): Device is not bonding slave [ 359.491245][T16411] bond23: option active_slave: invalid value (bond_slave_1) [ 359.508823][T16411] bond23 (unregistering): Released all slaves [ 359.818672][T16420] bond18: (slave vxcan7): The slave device specified does not support setting the MAC address [ 359.830446][T16420] bond18: (slave vxcan7): Error -95 calling set_mac_address [ 359.931502][T16427] macvlan3: entered promiscuous mode [ 359.937822][T16427] macvlan3: entered allmulticast mode [ 359.945464][T16427] bond18: entered promiscuous mode [ 359.951682][T16427] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 359.972262][T16427] bond18: left promiscuous mode [ 360.031516][T16436] IPv6: sit2: Disabled Multicast RS [ 360.234261][T16451] syzkaller1: entered promiscuous mode [ 360.239911][T16451] syzkaller1: entered allmulticast mode [ 360.321013][T16453] syz0: rxe_newlink: already configured on lo [ 360.331874][T16460] IPv6: Can't replace route, no match found [ 360.378971][T16461] tipc: Enabling of bearer <“dp:s> rejected, media not registered [ 361.215259][T16510] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 32, id = 0 [ 361.221547][T16508] rdma_rxe: rxe_newlink: failed to add lo [ 361.447393][T16517] Bluetooth: MGMT ver 1.23 [ 361.454918][T16517] netlink: 'syz.2.3074': attribute type 29 has an invalid length. [ 361.462793][T16517] __nla_validate_parse: 9 callbacks suppressed [ 361.462810][T16517] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3074'. [ 361.560760][T16517] netlink: 'syz.2.3074': attribute type 29 has an invalid length. [ 361.568884][T16528] siw: device registration error -23 [ 361.595552][T16517] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3074'. [ 361.859516][T16549] netlink: 'syz.1.3081': attribute type 13 has an invalid length. [ 361.969852][T16555] netlink: 'syz.4.3083': attribute type 21 has an invalid length. [ 361.977856][T16555] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3083'. [ 361.991809][T16555] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 362.097375][T16558] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3084'. [ 362.136870][T16561] rdma_rxe: rxe_newlink: failed to add lo [ 362.218815][T16565] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3087'. [ 362.390950][T16565] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 362.769323][T16587] netlink: 'syz.0.3091': attribute type 32 has an invalid length. [ 362.789402][T16587] netlink: 'syz.0.3091': attribute type 2 has an invalid length. [ 362.838591][T16590] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3092'. [ 362.892871][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 362.900977][ C1] lec:lec_tx_timeout: lec0 [ 362.905801][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 362.988823][T16598] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3095'. [ 363.240687][T16611] nbd: must specify a size in bytes for the device [ 363.255248][T16604] xt_hashlimit: size too large, truncated to 1048576 [ 363.330347][T16611] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 363.472086][T16618] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3100'. [ 363.521860][T16622] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3099'. [ 363.537248][T16622] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3099'. [ 363.579710][T16622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 363.589934][T16622] 8021q: adding VLAN 0 to HW filter on device team0 [ 363.602462][T16622] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 363.665034][ T7161] lo speed is unknown, defaulting to 1000 [ 363.670822][ T7161] syz0: Port: 1 Link ACTIVE [ 363.781595][T16624] syzkaller1: entered promiscuous mode [ 363.796808][T16624] syzkaller1: entered allmulticast mode [ 363.809356][ T5883] lo speed is unknown, defaulting to 1000 [ 364.393944][T16660] netlink: 'syz.4.3107': attribute type 10 has an invalid length. [ 364.660789][T16679] netlink: 'syz.2.3115': attribute type 1 has an invalid length. [ 364.790038][T16687] bond16: (slave vxcan1): The slave device specified does not support setting the MAC address [ 364.823610][T16687] bond16: (slave vxcan1): Error -95 calling set_mac_address [ 364.869315][T16679] macvlan0: entered promiscuous mode [ 364.879270][T16679] macvlan0: entered allmulticast mode [ 364.886873][T16679] bond16: entered promiscuous mode [ 364.893686][T16679] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 364.902659][T16699] netlink: 'syz.3.3120': attribute type 9 has an invalid length. [ 364.915268][T16679] bond16: left promiscuous mode [ 364.949153][T16699] netlink: 'syz.3.3120': attribute type 9 has an invalid length. [ 364.959469][T16334] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 364.969174][T16334] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 364.992322][T16334] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.009640][T16334] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.103817][T16707] žÿ: renamed from team_slave_1 [ 365.748774][T16750] 8021q: adding VLAN 0 to HW filter on device bond18 [ 365.898846][T16770] macvtap1: entered promiscuous mode [ 365.907750][T16770] erspan0: entered promiscuous mode [ 365.923228][T16770] macvtap1: entered allmulticast mode [ 365.929725][T16770] erspan0: entered allmulticast mode [ 366.108788][T16786] bond19: option miimon: invalid value (18446744073709551607) [ 366.122996][T16786] bond19: option miimon: allowed values 0 - 2147483647 [ 366.286606][T16786] bond19 (unregistering): Released all slaves [ 366.322377][T16796] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 786440, id = 0 [ 366.477851][T16802] netlink: 'syz.0.3145': attribute type 1 has an invalid length. [ 366.561812][T16809] netlink: 'syz.4.3146': attribute type 10 has an invalid length. [ 366.584587][T16805] netlink: 'syz.4.3146': attribute type 10 has an invalid length. [ 366.600987][T16807] bond19: (slave vxcan7): The slave device specified does not support setting the MAC address [ 366.612329][T16807] bond19: (slave vxcan7): Error -95 calling set_mac_address [ 366.620640][T16802] __nla_validate_parse: 26 callbacks suppressed [ 366.620658][T16802] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3145'. [ 366.684367][T16821] openvswitch: netlink: IPv4 tun info is not correct [ 366.734658][T16802] macvlan2: entered promiscuous mode [ 366.740015][T16802] macvlan2: entered allmulticast mode [ 366.746660][T16802] bond19: entered promiscuous mode [ 366.756875][T16802] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 366.768876][T16802] bond19: left promiscuous mode [ 366.838551][T16830] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3147'. [ 367.912900][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 367.921015][ C1] lec:lec_tx_timeout: lec0 [ 367.925701][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 369.565881][T16812] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 369.741687][T16844] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 369.756337][T16847] x_tables: duplicate underflow at hook 2 [ 370.105554][T16875] netlink: 'syz.3.3160': attribute type 2 has an invalid length. [ 370.162463][T16875] l24): entered promiscuous mode [ 370.167548][T16877] x_tables: duplicate underflow at hook 1 [ 370.231322][T16875] syzkaller1: entered promiscuous mode [ 370.254074][T16875] syzkaller1: entered allmulticast mode [ 370.387025][T16896] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3166'. [ 370.395845][T16894] netlink: 'syz.0.3165': attribute type 1 has an invalid length. [ 370.470348][T16894] 8021q: adding VLAN 0 to HW filter on device bond20 [ 370.532505][T16901] bond20: (slave veth9): Enslaving as an active interface with a down link [ 370.584235][T16894] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3165'. [ 370.679302][T16894] bond20: (slave bridge3): Enslaving as an active interface with a down link [ 370.900801][T16930] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3171'. [ 370.980144][T16930] lo speed is unknown, defaulting to 1000 [ 371.022025][T16930] lo speed is unknown, defaulting to 1000 [ 371.337348][T16945] netlink: 'syz.1.3178': attribute type 39 has an invalid length. [ 371.595556][T16932] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 371.861103][T16955] tun0: tun_chr_ioctl cmd 1074812118 [ 371.866875][T16955] tun0: tun_chr_ioctl cmd 1074033169 [ 371.932623][T16952] lo speed is unknown, defaulting to 1000 [ 371.991814][T16952] lo speed is unknown, defaulting to 1000 [ 372.083355][T16961] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 372.934853][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 372.942985][ C1] lec:lec_tx_timeout: lec0 [ 372.947788][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 373.919873][T16993] syzkaller1: entered promiscuous mode [ 373.929999][T16993] syzkaller1: entered allmulticast mode [ 374.204754][T17003] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3197'. [ 374.282740][T17004] macsec1: entered promiscuous mode [ 374.599399][T17024] netlink: 'syz.1.3204': attribute type 6 has an invalid length. [ 374.632047][T17024] netlink: 'syz.1.3204': attribute type 7 has an invalid length. [ 374.695538][T17024] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3204'. [ 375.390816][T17059] netlink: 'syz.3.3212': attribute type 1 has an invalid length. [ 375.456770][T17059] bond19: (slave vxcan7): The slave device specified does not support setting the MAC address [ 375.468547][T17059] bond19: (slave vxcan7): Error -95 calling set_mac_address [ 375.517476][T17059] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3212'. [ 375.538011][T17059] macvlan3: entered promiscuous mode [ 375.544316][T17059] macvlan3: entered allmulticast mode [ 375.554517][T17059] bond19: entered promiscuous mode [ 375.560550][T17059] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 375.580754][T17059] bond19: left promiscuous mode [ 375.670504][T17068] openvswitch: netlink: IP tunnel dst address not specified [ 375.911762][T17074] netlink: 452 bytes leftover after parsing attributes in process `syz.0.3215'. [ 375.933653][T17074] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3215'. [ 375.955330][T17074] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3215'. [ 376.191349][T17094] bond20: (slave bond_slave_1): Device is not our slave [ 376.199564][T17094] bond20: option active_slave: invalid value (bond_slave_1) [ 376.249154][T17094] bond20 (unregistering): Released all slaves [ 376.813483][T17124] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3228'. [ 376.868354][T17128] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3229'. [ 377.001119][T17134] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3231'. [ 377.271752][T17150] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3235'. [ 377.459749][T17159] netlink: 'syz.1.3238': attribute type 3 has an invalid length. [ 377.962898][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 377.971033][ C1] lec:lec_tx_timeout: lec0 [ 377.975839][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 378.163300][T17199] sock: sock_set_timeout: `syz.0.3245' (pid 17199) tries to set negative timeout [ 378.205267][T17193] netlink: 'syz.0.3245': attribute type 1 has an invalid length. [ 378.332441][T17193] 8021q: adding VLAN 0 to HW filter on device bond21 [ 378.478371][T17208] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 378.727294][T17226] batadv1: left promiscuous mode [ 378.750515][T17226] batadv1: left allmulticast mode [ 378.890048][T17240] FAULT_INJECTION: forcing a failure. [ 378.890048][T17240] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 378.921939][T17240] CPU: 1 UID: 0 PID: 17240 Comm: syz.0.3257 Not tainted syzkaller #0 PREEMPT(full) [ 378.921969][T17240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 378.921988][T17240] Call Trace: [ 378.921997][T17240] [ 378.922006][T17240] dump_stack_lvl+0xe8/0x150 [ 378.922042][T17240] should_fail_ex+0x412/0x560 [ 378.922080][T17240] _copy_from_user+0x2d/0xb0 [ 378.922108][T17240] ___sys_sendmsg+0x1c6/0x360 [ 378.922153][T17240] ? __pfx____sys_sendmsg+0x10/0x10 [ 378.922221][T17240] ? __fget_files+0x2a/0x420 [ 378.922240][T17240] ? __fget_files+0x3a0/0x420 [ 378.922270][T17240] __x64_sys_sendmsg+0x1bd/0x2a0 [ 378.922304][T17240] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 378.922346][T17240] ? __pfx_ksys_write+0x10/0x10 [ 378.922383][T17240] do_syscall_64+0x14d/0xf80 [ 378.922421][T17240] ? trace_irq_disable+0x3b/0x150 [ 378.922440][T17240] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.922462][T17240] ? clear_bhb_loop+0x40/0x90 [ 378.922489][T17240] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.922514][T17240] RIP: 0033:0x7ff77259c819 [ 378.922535][T17240] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 378.922559][T17240] RSP: 002b:00007ff773535028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 378.922582][T17240] RAX: ffffffffffffffda RBX: 00007ff772815fa0 RCX: 00007ff77259c819 [ 378.922598][T17240] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 378.922611][T17240] RBP: 00007ff773535090 R08: 0000000000000000 R09: 0000000000000000 [ 378.922624][T17240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 378.922637][T17240] R13: 00007ff772816038 R14: 00007ff772815fa0 R15: 00007fff31bc9af8 [ 378.922672][T17240] [ 379.281348][T17248] tun0: tun_chr_ioctl cmd 1074025675 [ 379.289726][T17248] tun0: persist enabled [ 379.303412][T17252] tun0: tun_chr_ioctl cmd 1074025675 [ 379.313371][T17252] tun0: persist enabled [ 379.318254][T17248] tun0: tun_chr_ioctl cmd 1074025675 [ 379.383544][T17248] tun0: persist disabled [ 379.682248][T17278] netlink: 'syz.1.3270': attribute type 9 has an invalid length. [ 379.737267][T17281] netlink: 'syz.1.3270': attribute type 9 has an invalid length. [ 379.792405][T17286] __nla_validate_parse: 4 callbacks suppressed [ 379.792427][T17286] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3271'. [ 379.844740][T17286] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3271'. [ 379.876878][T17286] netlink: 580 bytes leftover after parsing attributes in process `syz.0.3271'. [ 379.962643][T17294] FAULT_INJECTION: forcing a failure. [ 379.962643][T17294] name failslab, interval 1, probability 0, space 0, times 0 [ 380.007116][T17294] CPU: 1 UID: 0 PID: 17294 Comm: syz.2.3274 Not tainted syzkaller #0 PREEMPT(full) [ 380.007146][T17294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 380.007160][T17294] Call Trace: [ 380.007168][T17294] [ 380.007178][T17294] dump_stack_lvl+0xe8/0x150 [ 380.007213][T17294] should_fail_ex+0x412/0x560 [ 380.007253][T17294] should_failslab+0xa8/0x100 [ 380.007291][T17294] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 380.007316][T17294] ? __alloc_skb+0x186/0x7d0 [ 380.007344][T17294] ? __alloc_skb+0x1d0/0x7d0 [ 380.007369][T17294] ? __local_bh_enable_ip+0xd0/0x130 [ 380.007402][T17294] __alloc_skb+0x1d0/0x7d0 [ 380.007435][T17294] netlink_sendmsg+0x5d4/0xb40 [ 380.007475][T17294] ? __pfx_netlink_sendmsg+0x10/0x10 [ 380.007508][T17294] ? aa_sock_msg_perm+0xf1/0x1b0 [ 380.007530][T17294] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 380.007559][T17294] ____sys_sendmsg+0x972/0x9f0 [ 380.007600][T17294] ? __pfx_____sys_sendmsg+0x10/0x10 [ 380.007641][T17294] ? import_iovec+0x73/0xa0 [ 380.007670][T17294] ___sys_sendmsg+0x2a5/0x360 [ 380.007708][T17294] ? __pfx____sys_sendmsg+0x10/0x10 [ 380.007776][T17294] ? __fget_files+0x2a/0x420 [ 380.007794][T17294] ? __fget_files+0x3a0/0x420 [ 380.007825][T17294] __x64_sys_sendmsg+0x1bd/0x2a0 [ 380.007860][T17294] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 380.007902][T17294] ? __pfx_ksys_write+0x10/0x10 [ 380.007938][T17294] do_syscall_64+0x14d/0xf80 [ 380.007959][T17294] ? trace_irq_disable+0x3b/0x150 [ 380.007977][T17294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.007999][T17294] ? clear_bhb_loop+0x40/0x90 [ 380.008026][T17294] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.008047][T17294] RIP: 0033:0x7ff8a1b9c819 [ 380.008067][T17294] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 380.008085][T17294] RSP: 002b:00007ff8a2994028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 380.008107][T17294] RAX: ffffffffffffffda RBX: 00007ff8a1e15fa0 RCX: 00007ff8a1b9c819 [ 380.008123][T17294] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 380.008136][T17294] RBP: 00007ff8a2994090 R08: 0000000000000000 R09: 0000000000000000 [ 380.008150][T17294] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 380.008162][T17294] R13: 00007ff8a1e16038 R14: 00007ff8a1e15fa0 R15: 00007fffeaa245d8 [ 380.008193][T17294] [ 380.461149][T17313] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3281'. [ 380.525195][T17313] bond22: entered promiscuous mode [ 380.530819][T17313] 8021q: adding VLAN 0 to HW filter on device bond22 [ 380.889806][T17339] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3288'. [ 381.014461][T17339] bond20: entered promiscuous mode [ 381.019663][T17339] bond20: entered allmulticast mode [ 381.026242][T17339] 8021q: adding VLAN 0 to HW filter on device bond20 [ 381.692640][T17393] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3302'. [ 381.782058][T17396] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3304'. [ 382.156085][T17414] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3309'. [ 382.982891][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 382.990958][ C1] lec:lec_tx_timeout: lec0 [ 382.995827][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 383.068960][T17420] FAULT_INJECTION: forcing a failure. [ 383.068960][T17420] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 383.086382][T17420] CPU: 1 UID: 0 PID: 17420 Comm: syz.1.3311 Not tainted syzkaller #0 PREEMPT(full) [ 383.086402][T17420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 383.086411][T17420] Call Trace: [ 383.086418][T17420] [ 383.086424][T17420] dump_stack_lvl+0xe8/0x150 [ 383.086451][T17420] should_fail_ex+0x412/0x560 [ 383.086478][T17420] _copy_to_user+0x31/0xb0 [ 383.086498][T17420] simple_read_from_buffer+0xe1/0x170 [ 383.086524][T17420] proc_fail_nth_read+0x1bb/0x230 [ 383.086549][T17420] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 383.086573][T17420] ? rw_verify_area+0x2a6/0x4d0 [ 383.086590][T17420] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 383.086612][T17420] vfs_read+0x20c/0xa70 [ 383.086627][T17420] ? fdget_pos+0x246/0x320 [ 383.086644][T17420] ? __pfx___mutex_lock+0x10/0x10 [ 383.086660][T17420] ? __pfx_vfs_read+0x10/0x10 [ 383.086677][T17420] ? __fget_files+0x2a/0x420 [ 383.086693][T17420] ? __fget_files+0x3a0/0x420 [ 383.086706][T17420] ? __fget_files+0x2a/0x420 [ 383.086725][T17420] ksys_read+0x150/0x270 [ 383.086743][T17420] ? __pfx_ksys_read+0x10/0x10 [ 383.086768][T17420] do_syscall_64+0x14d/0xf80 [ 383.086782][T17420] ? trace_irq_disable+0x3b/0x150 [ 383.086794][T17420] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.086809][T17420] ? clear_bhb_loop+0x40/0x90 [ 383.086827][T17420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.086841][T17420] RIP: 0033:0x7fda26b5d04e [ 383.086855][T17420] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 383.086868][T17420] RSP: 002b:00007fda24df5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 383.086883][T17420] RAX: ffffffffffffffda RBX: 00007fda24df66c0 RCX: 00007fda26b5d04e [ 383.086894][T17420] RDX: 000000000000000f RSI: 00007fda24df60a0 RDI: 0000000000000005 [ 383.086903][T17420] RBP: 00007fda24df6090 R08: 0000000000000000 R09: 0000000000000000 [ 383.086913][T17420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 383.086921][T17420] R13: 00007fda26e16128 R14: 00007fda26e16090 R15: 00007ffedc03b628 [ 383.086945][T17420] [ 383.971907][T17346] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 384.142462][T17425] netlink: 'syz.2.3314': attribute type 2 has an invalid length. [ 384.178199][T17428] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3315'. [ 384.269522][T17433] netlink: 'syz.1.3316': attribute type 1 has an invalid length. [ 384.360652][T17435] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3317'. [ 384.395738][T17437] FAULT_INJECTION: forcing a failure. [ 384.395738][T17437] name failslab, interval 1, probability 0, space 0, times 0 [ 384.435639][T17437] CPU: 0 UID: 0 PID: 17437 Comm: syz.0.3319 Not tainted syzkaller #0 PREEMPT(full) [ 384.435667][T17437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 384.435680][T17437] Call Trace: [ 384.435688][T17437] [ 384.435696][T17437] dump_stack_lvl+0xe8/0x150 [ 384.435730][T17437] should_fail_ex+0x412/0x560 [ 384.435766][T17437] should_failslab+0xa8/0x100 [ 384.435794][T17437] __kmalloc_noprof+0xe8/0x760 [ 384.435817][T17437] ? ethnl_default_doit+0x1ac/0xf50 [ 384.435846][T17437] ? __kmalloc_noprof+0x1b8/0x760 [ 384.435872][T17437] ethnl_default_doit+0x1ac/0xf50 [ 384.435919][T17437] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 384.435948][T17437] genl_family_rcv_msg_doit+0x22a/0x330 [ 384.435968][T17437] ? __asan_memcpy+0x40/0x70 [ 384.435991][T17437] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 384.436027][T17437] ? __lock_acquire+0x6b5/0x2cf0 [ 384.436058][T17437] genl_rcv_msg+0x61c/0x7a0 [ 384.436084][T17437] ? __pfx_genl_rcv_msg+0x10/0x10 [ 384.436102][T17437] ? __pfx_ethnl_default_doit+0x10/0x10 [ 384.436131][T17437] ? __lock_acquire+0x6b5/0x2cf0 [ 384.436167][T17437] netlink_rcv_skb+0x232/0x4b0 [ 384.436198][T17437] ? __pfx_genl_rcv_msg+0x10/0x10 [ 384.436220][T17437] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 384.436284][T17437] ? down_read+0x272/0x2e0 [ 384.436323][T17437] ? genl_rcv+0xd/0x40 [ 384.436347][T17437] genl_rcv+0x28/0x40 [ 384.436366][T17437] netlink_unicast+0x80f/0x9b0 [ 384.436399][T17437] ? __pfx_netlink_unicast+0x10/0x10 [ 384.436427][T17437] ? netlink_sendmsg+0x650/0xb40 [ 384.436456][T17437] ? skb_put+0x11b/0x210 [ 384.436490][T17437] netlink_sendmsg+0x813/0xb40 [ 384.436530][T17437] ? __pfx_netlink_sendmsg+0x10/0x10 [ 384.436565][T17437] ? aa_sock_msg_perm+0xf1/0x1b0 [ 384.436588][T17437] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 384.436617][T17437] ____sys_sendmsg+0x972/0x9f0 [ 384.436660][T17437] ? __pfx_____sys_sendmsg+0x10/0x10 [ 384.436702][T17437] ? import_iovec+0x73/0xa0 [ 384.436732][T17437] ___sys_sendmsg+0x2a5/0x360 [ 384.436771][T17437] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.436844][T17437] ? __fget_files+0x2a/0x420 [ 384.436865][T17437] ? __fget_files+0x3a0/0x420 [ 384.436904][T17437] __x64_sys_sendmsg+0x1bd/0x2a0 [ 384.436942][T17437] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 384.436987][T17437] ? __pfx_ksys_write+0x10/0x10 [ 384.437026][T17437] do_syscall_64+0x14d/0xf80 [ 384.437048][T17437] ? trace_irq_disable+0x3b/0x150 [ 384.437067][T17437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.437091][T17437] ? clear_bhb_loop+0x40/0x90 [ 384.437119][T17437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.437141][T17437] RIP: 0033:0x7ff77259c819 [ 384.437161][T17437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.437180][T17437] RSP: 002b:00007ff773535028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 384.437203][T17437] RAX: ffffffffffffffda RBX: 00007ff772815fa0 RCX: 00007ff77259c819 [ 384.437220][T17437] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 384.437233][T17437] RBP: 00007ff773535090 R08: 0000000000000000 R09: 0000000000000000 [ 384.437247][T17437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 384.437261][T17437] R13: 00007ff772816038 R14: 00007ff772815fa0 R15: 00007fff31bc9af8 [ 384.437296][T17437] [ 384.835037][T17445] __nla_validate_parse: 4 callbacks suppressed [ 384.835058][T17445] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3322'. [ 384.871664][T17445] 1ªX¹¦À: renamed from 60ªX¹¦À [ 384.892622][T17445] 1ªX¹¦À: entered allmulticast mode [ 384.898773][T17445] A link change request failed with some changes committed already. Interface 61ªX¹¦À may have been left with an inconsistent configuration, please check. [ 384.975751][T17454] netlink: 10 bytes leftover after parsing attributes in process `syz.2.3325'. [ 384.986118][T17456] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3321'. [ 385.034220][T17454] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3325'. [ 385.046881][T17455] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3325'. [ 385.195384][T17463] 1ªX¹¦À: left allmulticast mode [ 385.226525][T17469] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3328'. [ 385.290116][T16327] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.301122][T16327] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.331542][T16327] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.342772][T17477] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3329'. [ 385.354782][T16327] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.359737][T17480] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3331'. [ 385.590450][T17496] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 385.598329][T17496] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 385.776187][T17504] bond23: (slave bond_slave_1): Device is not bonding slave [ 385.808466][T17504] bond23: option active_slave: invalid value (bond_slave_1) [ 385.827893][T17504] bond23 (unregistering): Released all slaves [ 385.868108][T17511] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3342'. [ 386.211428][T17524] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3345'. [ 386.334697][T17533] veth11: entered allmulticast mode [ 386.420253][T17525] syzkaller1: entered promiscuous mode [ 386.429241][T17525] syzkaller1: entered allmulticast mode [ 386.478471][T17540] lo speed is unknown, defaulting to 1000 [ 386.486250][T17540] lo speed is unknown, defaulting to 1000 [ 386.672173][T17545] lo speed is unknown, defaulting to 1000 [ 386.710359][T17552] lo speed is unknown, defaulting to 1000 [ 386.730484][T17562] xt_nat: multiple ranges no longer supported [ 386.932348][T17545] lo speed is unknown, defaulting to 1000 [ 387.546150][T17552] lo speed is unknown, defaulting to 1000 [ 387.596849][T17616] openvswitch: netlink: Multiple metadata blocks provided [ 387.651223][T17617] Unsupported ieee802154 address type: 0 [ 388.003284][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 388.011446][ C1] lec:lec_tx_timeout: lec0 [ 388.016090][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 388.112335][T17645] netlink: 'syz.0.3375': attribute type 1 has an invalid length. [ 388.198731][T17645] 8021q: adding VLAN 0 to HW filter on device bond23 [ 388.334603][T17647] bond23: (slave veth13): Enslaving as an active interface with a down link [ 388.376890][T17640] bond23: (slave dummy0): making interface the new active one [ 388.408035][T17640] dummy0: entered promiscuous mode [ 388.424426][T17640] bond23: (slave dummy0): Enslaving as an active interface with an up link [ 388.493610][T17645] bond23: (slave dummy0): Releasing active interface [ 388.500832][T17645] dummy0 (unregistering): left promiscuous mode [ 389.012409][T17663] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 389.498160][T17677] bond17: (slave bond_slave_1): Device is not bonding slave [ 389.505879][T17677] bond17: option active_slave: invalid value (bond_slave_1) [ 389.640828][T17677] bond17 (unregistering): Released all slaves [ 389.746130][T17683] netlink: 'syz.3.3386': attribute type 2 has an invalid length. [ 389.870031][T17686] lo speed is unknown, defaulting to 1000 [ 389.897481][T17687] __nla_validate_parse: 8 callbacks suppressed [ 389.897504][T17687] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3387'. [ 389.926840][T17686] lo speed is unknown, defaulting to 1000 [ 390.424706][T17693] lo speed is unknown, defaulting to 1000 [ 390.477743][T17693] lo speed is unknown, defaulting to 1000 [ 390.714233][T17703] netlink: 'syz.0.3390': attribute type 10 has an invalid length. [ 390.767220][T17708] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 390.859304][T17708] bridge_slave_1: vlans aren't supported yet for dev_uc|mc_add() [ 390.881951][T17703] team0 (unregistering): Port device C removed [ 390.905719][T17703] team0 (unregistering): Port device team_slave_1 removed [ 390.917797][T17703] team0 (unregistering): Port device bond7 removed [ 390.928509][T17703] team0 (unregistering): Port device bond10 removed [ 390.963953][T17709] syzkaller0: entered promiscuous mode [ 390.969488][T17709] syzkaller0: entered allmulticast mode [ 391.317624][T17728] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3395'. [ 391.328523][T17728] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3395'. [ 391.552328][T17731] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3395'. [ 391.593623][T17731] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3395'. [ 391.838698][T17740] netlink: 67 bytes leftover after parsing attributes in process `syz.4.3396'. [ 392.366657][T16191] lo speed is unknown, defaulting to 1000 [ 392.372585][T16191] syz0: Port: 1 Link DOWN [ 392.399709][T17744] batadv_slave_1: entered promiscuous mode [ 392.417331][T17756] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 392.453008][T17758] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 392.493697][T16325] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.522702][T16325] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.562892][T16191] lo speed is unknown, defaulting to 1000 [ 392.570371][T17746] batadv_slave_1: left promiscuous mode [ 392.650676][T16325] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.671614][T16325] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.722091][T17768] netlink: 'syz.3.3402': attribute type 1 has an invalid length. [ 392.807825][T17777] FAULT_INJECTION: forcing a failure. [ 392.807825][T17777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.845228][T17777] CPU: 1 UID: 0 PID: 17777 Comm: syz.0.3403 Not tainted syzkaller #0 PREEMPT(full) [ 392.845258][T17777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 392.845272][T17777] Call Trace: [ 392.845280][T17777] [ 392.845289][T17777] dump_stack_lvl+0xe8/0x150 [ 392.845325][T17777] should_fail_ex+0x412/0x560 [ 392.845364][T17777] _copy_from_user+0x2d/0xb0 [ 392.845392][T17777] ___sys_sendmsg+0x1c6/0x360 [ 392.845430][T17777] ? __pfx____sys_sendmsg+0x10/0x10 [ 392.845499][T17777] ? __fget_files+0x2a/0x420 [ 392.845519][T17777] ? __fget_files+0x3a0/0x420 [ 392.845548][T17777] __x64_sys_sendmsg+0x1bd/0x2a0 [ 392.845584][T17777] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 392.845626][T17777] ? __pfx_ksys_write+0x10/0x10 [ 392.845663][T17777] do_syscall_64+0x14d/0xf80 [ 392.845684][T17777] ? trace_irq_disable+0x3b/0x150 [ 392.845702][T17777] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.845724][T17777] ? clear_bhb_loop+0x40/0x90 [ 392.845749][T17777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.845770][T17777] RIP: 0033:0x7ff77259c819 [ 392.845790][T17777] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 392.845809][T17777] RSP: 002b:00007ff773514028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 392.845831][T17777] RAX: ffffffffffffffda RBX: 00007ff772816090 RCX: 00007ff77259c819 [ 392.845846][T17777] RDX: 0000000000000011 RSI: 0000200000001b00 RDI: 0000000000000009 [ 392.845860][T17777] RBP: 00007ff773514090 R08: 0000000000000000 R09: 0000000000000000 [ 392.845873][T17777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 392.845886][T17777] R13: 00007ff772816128 R14: 00007ff772816090 R15: 00007fff31bc9af8 [ 392.845928][T17777] [ 392.848065][T17777] netlink: 'syz.0.3403': attribute type 1 has an invalid length. [ 392.982665][T17768] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3402'. [ 393.002769][T17776] bond21: (slave vxcan7): The slave device specified does not support setting the MAC address [ 393.038341][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 393.038369][ C1] lec:lec_tx_timeout: lec0 [ 393.047496][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 393.078386][T17776] bond21: (slave vxcan7): Error -95 calling set_mac_address [ 393.134580][T17779] macvlan3: entered promiscuous mode [ 393.139939][T17779] macvlan3: entered allmulticast mode [ 393.146545][T17779] bond21: entered promiscuous mode [ 393.156286][T17779] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 393.220879][T17779] bond21: left promiscuous mode [ 393.424599][T17801] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3408'. [ 393.506525][T17805] syzkaller0: entered promiscuous mode [ 393.512281][T17805] syzkaller0: entered allmulticast mode [ 393.512444][T17806] netlink: 'syz.3.3410': attribute type 1 has an invalid length. [ 393.806821][T17826] FAULT_INJECTION: forcing a failure. [ 393.806821][T17826] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 393.824693][T17826] CPU: 0 UID: 0 PID: 17826 Comm: syz.2.3417 Not tainted syzkaller #0 PREEMPT(full) [ 393.824723][T17826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 393.824736][T17826] Call Trace: [ 393.824745][T17826] [ 393.824754][T17826] dump_stack_lvl+0xe8/0x150 [ 393.824791][T17826] should_fail_ex+0x412/0x560 [ 393.824831][T17826] _copy_from_iter+0x1d3/0x1670 [ 393.824865][T17826] ? unwind_next_frame+0xa5/0x23c0 [ 393.824899][T17826] ? __pfx__copy_from_iter+0x10/0x10 [ 393.824948][T17826] bcm_sendmsg+0x172/0x6c0 [ 393.824981][T17826] ? __pfx_bcm_sendmsg+0x10/0x10 [ 393.825012][T17826] ? aa_sock_msg_perm+0xf1/0x1b0 [ 393.825036][T17826] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 393.825066][T17826] ____sys_sendmsg+0x972/0x9f0 [ 393.825110][T17826] ? __pfx_____sys_sendmsg+0x10/0x10 [ 393.825151][T17826] ? import_iovec+0x73/0xa0 [ 393.825180][T17826] ___sys_sendmsg+0x2a5/0x360 [ 393.825218][T17826] ? __pfx____sys_sendmsg+0x10/0x10 [ 393.825287][T17826] ? __fget_files+0x2a/0x420 [ 393.825307][T17826] ? __fget_files+0x3a0/0x420 [ 393.825337][T17826] __x64_sys_sendmsg+0x1bd/0x2a0 [ 393.825373][T17826] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 393.825415][T17826] ? __pfx_ksys_write+0x10/0x10 [ 393.825452][T17826] do_syscall_64+0x14d/0xf80 [ 393.825477][T17826] ? trace_irq_disable+0x3b/0x150 [ 393.825496][T17826] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.825518][T17826] ? clear_bhb_loop+0x40/0x90 [ 393.825544][T17826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.825566][T17826] RIP: 0033:0x7ff8a1b9c819 [ 393.825587][T17826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.825606][T17826] RSP: 002b:00007ff8a2994028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 393.825629][T17826] RAX: ffffffffffffffda RBX: 00007ff8a1e15fa0 RCX: 00007ff8a1b9c819 [ 393.825646][T17826] RDX: 0000000000000011 RSI: 0000200000001b00 RDI: 0000000000000009 [ 393.825659][T17826] RBP: 00007ff8a2994090 R08: 0000000000000000 R09: 0000000000000000 [ 393.825673][T17826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.825685][T17826] R13: 00007ff8a1e16038 R14: 00007ff8a1e15fa0 R15: 00007fffeaa245d8 [ 393.825718][T17826] [ 393.828799][T17826] netlink: 'syz.2.3417': attribute type 1 has an invalid length. [ 394.000311][T17831] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 394.168760][T17833] bond26: (slave bond_slave_1): Device is not bonding slave [ 394.186975][T17833] bond26: option active_slave: invalid value (bond_slave_1) [ 394.201892][T17833] bond26 (unregistering): Released all slaves [ 394.491057][T17841] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3419'. [ 394.506567][T17841] sctp: [Deprecated]: syz.2.3419 (pid 17841) Use of struct sctp_assoc_value in delayed_ack socket option. [ 394.506567][T17841] Use struct sctp_sack_info instead [ 396.292171][T17792] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 396.524109][T17854] rdma_rxe: rxe_newlink: failed to add lo [ 396.654600][T17870] FAULT_INJECTION: forcing a failure. [ 396.654600][T17870] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 396.683841][T17870] CPU: 0 UID: 0 PID: 17870 Comm: syz.3.3428 Not tainted syzkaller #0 PREEMPT(full) [ 396.683879][T17870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 396.683892][T17870] Call Trace: [ 396.683900][T17870] [ 396.683909][T17870] dump_stack_lvl+0xe8/0x150 [ 396.683945][T17870] should_fail_ex+0x412/0x560 [ 396.683985][T17870] _copy_from_iter+0x1d3/0x1670 [ 396.684007][T17870] ? __lock_acquire+0x6b5/0x2cf0 [ 396.684046][T17870] ? __pfx__copy_from_iter+0x10/0x10 [ 396.684069][T17870] ? _copy_from_iter+0x21b/0x1670 [ 396.684097][T17870] ? do_raw_spin_lock+0x12b/0x2f0 [ 396.684122][T17870] bcm_tx_setup+0x11be/0x1bc0 [ 396.684167][T17870] bcm_sendmsg+0x46e/0x6c0 [ 396.684196][T17870] ? __pfx_bcm_sendmsg+0x10/0x10 [ 396.684225][T17870] ? aa_sock_msg_perm+0xf1/0x1b0 [ 396.684248][T17870] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 396.684277][T17870] ____sys_sendmsg+0x972/0x9f0 [ 396.684320][T17870] ? __pfx_____sys_sendmsg+0x10/0x10 [ 396.684362][T17870] ? import_iovec+0x73/0xa0 [ 396.684390][T17870] ___sys_sendmsg+0x2a5/0x360 [ 396.684428][T17870] ? __pfx____sys_sendmsg+0x10/0x10 [ 396.684500][T17870] ? __fget_files+0x2a/0x420 [ 396.684518][T17870] ? __fget_files+0x3a0/0x420 [ 396.684549][T17870] __x64_sys_sendmsg+0x1bd/0x2a0 [ 396.684584][T17870] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 396.684627][T17870] ? __pfx_ksys_write+0x10/0x10 [ 396.684663][T17870] do_syscall_64+0x14d/0xf80 [ 396.684684][T17870] ? trace_irq_disable+0x3b/0x150 [ 396.684703][T17870] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.684742][T17870] ? clear_bhb_loop+0x40/0x90 [ 396.684769][T17870] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.684804][T17870] RIP: 0033:0x7f7e3299c819 [ 396.684824][T17870] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.684842][T17870] RSP: 002b:00007f7e338f8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 396.684873][T17870] RAX: ffffffffffffffda RBX: 00007f7e32c16090 RCX: 00007f7e3299c819 [ 396.684889][T17870] RDX: 0000000000000011 RSI: 0000200000001b00 RDI: 0000000000000009 [ 396.684903][T17870] RBP: 00007f7e338f8090 R08: 0000000000000000 R09: 0000000000000000 [ 396.684916][T17870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 396.684928][T17870] R13: 00007f7e32c16128 R14: 00007f7e32c16090 R15: 00007ffdad3c4bf8 [ 396.684962][T17870] [ 396.686992][T17870] netlink: 'syz.3.3428': attribute type 1 has an invalid length. [ 397.017312][T17875] openvswitch: netlink: Duplicate or invalid key (type 0). [ 397.038264][T17875] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 397.307803][T17886] bond20: left promiscuous mode [ 397.312759][T17886] bond20: left allmulticast mode [ 397.579590][T17910] rdma_rxe: rxe_newlink: failed to add lo [ 397.832501][T17930] netlink: 'syz.2.3450': attribute type 5 has an invalid length. [ 397.854758][T17926] netlink: 'syz.0.3448': attribute type 1 has an invalid length. [ 397.969842][T17926] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3448'. [ 397.982551][T17935] bond24: (slave vxcan7): The slave device specified does not support setting the MAC address [ 398.004300][T17935] bond24: (slave vxcan7): Error -95 calling set_mac_address [ 398.052974][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 398.061087][ C1] lec:lec_tx_timeout: lec0 [ 398.065799][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 398.194751][T17944] macvlan2: entered promiscuous mode [ 398.232989][T17944] macvlan2: entered allmulticast mode [ 398.239343][T17944] bond24: entered promiscuous mode [ 398.336740][T17944] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 398.356883][T17944] bond24: left promiscuous mode [ 398.501897][T17970] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3459'. [ 398.601799][T17974] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3461'. [ 398.641328][T17974] sctp: [Deprecated]: syz.0.3461 (pid 17974) Use of struct sctp_assoc_value in delayed_ack socket option. [ 398.641328][T17974] Use struct sctp_sack_info instead [ 399.025033][T18000] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3470'. [ 399.207355][T18015] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3474'. [ 399.238128][T18015] sctp: [Deprecated]: syz.0.3474 (pid 18015) Use of struct sctp_assoc_value in delayed_ack socket option. [ 399.238128][T18015] Use struct sctp_sack_info instead [ 399.260106][T18017] netlink: 'syz.2.3475': attribute type 10 has an invalid length. [ 399.295417][T18017] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3475'. [ 399.635541][ T5842] Bluetooth: hci4: command 0x0405 tx timeout [ 399.690066][T18053] netlink: 'syz.4.3486': attribute type 2 has an invalid length. [ 399.724144][T18057] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3487'. [ 399.739382][T18057] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3487'. [ 399.811347][T18062] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3488'. [ 399.862001][T18063] netlink: 'syz.4.3488': attribute type 8 has an invalid length. [ 399.919014][T18062] bond23: entered promiscuous mode [ 399.925860][T18062] 8021q: adding VLAN 0 to HW filter on device bond23 [ 400.056779][T18075] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3490'. [ 400.084236][T18075] sctp: [Deprecated]: syz.0.3490 (pid 18075) Use of struct sctp_assoc_value in delayed_ack socket option. [ 400.084236][T18075] Use struct sctp_sack_info instead [ 400.634476][T18079] ip6tnl2: entered allmulticast mode [ 400.641481][T16334] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 400.649563][T16334] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 400.663487][T16200] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 400.973146][T16191] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 401.520096][T18115] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 401.713990][T16191] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 401.726621][T18118] netlink: 'syz.4.3503': attribute type 1 has an invalid length. [ 401.761060][T18118] bond24: entered promiscuous mode [ 401.766771][T18118] 8021q: adding VLAN 0 to HW filter on device bond24 [ 401.796239][T18118] 8021q: adding VLAN 0 to HW filter on device bond24 [ 401.804431][T18118] bond24: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 401.816323][T18118] bond24: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 401.831665][T18118] bond24: (slave ip6gre1): making interface the new active one [ 401.841157][T18118] ip6gre1: entered promiscuous mode [ 401.850237][T18118] bond24: (slave ip6gre1): Enslaving as an active interface with an up link [ 402.097966][T18124] sctp: [Deprecated]: syz.2.3505 (pid 18124) Use of struct sctp_assoc_value in delayed_ack socket option. [ 402.097966][T18124] Use struct sctp_sack_info instead [ 403.003866][T18070] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 403.236540][T18147] netlink: 'syz.3.3511': attribute type 1 has an invalid length. [ 403.251095][T18142] bond23: left promiscuous mode [ 403.260281][T18142] bond24: left promiscuous mode [ 403.285636][T18142] ip6gre1: left promiscuous mode [ 403.337811][T18151] lo speed is unknown, defaulting to 1000 [ 403.494596][T18159] __nla_validate_parse: 5 callbacks suppressed [ 403.494616][T18159] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3516'. [ 403.585021][T18159] sctp: [Deprecated]: syz.1.3516 (pid 18159) Use of struct sctp_assoc_value in delayed_ack socket option. [ 403.585021][T18159] Use struct sctp_sack_info instead [ 403.605968][T18167] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3518'. [ 403.801948][T18178] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3523'. [ 403.803988][T18175] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3520'. [ 403.926622][T18181] syzkaller1: entered allmulticast mode [ 404.202858][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6140 ms [ 404.210967][ C1] lec:lec_tx_timeout: lec0 [ 404.219895][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 404.465042][T18222] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3530'. [ 404.474874][T18222] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3530'. [ 404.485286][T18222] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3530'. [ 404.502432][T18224] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3533'. [ 404.514265][T18222] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3530'. [ 404.524829][T18222] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3530'. [ 404.538312][T18224] sctp: [Deprecated]: syz.1.3533 (pid 18224) Use of struct sctp_assoc_value in delayed_ack socket option. [ 404.538312][T18224] Use struct sctp_sack_info instead [ 404.606172][T18226] tun0: tun_chr_ioctl cmd 1074025672 [ 404.611576][T18226] tun0: ignored: set checksum disabled [ 404.993166][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 405.482658][T18243] netlink: 'syz.4.3537': attribute type 21 has an invalid length. [ 405.491449][T18243] netlink: 'syz.4.3537': attribute type 4 has an invalid length. [ 405.500586][T18243] netlink: 'syz.4.3537': attribute type 5 has an invalid length. [ 406.996990][T18195] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 407.006942][T18219] netlink: 'syz.3.3530': attribute type 3 has an invalid length. [ 407.018122][T18219] netlink: 'syz.3.3530': attribute type 1 has an invalid length. [ 407.214947][T18252] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20000 [ 407.382797][T18263] sctp: [Deprecated]: syz.3.3544 (pid 18263) Use of struct sctp_assoc_value in delayed_ack socket option. [ 407.382797][T18263] Use struct sctp_sack_info instead [ 407.561678][T18274] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 407.746438][T18288] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 407.828194][T18288] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 408.251092][T18306] lo speed is unknown, defaulting to 1000 [ 408.360728][T18310] sctp: [Deprecated]: syz.0.3558 (pid 18310) Use of struct sctp_assoc_value in delayed_ack socket option. [ 408.360728][T18310] Use struct sctp_sack_info instead [ 408.547111][T18315] __nla_validate_parse: 97 callbacks suppressed [ 408.547131][T18315] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3560'. [ 409.350388][T18331] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3565'. [ 409.419717][T18333] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3566'. [ 409.430728][T18333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3566'. [ 409.601559][T18335] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3567'. [ 409.695582][T18339] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3569'. [ 409.708437][T18339] sctp: [Deprecated]: syz.4.3569 (pid 18339) Use of struct sctp_assoc_value in delayed_ack socket option. [ 409.708437][T18339] Use struct sctp_sack_info instead [ 409.952868][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5730 ms [ 409.960976][ C1] lec:lec_tx_timeout: lec0 [ 409.965854][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 410.792327][T18292] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 411.302693][T18374] macvlan2: entered promiscuous mode [ 411.435515][T18379] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3580'. [ 411.464884][T18379] sctp: [Deprecated]: syz.0.3580 (pid 18379) Use of struct sctp_assoc_value in delayed_ack socket option. [ 411.464884][T18379] Use struct sctp_sack_info instead [ 411.588363][T18383] syzkaller1: entered promiscuous mode [ 411.601171][T18383] syzkaller1: entered allmulticast mode [ 411.749106][T18387] bond26: entered allmulticast mode [ 411.756087][T18387] 8021q: adding VLAN 0 to HW filter on device bond26 [ 411.932739][T18406] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3587'. [ 412.107640][T18410] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3588'. [ 412.155031][T18410] openvswitch: netlink: Message has 2 unknown bytes. [ 412.345097][T18424] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3592'. [ 412.374941][T18424] sctp: [Deprecated]: syz.2.3592 (pid 18424) Use of struct sctp_assoc_value in delayed_ack socket option. [ 412.374941][T18424] Use struct sctp_sack_info instead [ 412.550958][T18430] geneve3: entered promiscuous mode [ 412.562627][T16323] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 53925 - 0 [ 412.577545][T16323] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 53925 - 0 [ 412.587583][T16323] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 53925 - 0 [ 412.635173][T16323] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 53925 - 0 [ 412.706648][T18437] netlink: 'syz.2.3598': attribute type 1 has an invalid length. [ 412.842447][T18438] bond26: Unable to set up delay as MII monitoring is disabled [ 412.856312][T18438] bond26 (unregistering): Released all slaves [ 412.896420][T18442] bond17: (slave vxcan1): The slave device specified does not support setting the MAC address [ 412.908529][T18442] bond17: (slave vxcan1): Error -95 calling set_mac_address [ 413.129409][T18461] sctp: [Deprecated]: syz.3.3605 (pid 18461) Use of struct sctp_assoc_value in delayed_ack socket option. [ 413.129409][T18461] Use struct sctp_sack_info instead [ 413.456907][T18486] netlink: 'syz.1.3613': attribute type 29 has an invalid length. [ 413.697262][T18498] "syz.4.3614" (18498) uses obsolete ecb(arc4) skcipher [ 413.769100][T18491] bond18: (slave bond_slave_1): Device is not bonding slave [ 413.793127][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 413.804889][T18491] bond18: option active_slave: invalid value (bond_slave_1) [ 413.865562][T18491] bond18 (unregistering): Released all slaves [ 414.196107][T18517] __nla_validate_parse: 4 callbacks suppressed [ 414.196128][T18517] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3620'. [ 414.223580][T18517] sctp: [Deprecated]: syz.1.3620 (pid 18517) Use of struct sctp_assoc_value in delayed_ack socket option. [ 414.223580][T18517] Use struct sctp_sack_info instead [ 414.287224][T18523] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3623'. [ 414.443602][T18528] bond25: entered promiscuous mode [ 414.449177][T18528] 8021q: adding VLAN 0 to HW filter on device bond25 [ 414.573867][T18542] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3630'. [ 414.659295][T18546] geneve3: entered allmulticast mode [ 414.676995][T18545] tipc: Invalid UDP bearer configuration [ 414.677040][T18545] tipc: Enabling of bearer rejected, failed to enable media [ 414.719673][T18550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3633'. [ 414.735443][T18550] netlink: 'syz.2.3633': attribute type 30 has an invalid length. [ 414.782555][T16319] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 414.782799][T18550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3633'. [ 414.822159][T16319] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 414.825582][T18550] netlink: 'syz.2.3633': attribute type 30 has an invalid length. [ 414.848464][T16319] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 414.869511][T18554] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3637'. [ 414.877364][T16319] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 414.929093][T18558] SET target dimension over the limit! [ 414.937226][T18560] netlink: zone id is out of range [ 414.942508][T18560] netlink: zone id is out of range [ 414.948467][T18560] netlink: zone id is out of range [ 414.954575][T18548] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3634'. [ 414.964336][T18560] netlink: zone id is out of range [ 414.969515][T18560] netlink: zone id is out of range [ 414.974889][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 414.974916][ C1] lec:lec_tx_timeout: lec0 [ 414.983122][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 415.014245][T18557] lo speed is unknown, defaulting to 1000 [ 415.017250][T18554] sctp: [Deprecated]: syz.4.3637 (pid 18554) Use of struct sctp_assoc_value in delayed_ack socket option. [ 415.017250][T18554] Use struct sctp_sack_info instead [ 415.025933][T18557] lo speed is unknown, defaulting to 1000 [ 415.079871][T18548] geneve2: entered promiscuous mode [ 415.113248][T18560] netlink: zone id is out of range [ 415.118509][T18560] netlink: zone id is out of range [ 415.187757][T18560] netlink: zone id is out of range [ 415.200106][T18560] netlink: zone id is out of range [ 415.223533][T18560] netlink: zone id is out of range [ 415.277613][T18571] xt_SECMARK: invalid mode: 4 [ 415.570103][T18580] lo speed is unknown, defaulting to 1000 [ 415.577986][T18580] lo speed is unknown, defaulting to 1000 [ 415.618124][T18582] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3644'. [ 415.643232][T18577] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3642'. [ 415.782370][T18585] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 415.819718][T18577] geneve4: entered promiscuous mode [ 415.847317][T18585] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3645'. [ 416.395463][T18605] sctp: [Deprecated]: syz.3.3650 (pid 18605) Use of struct sctp_assoc_value in delayed_ack socket option. [ 416.395463][T18605] Use struct sctp_sack_info instead [ 417.174940][T18639] syzkaller0: entered promiscuous mode [ 417.180506][T18639] syzkaller0: entered allmulticast mode [ 417.945897][T18680] lo speed is unknown, defaulting to 1000 [ 417.954078][T18680] lo speed is unknown, defaulting to 1000 [ 418.669263][T18718] netlink: 'syz.2.3675': attribute type 4 has an invalid length. [ 418.766020][T18708] nbd0: detected capacity change from 0 to 63 [ 418.799516][ T5842] block nbd0: Receive control failed (result -32) [ 418.807038][ T5832] block nbd0: Receive control failed (result -32) [ 418.846702][T17384] block nbd0: Dead connection, failed to find a fallback [ 418.879250][T17384] block nbd0: shutting down sockets [ 418.889596][T17384] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.900593][T17384] Buffer I/O error on dev nbd0, logical block 0, async page read [ 418.909763][T17384] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.932533][T17384] Buffer I/O error on dev nbd0, logical block 1, async page read [ 418.941402][T17384] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.956275][T17384] Buffer I/O error on dev nbd0, logical block 2, async page read [ 418.971344][T17384] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.982416][T17384] Buffer I/O error on dev nbd0, logical block 3, async page read [ 418.990951][T17384] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 419.001575][T17384] Buffer I/O error on dev nbd0, logical block 0, async page read [ 419.010115][T17384] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 419.020439][T17384] Buffer I/O error on dev nbd0, logical block 1, async page read [ 419.029243][T17384] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 419.039368][T17384] Buffer I/O error on dev nbd0, logical block 2, async page read [ 419.047384][T17384] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 419.057313][T17384] Buffer I/O error on dev nbd0, logical block 3, async page read [ 419.073471][T17384] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 419.086279][T17384] Buffer I/O error on dev nbd0, logical block 0, async page read [ 419.104121][T17384] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 419.124221][T17384] Buffer I/O error on dev nbd0, logical block 1, async page read [ 419.148006][T18730] .71·: renamed from .70· [ 419.175044][T17384] ldm_validate_partition_table(): Disk read failed. [ 419.194264][T17384] Dev nbd0: unable to read RDB block 0 [ 419.200466][T17384] nbd0: unable to read partition table [ 419.214935][T18730] .71·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 419.285108][T17384] ldm_validate_partition_table(): Disk read failed. [ 419.292550][T18730] .71·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 419.313044][T18730] .71·: entered allmulticast mode [ 419.318844][T17384] Dev nbd0: unable to read RDB block 0 [ 419.325646][T18730] hsr_slave_0: entered allmulticast mode [ 419.359866][T17384] nbd0: unable to read partition table [ 419.376430][T18730] hsr_slave_1: entered allmulticast mode [ 419.745137][T18755] syzkaller0: entered promiscuous mode [ 419.750679][T18755] syzkaller0: entered allmulticast mode [ 419.782543][T18761] vlan0: entered promiscuous mode [ 419.871884][T18750] tipc: Started in network mode [ 419.878365][T18750] tipc: Node identity 6ee18c60c21b, cluster identity 4711 [ 419.887962][T18750] tipc: Enabled bearer , priority 0 [ 419.896878][T18766] 8021q: VLANs not supported on ip6gre0 [ 419.938142][T18772] __nla_validate_parse: 17 callbacks suppressed [ 419.938162][T18772] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3690'. [ 419.970429][T18750] lo speed is unknown, defaulting to 1000 [ 419.978802][T18750] lo speed is unknown, defaulting to 1000 [ 419.992904][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 420.000975][ C1] lec:lec_tx_timeout: lec0 [ 420.006131][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 420.165027][T18776] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3692'. [ 420.186589][T18776] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3692'. [ 420.224260][T18776] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3692'. [ 420.234395][T18776] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3692'. [ 420.309382][T18783] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3696'. [ 420.373232][T18749] tipc: Resetting bearer [ 420.395650][T18749] tipc: Disabling bearer [ 420.424326][T18788] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3697'. [ 420.948726][T18803] netlink: 'syz.2.3702': attribute type 1 has an invalid length. [ 420.956858][T18803] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3702'. [ 421.230252][T18808] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3704'. [ 421.254505][T18808] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3704'. [ 421.872100][T18826] bond0: left promiscuous mode [ 421.878060][T18826] bond14: left promiscuous mode [ 422.025353][T18848] net_ratelimit: 46 callbacks suppressed [ 422.025375][T18848] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.136224][T18826] bond22: left promiscuous mode [ 422.177023][T18826] veth11: left allmulticast mode [ 422.235818][T18826] bond25: left promiscuous mode [ 422.251967][T18836] syzkaller0: entered promiscuous mode [ 422.265972][T18836] syzkaller0: entered allmulticast mode [ 422.515926][T18870] netlink: 'syz.4.3721': attribute type 83 has an invalid length. [ 422.676173][T18878] ipvlan2: entered promiscuous mode [ 422.875046][T18881] vlan0: left promiscuous mode [ 422.972214][T18881] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 422.999974][T18881] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 423.064383][T18881] geneve3: left promiscuous mode [ 423.142664][T18881] geneve4: left promiscuous mode [ 423.172142][T16332] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 423.180679][T16332] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 53925 - 0 [ 423.202892][T16332] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 423.212911][T16332] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 53925 - 0 [ 423.242608][T16332] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 423.263025][T16332] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 53925 - 0 [ 423.281503][T16332] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 423.302905][T16332] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 53925 - 0 [ 423.399329][T18910] syzkaller0: entered promiscuous mode [ 423.407763][T18910] syzkaller0: entered allmulticast mode [ 423.500744][T18931] netlink: 'syz.2.3737': attribute type 1 has an invalid length. [ 423.772173][T18942] netlink: 'syz.4.3740': attribute type 1 has an invalid length. [ 424.976706][T18955] netlink: 'syz.1.3744': attribute type 1 has an invalid length. [ 425.015153][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 425.023299][ C1] lec:lec_tx_timeout: lec0 [ 425.028016][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 425.332990][T18950] __nla_validate_parse: 4 callbacks suppressed [ 425.333010][T18950] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3741'. [ 425.348390][T18950] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3741'. [ 425.408883][T18955] bond27: entered promiscuous mode [ 425.415217][T18955] 8021q: adding VLAN 0 to HW filter on device bond27 [ 425.522013][T18967] workqueue: Failed to create a rescuer kthread for wq "bond22": -EINTR [ 425.742558][T18980] netlink: 496 bytes leftover after parsing attributes in process `syz.4.3751'. [ 425.782526][T18981] bridge6: entered promiscuous mode [ 425.792083][T18981] bridge6: entered allmulticast mode [ 425.814122][T18981] team0: Port device bridge6 added [ 425.819517][T18983] bridge0: port 2(team0) entered blocking state [ 425.828582][T18983] bridge0: port 2(team0) entered disabled state [ 425.835488][T18983] team0: entered allmulticast mode [ 425.842181][T18983] team_slave_0: entered allmulticast mode [ 425.886520][T18983] team_slave_1: entered allmulticast mode [ 425.900165][T18983] bond5: entered allmulticast mode [ 425.912055][T18983] team0: left allmulticast mode [ 425.938532][T18983] team_slave_0: left allmulticast mode [ 425.957501][T18983] team_slave_1: left allmulticast mode [ 425.965256][T18983] bond5: left allmulticast mode [ 425.981950][T18980] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3751'. [ 425.992148][T18980] netlink: 19 bytes leftover after parsing attributes in process `syz.4.3751'. [ 426.035239][T18980] netlink: 19 bytes leftover after parsing attributes in process `syz.4.3751'. [ 426.080777][T18997] FAULT_INJECTION: forcing a failure. [ 426.080777][T18997] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 426.130563][T18997] CPU: 0 UID: 0 PID: 18997 Comm: syz.1.3756 Not tainted syzkaller #0 PREEMPT(full) [ 426.130592][T18997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 426.130605][T18997] Call Trace: [ 426.130613][T18997] [ 426.130622][T18997] dump_stack_lvl+0xe8/0x150 [ 426.130656][T18997] should_fail_ex+0x412/0x560 [ 426.130692][T18997] _copy_from_iter+0x1d3/0x1670 [ 426.130720][T18997] ? rcu_is_watching+0x15/0xb0 [ 426.130756][T18997] ? __pfx__copy_from_iter+0x10/0x10 [ 426.130792][T18997] ? netlink_sendmsg+0x650/0xb40 [ 426.130820][T18997] ? skb_put+0x11b/0x210 [ 426.130853][T18997] netlink_sendmsg+0x6c0/0xb40 [ 426.130892][T18997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 426.130925][T18997] ? aa_sock_msg_perm+0xf1/0x1b0 [ 426.130947][T18997] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 426.130976][T18997] ____sys_sendmsg+0x972/0x9f0 [ 426.131023][T18997] ? __pfx_____sys_sendmsg+0x10/0x10 [ 426.131083][T18997] ? import_iovec+0x73/0xa0 [ 426.131113][T18997] ___sys_sendmsg+0x2a5/0x360 [ 426.131163][T18997] ? __pfx____sys_sendmsg+0x10/0x10 [ 426.131234][T18997] ? __fget_files+0x2a/0x420 [ 426.131254][T18997] ? __fget_files+0x3a0/0x420 [ 426.131284][T18997] __x64_sys_sendmsg+0x1bd/0x2a0 [ 426.131321][T18997] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 426.131364][T18997] ? __pfx_ksys_write+0x10/0x10 [ 426.131402][T18997] do_syscall_64+0x14d/0xf80 [ 426.131423][T18997] ? trace_irq_disable+0x3b/0x150 [ 426.131443][T18997] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.131465][T18997] ? clear_bhb_loop+0x40/0x90 [ 426.131492][T18997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.131514][T18997] RIP: 0033:0x7fda26b9c819 [ 426.131533][T18997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.131553][T18997] RSP: 002b:00007fda27971028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 426.131576][T18997] RAX: ffffffffffffffda RBX: 00007fda26e15fa0 RCX: 00007fda26b9c819 [ 426.131592][T18997] RDX: 0000000000004090 RSI: 00002000000000c0 RDI: 0000000000000003 [ 426.131606][T18997] RBP: 00007fda27971090 R08: 0000000000000000 R09: 0000000000000000 [ 426.131620][T18997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.131633][T18997] R13: 00007fda26e16038 R14: 00007fda26e15fa0 R15: 00007ffedc03b628 [ 426.131667][T18997] [ 426.533729][T19015] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 426.938686][T19037] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3764'. [ 427.206876][T19047] bond26: (slave bond_slave_1): Device is not bonding slave [ 427.217348][T19047] bond26: option active_slave: invalid value (bond_slave_1) [ 427.229724][T19047] bond26 (unregistering): Released all slaves [ 427.308468][T19056] netlink: 'syz.1.3771': attribute type 4 has an invalid length. [ 427.324720][T19056] netlink: 'syz.1.3771': attribute type 4 has an invalid length. [ 427.339688][T19056] set match dimension is over the limit! [ 427.578346][T19066] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3772'. [ 427.898220][T19078] netlink: 'syz.2.3775': attribute type 13 has an invalid length. [ 428.237291][T19101] netlink: 'syz.3.3782': attribute type 1 has an invalid length. [ 428.420548][T19109] netlink: 'syz.3.3785': attribute type 7 has an invalid length. [ 428.434245][T19109] netlink: 'syz.3.3785': attribute type 7 has an invalid length. [ 428.689078][T19120] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3789'. [ 428.835836][T19133] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3794'. [ 428.848006][T19133] netlink: 'syz.1.3794': attribute type 25 has an invalid length. [ 428.870554][T16325] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.879223][T19133] netlink: 'syz.1.3794': attribute type 25 has an invalid length. [ 428.887838][T16325] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.896567][T16325] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.905376][T16325] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.147598][T19160] netlink: 'syz.3.3796': attribute type 9 has an invalid length. [ 429.283849][T19165] lo speed is unknown, defaulting to 1000 [ 429.291641][T19165] lo speed is unknown, defaulting to 1000 [ 429.584267][T19182] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 429.623442][T19176] lo speed is unknown, defaulting to 1000 [ 429.707205][T19176] lo speed is unknown, defaulting to 1000 [ 429.986492][T19191] syzkaller0: entered promiscuous mode [ 429.992042][T19191] syzkaller0: entered allmulticast mode [ 430.030289][T19191] pimreg: tun_chr_ioctl cmd 1074025677 [ 430.042055][T19191] pimreg: linktype set to 774 [ 430.046906][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 430.046933][ C1] lec:lec_tx_timeout: lec0 [ 430.055109][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 431.713162][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 431.955402][T19139] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 432.321365][T19219] netlink: 'syz.0.3820': attribute type 1 has an invalid length. [ 432.329960][T19219] __nla_validate_parse: 7 callbacks suppressed [ 432.329979][T19219] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3820'. [ 432.367788][T19225] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3821'. [ 432.582325][T19233] tun0: tun_chr_ioctl cmd 1074025677 [ 432.588041][T19233] tun0: linktype set to 822 [ 432.685978][T19239] block nbd0: NBD_DISCONNECT [ 432.692867][T19239] block nbd0: Send disconnect failed -32 [ 432.713576][T19239] block nbd0: Send disconnect failed -32 [ 432.908851][T19245] macsec0: entered allmulticast mode [ 432.929076][T19248] veth1_macvtap: entered allmulticast mode [ 432.939803][T19248] macsec0: left allmulticast mode [ 432.948798][T19248] veth1_macvtap: left allmulticast mode [ 433.126859][T19263] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3834'. [ 433.184941][T19263] sctp: [Deprecated]: syz.2.3834 (pid 19263) Use of struct sctp_assoc_value in delayed_ack socket option. [ 433.184941][T19263] Use struct sctp_sack_info instead [ 433.429532][T19287] syzkaller0: entered promiscuous mode [ 433.436624][T19287] syzkaller0: entered allmulticast mode [ 433.534659][T19294] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3843'. [ 433.549122][T19294] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3843'. [ 435.024314][T19318] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3849'. [ 435.039708][T19318] ip6gre1: entered promiscuous mode [ 435.045177][T19318] ip6gre1: entered allmulticast mode [ 435.052199][T16334] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 435.078258][T16192] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 435.086420][T16334] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 435.425279][T16192] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 435.872858][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5820 ms [ 435.880989][ C1] lec:lec_tx_timeout: lec0 [ 435.886238][T16192] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 435.953576][T16192] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 436.005407][T19352] netlink: 'syz.1.3857': attribute type 1 has an invalid length. [ 436.033629][T16192] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 436.720121][T19379] syzkaller0: entered promiscuous mode [ 436.732386][T19379] syzkaller0: entered allmulticast mode [ 436.756650][T19373] hsr0: left promiscuous mode [ 436.774202][T19373] xfrm0: left promiscuous mode [ 436.779127][T19373] xfrm0: left allmulticast mode [ 436.804801][T19373] erspan0: left allmulticast mode [ 436.810349][T19373] erspan0: left promiscuous mode [ 436.820373][T19373] macvtap1: left promiscuous mode [ 436.827382][T19373] macvtap1: left allmulticast mode [ 436.846352][T19373] ip6tnl2: left allmulticast mode [ 436.861889][T19373] macvlan2: left promiscuous mode [ 436.871154][T19373] bond26: left allmulticast mode [ 436.884169][T19386] netlink: 'syz.2.3869': attribute type 1 has an invalid length. [ 436.884198][T19373] geneve2: left promiscuous mode [ 436.900327][T19373] bond27: left promiscuous mode [ 436.910388][T19373] ip6gre1: left promiscuous mode [ 436.916498][T19373] ip6gre1: left allmulticast mode [ 436.944324][T19388] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3870'. [ 436.964494][ T87] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 436.993510][T16326] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 437.080792][T16326] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 437.099786][T16326] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 437.285916][T19402] syzkaller0: entered promiscuous mode [ 437.305476][T19402] syzkaller0: entered allmulticast mode [ 437.469919][T19404] netlink: 'syz.1.3876': attribute type 1 has an invalid length. [ 437.644156][T19424] netlink: 'syz.0.3881': attribute type 1 has an invalid length. [ 437.808816][T19429] syzkaller0: entered promiscuous mode [ 437.814568][T19429] syzkaller0: entered allmulticast mode [ 437.977270][T19438] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3887'. [ 437.994618][T19438] sctp: [Deprecated]: syz.3.3887 (pid 19438) Use of struct sctp_assoc_value in delayed_ack socket option. [ 437.994618][T19438] Use struct sctp_sack_info instead [ 438.308571][T19456] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3891'. [ 438.566583][T19472] syzkaller0: entered promiscuous mode [ 438.572382][T19472] syzkaller0: entered allmulticast mode [ 438.610097][T19474] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3899'. [ 438.626218][T19474] sctp: [Deprecated]: syz.4.3899 (pid 19474) Use of struct sctp_assoc_value in delayed_ack socket option. [ 438.626218][T19474] Use struct sctp_sack_info instead [ 438.676587][T19478] netlink: 'syz.3.3900': attribute type 10 has an invalid length. [ 439.144879][T19510] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3912'. [ 439.156991][T19510] sctp: [Deprecated]: syz.3.3912 (pid 19510) Use of struct sctp_assoc_value in delayed_ack socket option. [ 439.156991][T19510] Use struct sctp_sack_info instead [ 439.177392][T19508] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 439.188311][T19508] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 439.480702][T19532] tipc: Enabled bearer , priority 0 [ 439.521660][T19533] lo speed is unknown, defaulting to 1000 [ 439.542501][T19533] lo speed is unknown, defaulting to 1000 [ 439.567296][T19537] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.3916'. [ 439.580622][T19537] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.3916'. [ 439.597483][T19539] macsec1: entered promiscuous mode [ 439.603366][T19539] veth1_to_bond: entered promiscuous mode [ 439.613744][T19539] veth1_to_bond: left promiscuous mode [ 439.619549][T19541] netlink: 'syz.2.3919': attribute type 1 has an invalid length. [ 439.662520][T19541] bond18: entered promiscuous mode [ 439.668316][T19541] 8021q: adding VLAN 0 to HW filter on device bond18 [ 439.696870][T19541] ipvlan2: entered allmulticast mode [ 439.702309][T19541] bond18: entered allmulticast mode [ 439.730765][T19541] bond18: (slave bridge11): making interface the new active one [ 439.739185][T19541] bridge11: entered promiscuous mode [ 439.746154][T19541] bridge11: entered allmulticast mode [ 439.764088][T19541] bond18: (slave bridge11): Enslaving as an active interface with an up link [ 439.990114][T19550] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3918'. [ 440.007651][T19551] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3922'. [ 440.040468][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 440.080558][T19551] macvlan2: entered allmulticast mode [ 440.090328][T19551] hsr0: entered allmulticast mode [ 440.100546][T19551] hsr_slave_0: entered allmulticast mode [ 440.110051][T19551] hsr_slave_1: entered allmulticast mode [ 440.141175][T19553] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3921'. [ 440.240180][T19556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3923'. [ 440.451790][T19559] netlink: 'syz.0.3924': attribute type 10 has an invalid length. [ 440.463001][T19564] netlink: 'syz.4.3926': attribute type 1 has an invalid length. [ 440.495328][T19559] batadv0: entered promiscuous mode [ 440.500641][T19559] batadv0: entered allmulticast mode [ 440.509177][T19559] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 440.526412][T19562] sctp: [Deprecated]: syz.3.3925 (pid 19562) Use of struct sctp_assoc_value in delayed_ack socket option. [ 440.526412][T19562] Use struct sctp_sack_info instead [ 440.587564][T19564] 8021q: adding VLAN 0 to HW filter on device bond26 [ 441.260161][T19597] lo speed is unknown, defaulting to 1000 [ 441.285313][T19597] lo speed is unknown, defaulting to 1000 [ 441.373243][T19605] sctp: [Deprecated]: syz.0.3938 (pid 19605) Use of struct sctp_assoc_value in delayed_ack socket option. [ 441.373243][T19605] Use struct sctp_sack_info instead [ 441.535594][T19601] openvswitch: netlink: Flow actions attr not present in new flow. [ 441.587637][T19610] dvmrp0: entered allmulticast mode [ 441.647966][T19607] lo speed is unknown, defaulting to 1000 [ 441.756374][T19620] netlink: 'syz.0.3939': attribute type 5 has an invalid length. [ 441.797068][T19613] syzkaller0: entered promiscuous mode [ 441.817794][T19613] syzkaller0: entered allmulticast mode [ 442.029416][T19607] lo speed is unknown, defaulting to 1000 [ 443.184575][T19639] __nla_validate_parse: 6 callbacks suppressed [ 443.184596][T19639] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3942'. [ 443.267227][T19640] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3942'. [ 444.537334][T19648] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3944'. [ 444.758079][T19651] lo speed is unknown, defaulting to 1000 [ 444.786403][T19658] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3946'. [ 444.848656][T19659] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3946'. [ 445.052900][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 445.061015][ C1] lec:lec_tx_timeout: lec0 [ 445.075939][T19672] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3949'. [ 445.105662][T19672] sctp: [Deprecated]: syz.4.3949 (pid 19672) Use of struct sctp_assoc_value in delayed_ack socket option. [ 445.105662][T19672] Use struct sctp_sack_info instead [ 445.516563][T19692] netlink: 'syz.4.3953': attribute type 4 has an invalid length. [ 445.829047][T19700] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3960'. [ 445.874171][T19700] bond0: entered promiscuous mode [ 445.883034][T19700] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 445.894992][T19700] bond0: left promiscuous mode [ 445.899949][T19700] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 446.068428][T19715] syzkaller0: entered promiscuous mode [ 446.074738][T19715] syzkaller0: entered allmulticast mode [ 446.164985][T19720] netlink: 'syz.1.3964': attribute type 4 has an invalid length. [ 446.573532][T19744] lo speed is unknown, defaulting to 1000 [ 446.618286][T19747] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3974'. [ 446.666832][T19749] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3975'. [ 448.834147][T19703] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 449.013615][T19760] syzkaller0: entered promiscuous mode [ 449.019252][T19760] syzkaller0: entered allmulticast mode [ 449.036241][T19766] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3983'. [ 449.089517][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.132487][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.149138][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.165153][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.183528][T19770] erspan0: entered promiscuous mode [ 449.191246][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.204927][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.217128][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.230565][T19777] netlink: 480 bytes leftover after parsing attributes in process `syz.1.3985'. [ 449.238844][T19770] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3980'. [ 449.261004][T19770] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 449.340408][T19775] veth11: entered allmulticast mode [ 449.355326][T19775] bond22: (slave veth11): Enslaving as an active interface with an up link [ 449.366013][T19774] lo speed is unknown, defaulting to 1000 [ 449.418023][T19778] bond22 (unregistering): (slave veth11): Releasing backup interface [ 449.457029][T19778] bond22 (unregistering): Released all slaves [ 449.596929][ T7161] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 449.606235][T16332] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 449.851026][T19806] netlink: 'syz.4.3992': attribute type 15 has an invalid length. [ 450.173101][ T7161] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 450.673618][T16334] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 450.682499][T16334] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 450.843856][T19835] rdma_rxe: rxe_newlink: failed to add lo [ 450.904754][T19839] lo speed is unknown, defaulting to 1000 [ 451.393180][T16192] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 452.520749][T19790] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 452.734069][T19855] netlink: 'syz.3.4007': attribute type 1 has an invalid length. [ 452.936109][T19868] lo speed is unknown, defaulting to 1000 [ 452.952040][T19868] lo speed is unknown, defaulting to 1000 [ 452.982041][T19865] lo speed is unknown, defaulting to 1000 [ 453.014174][T19875] FAULT_INJECTION: forcing a failure. [ 453.014174][T19875] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.057508][T19875] CPU: 1 UID: 0 PID: 19875 Comm: syz.3.4015 Not tainted syzkaller #0 PREEMPT(full) [ 453.057538][T19875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 453.057563][T19875] Call Trace: [ 453.057572][T19875] [ 453.057581][T19875] dump_stack_lvl+0xe8/0x150 [ 453.057618][T19875] should_fail_ex+0x412/0x560 [ 453.057657][T19875] _copy_from_user+0x2d/0xb0 [ 453.057683][T19875] __sys_bpf+0x229/0x950 [ 453.057707][T19875] ? __pfx___sys_bpf+0x10/0x10 [ 453.057743][T19875] ? ksys_write+0x242/0x270 [ 453.057771][T19875] ? __pfx_ksys_write+0x10/0x10 [ 453.057803][T19875] __x64_sys_bpf+0x7c/0x90 [ 453.057835][T19875] do_syscall_64+0x14d/0xf80 [ 453.057855][T19875] ? trace_irq_disable+0x3b/0x150 [ 453.057874][T19875] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.057895][T19875] ? clear_bhb_loop+0x40/0x90 [ 453.057921][T19875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.057942][T19875] RIP: 0033:0x7f7e3299c819 [ 453.057962][T19875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 453.057980][T19875] RSP: 002b:00007f7e33919028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 453.058002][T19875] RAX: ffffffffffffffda RBX: 00007f7e32c15fa0 RCX: 00007f7e3299c819 [ 453.058018][T19875] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 000000000000000a [ 453.058032][T19875] RBP: 00007f7e33919090 R08: 0000000000000000 R09: 0000000000000000 [ 453.058045][T19875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 453.058063][T19875] R13: 00007f7e32c16038 R14: 00007f7e32c15fa0 R15: 00007ffdad3c4bf8 [ 453.058097][T19875] [ 453.712617][T19865] lo speed is unknown, defaulting to 1000 [ 454.681897][T19934] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 454.916338][ T5488] macvtap0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 455.040318][T19939] netlink: 'syz.0.4029': attribute type 1 has an invalid length. [ 455.073118][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 455.122090][T19939] veth21: entered promiscuous mode [ 456.357560][T19880] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 456.749103][T19967] veth1_macvtap: renamed from vlan1 [ 456.805840][T19975] __nla_validate_parse: 15 callbacks suppressed [ 456.805862][T19975] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4039'. [ 456.862508][T19975] tipc: Enabling of bearer rejected, media not registered [ 456.947507][T19979] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4039'. [ 457.026587][T19979] nbd: socks must be embedded in a SOCK_ITEM attr [ 457.076890][T19937] block nbd64: NBD_DISCONNECT [ 457.076907][T19986] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4039'. [ 457.136563][T19986] nbd: socks must be embedded in a SOCK_ITEM attr [ 457.178896][T19666] block nbd64: NBD_DISCONNECT [ 457.486046][T20012] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4045'. [ 457.594887][T19666] udevd[19666]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 457.924704][T20037] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4049'. [ 457.959930][T20037] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4049'. [ 458.024234][T10701] lec:lec_start_xmit: lec0:No lecd attached [ 458.046486][T20037] bond19: option packets_per_slave: invalid value (1048582) [ 458.054019][T20037] bond19: option packets_per_slave: allowed values 0 - 65535 [ 458.063365][T20037] bond19 (unregistering): Released all slaves [ 460.342310][T20002] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 460.567336][T20079] netlink: 'syz.0.4057': attribute type 1 has an invalid length. [ 460.614697][T20082] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 460.846467][T20099] xt_hashlimit: size too large, truncated to 1048576 [ 460.912736][T20101] –: renamed from wg2 [ 461.353296][T20128] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4071'. [ 461.362326][T20128] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4071'. [ 462.214233][T20144] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4075'. [ 462.392319][T20155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4073'. [ 462.401875][T20155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4073'. [ 462.847927][T20172] xt_CT: You must specify a L4 protocol and not use inversions on it [ 463.020284][T20180] bond28: (slave bond_slave_1): Device is not bonding slave [ 463.030557][T20180] bond28: option active_slave: invalid value (bond_slave_1) [ 463.038105][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 463.038132][ C1] lec:lec_tx_timeout: lec0 [ 463.119719][T20180] bond28 (unregistering): Released all slaves [ 463.348686][T20199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4087'. [ 463.713088][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 463.727817][T20213] tipc: Enabled bearer , priority 0 [ 463.761617][T20213] mac80211_hwsim hwsim29 syzkaller0: entered promiscuous mode [ 463.773329][T20213] mac80211_hwsim hwsim29 syzkaller0: entered allmulticast mode [ 463.817409][T20213] tipc: Resetting bearer [ 463.965258][T20217] lo speed is unknown, defaulting to 1000 [ 463.974304][T20217] lo speed is unknown, defaulting to 1000 [ 464.033660][T20225] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 464.701305][T20268] bond28: (slave bond_slave_1): Device is not bonding slave [ 464.710775][T20268] bond28: option active_slave: invalid value (bond_slave_1) [ 464.720381][T20268] bond28 (unregistering): Released all slaves [ 465.575038][T20301] netlink: 324 bytes leftover after parsing attributes in process `syz.1.4106'. [ 465.655342][T20301] bond29: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 465.713548][T20301] bond29: (slave lo): Enslaving as an active interface with an up link [ 465.722720][T20301] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 466.164186][T20331] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4116'. [ 466.325784][T20339] bond24: (slave bond_slave_1): Device is not our slave [ 466.333075][T20339] bond24: option active_slave: invalid value (bond_slave_1) [ 466.360026][T20342] netlink: 'syz.1.4119': attribute type 4 has an invalid length. [ 466.368535][T20342] netlink: 156 bytes leftover after parsing attributes in process `syz.1.4119'. [ 466.650443][T20339] bond24 (unregistering): Released all slaves [ 466.722429][T20342] wlan1: mtu greater than device maximum [ 467.071445][T20357] tipc: Enabled bearer , priority 21 [ 467.089812][T20357] tipc: Enabling of bearer rejected, already enabled [ 467.127093][T20360] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4121'. [ 467.137153][T20360] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4121'. [ 467.146421][T20360] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4121'. [ 468.196885][T20390] __nla_validate_parse: 1 callbacks suppressed [ 468.196906][T20390] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4132'. [ 468.574680][T20402] block nbd0: server does not support multiple connections per device. [ 468.586122][T20402] block nbd0: shutting down sockets [ 468.740586][T20408] bond28: (slave bond_slave_1): Device is not bonding slave [ 468.752527][T20408] bond28: option active_slave: invalid value (bond_slave_1) [ 468.771135][T20408] bond28 (unregistering): Released all slaves [ 468.892061][T20412] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 469.532108][T20442] SET target dimension over the limit! [ 469.897008][T20459] IPVS: set_ctl: invalid protocol: 33 172.20.20.170:20001 [ 471.184587][T20513] netlink: 'syz.2.4167': attribute type 5 has an invalid length. [ 471.597254][T20531] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4174'. [ 471.612052][T20537] tipc: Failed to remove unknown binding: 66,1,1/0:1298625912/1298625914 [ 471.672182][T20537] tipc: Failed to remove unknown binding: 66,1,1/0:1298625912/1298625914 [ 471.728470][T20537] tipc: Failed to remove unknown binding: 66,1,1/0:1298625912/1298625914 [ 471.768928][T20540] sctp: [Deprecated]: syz.4.4175 (pid 20540) Use of int in max_burst socket option. [ 471.768928][T20540] Use struct sctp_assoc_value instead [ 471.995861][T20547] tc_dump_action: action bad kind [ 472.243934][T20555] tipc: Enabled bearer , priority 0 [ 472.262410][T20555] syzkaller0: entered promiscuous mode [ 472.274523][T20555] syzkaller0: entered allmulticast mode [ 472.326797][T20561] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4183'. [ 472.361868][T20555] tipc: Resetting bearer [ 472.419245][T20554] tipc: Resetting bearer [ 472.497928][T20554] tipc: Disabling bearer [ 472.499008][T20575] rdma_rxe: rxe_newlink: failed to add lo [ 472.907888][T20588] syzkaller1: entered promiscuous mode [ 472.919098][T20588] syzkaller1: entered allmulticast mode [ 472.930153][T20588] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4192'. [ 472.939458][T20588] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4192'. [ 473.675710][T20616] netlink: 'syz.1.4197': attribute type 30 has an invalid length. [ 473.707929][T20616] [ 473.710420][T20616] ====================================================== [ 473.717457][T20616] WARNING: possible circular locking dependency detected [ 473.724508][T20616] syzkaller #0 Not tainted [ 473.728954][T20616] ------------------------------------------------------ [ 473.735991][T20616] syz.1.4197/20616 is trying to acquire lock: [ 473.742074][T20616] ffffffff8e85db48 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x218/0x19c0 [ 473.751673][T20616] [ 473.751673][T20616] but task is already holding lock: [ 473.759043][T20616] ffffffff8e5fccc8 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0x9ef/0x1e90 [ 473.768377][T20616] [ 473.768377][T20616] which lock already depends on the new lock. [ 473.768377][T20616] [ 473.778782][T20616] [ 473.778782][T20616] the existing dependency chain (in reverse order) is: [ 473.787801][T20616] [ 473.787801][T20616] -> #9 (wq_pool_mutex){+.+.}-{4:4}: [ 473.795287][T20616] __mutex_lock+0x19f/0x1300 [ 473.800423][T20616] __alloc_workqueue+0x9ef/0x1e90 [ 473.805983][T20616] alloc_workqueue_noprof+0xe3/0x210 [ 473.811804][T20616] padata_alloc+0xc1/0x370 [ 473.816761][T20616] pcrypt_init_padata+0x27/0x100 [ 473.822246][T20616] pcrypt_init+0x60/0xc0 [ 473.827032][T20616] do_one_initcall+0x250/0x8d0 [ 473.832334][T20616] do_initcall_level+0x104/0x190 [ 473.837815][T20616] do_initcalls+0x59/0xa0 [ 473.842689][T20616] kernel_init_freeable+0x2a6/0x3e0 [ 473.848427][T20616] kernel_init+0x1d/0x1d0 [ 473.853296][T20616] ret_from_fork+0x51e/0xb90 [ 473.858430][T20616] ret_from_fork_asm+0x1a/0x30 [ 473.863730][T20616] [ 473.863730][T20616] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 473.871478][T20616] cpus_read_lock+0x42/0x160 [ 473.876606][T20616] static_key_slow_inc+0x12/0x30 [ 473.882089][T20616] ipv6_flowlabel_opt+0x1b94/0x28e0 [ 473.887848][T20616] do_ipv6_setsockopt+0xd9f/0x3150 [ 473.893502][T20616] ipv6_setsockopt+0x59/0x170 [ 473.898737][T20616] do_sock_setsockopt+0x17c/0x1b0 [ 473.904300][T20616] __x64_sys_setsockopt+0x13d/0x1b0 [ 473.910038][T20616] do_syscall_64+0x14d/0xf80 [ 473.915158][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.921586][T20616] [ 473.921586][T20616] -> #7 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 473.929331][T20616] lock_sock_nested+0x41/0x100 [ 473.934629][T20616] inet_shutdown+0x6a/0x390 [ 473.939677][T20616] nbd_mark_nsock_dead+0x2e9/0x560 [ 473.945323][T20616] sock_shutdown+0x15e/0x260 [ 473.950452][T20616] nbd_clear_sock+0x24/0x170 [ 473.955577][T20616] nbd_config_put+0x2dd/0x580 [ 473.960782][T20616] nbd_genl_connect+0x19d5/0x1cf0 [ 473.966340][T20616] genl_family_rcv_msg_doit+0x22a/0x330 [ 473.972418][T20616] genl_rcv_msg+0x61c/0x7a0 [ 473.977455][T20616] netlink_rcv_skb+0x232/0x4b0 [ 473.982764][T20616] genl_rcv+0x28/0x40 [ 473.987303][T20616] netlink_unicast+0x80f/0x9b0 [ 473.992614][T20616] netlink_sendmsg+0x813/0xb40 [ 473.997940][T20616] ____sys_sendmsg+0x972/0x9f0 [ 474.003247][T20616] ___sys_sendmsg+0x2a5/0x360 [ 474.008469][T20616] __x64_sys_sendmsg+0x1bd/0x2a0 [ 474.013950][T20616] do_syscall_64+0x14d/0xf80 [ 474.019109][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.025541][T20616] [ 474.025541][T20616] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 474.033207][T20616] __mutex_lock+0x19f/0x1300 [ 474.038351][T20616] nbd_queue_rq+0x37b/0x1100 [ 474.043498][T20616] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 474.049595][T20616] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 474.056462][T20616] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 474.062988][T20616] blk_mq_run_hw_queue+0x348/0x4f0 [ 474.068652][T20616] blk_mq_dispatch_list+0xd16/0xe10 [ 474.074395][T20616] blk_mq_flush_plug_list+0x48d/0x570 [ 474.080337][T20616] __blk_flush_plug+0x3ed/0x4d0 [ 474.085725][T20616] __submit_bio+0x28d/0x580 [ 474.090768][T20616] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 474.096972][T20616] block_read_full_folio+0x599/0x830 [ 474.102801][T20616] filemap_read_folio+0x137/0x3b0 [ 474.108367][T20616] do_read_cache_folio+0x358/0x590 [ 474.114046][T20616] read_part_sector+0xb6/0x2b0 [ 474.119364][T20616] adfspart_check_ICS+0xa5/0xa40 [ 474.124838][T20616] bdev_disk_changed+0x7ba/0x1550 [ 474.130405][T20616] blkdev_get_whole+0x380/0x510 [ 474.135791][T20616] bdev_open+0x31e/0xd30 [ 474.140570][T20616] blkdev_open+0x470/0x610 [ 474.145524][T20616] do_dentry_open+0x785/0x14e0 [ 474.150823][T20616] vfs_open+0x3b/0x340 [ 474.155445][T20616] path_openat+0x2e08/0x3860 [ 474.160579][T20616] do_file_open+0x23e/0x4a0 [ 474.165615][T20616] do_sys_openat2+0x113/0x200 [ 474.170858][T20616] __x64_sys_openat+0x138/0x170 [ 474.176280][T20616] do_syscall_64+0x14d/0xf80 [ 474.181408][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.187832][T20616] [ 474.187832][T20616] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 474.195064][T20616] __mutex_lock+0x19f/0x1300 [ 474.200197][T20616] nbd_queue_rq+0xc6/0x1100 [ 474.205232][T20616] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 474.211322][T20616] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 474.218187][T20616] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 474.224709][T20616] blk_mq_run_hw_queue+0x348/0x4f0 [ 474.230447][T20616] blk_mq_dispatch_list+0xd16/0xe10 [ 474.236180][T20616] blk_mq_flush_plug_list+0x48d/0x570 [ 474.242094][T20616] __blk_flush_plug+0x3ed/0x4d0 [ 474.247477][T20616] __submit_bio+0x28d/0x580 [ 474.252539][T20616] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 474.258717][T20616] block_read_full_folio+0x599/0x830 [ 474.264543][T20616] filemap_read_folio+0x137/0x3b0 [ 474.270106][T20616] do_read_cache_folio+0x358/0x590 [ 474.275762][T20616] read_part_sector+0xb6/0x2b0 [ 474.281060][T20616] adfspart_check_ICS+0xa5/0xa40 [ 474.286538][T20616] bdev_disk_changed+0x7ba/0x1550 [ 474.292105][T20616] blkdev_get_whole+0x380/0x510 [ 474.297491][T20616] bdev_open+0x31e/0xd30 [ 474.302287][T20616] blkdev_open+0x470/0x610 [ 474.307242][T20616] do_dentry_open+0x785/0x14e0 [ 474.312538][T20616] vfs_open+0x3b/0x340 [ 474.317145][T20616] path_openat+0x2e08/0x3860 [ 474.322268][T20616] do_file_open+0x23e/0x4a0 [ 474.327301][T20616] do_sys_openat2+0x113/0x200 [ 474.332519][T20616] __x64_sys_openat+0x138/0x170 [ 474.337909][T20616] do_syscall_64+0x14d/0xf80 [ 474.343058][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.349507][T20616] [ 474.349507][T20616] -> #4 (set->srcu){.+.+}-{0:0}: [ 474.356650][T20616] __synchronize_srcu+0xca/0x300 [ 474.362121][T20616] elevator_switch+0x1e8/0x7a0 [ 474.367420][T20616] elevator_change+0x2cc/0x450 [ 474.372737][T20616] elevator_set_default+0x36c/0x430 [ 474.378479][T20616] blk_register_queue+0x366/0x430 [ 474.384046][T20616] __add_disk+0x677/0xd50 [ 474.388924][T20616] add_disk_fwnode+0xfb/0x480 [ 474.394159][T20616] nbd_dev_add+0x72c/0xb50 [ 474.399129][T20616] nbd_init+0x168/0x1f0 [ 474.403876][T20616] do_one_initcall+0x250/0x8d0 [ 474.409185][T20616] do_initcall_level+0x104/0x190 [ 474.414666][T20616] do_initcalls+0x59/0xa0 [ 474.419547][T20616] kernel_init_freeable+0x2a6/0x3e0 [ 474.425283][T20616] kernel_init+0x1d/0x1d0 [ 474.430150][T20616] ret_from_fork+0x51e/0xb90 [ 474.435277][T20616] ret_from_fork_asm+0x1a/0x30 [ 474.440589][T20616] [ 474.440589][T20616] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 474.448424][T20616] __mutex_lock+0x19f/0x1300 [ 474.453554][T20616] elevator_change+0x1b3/0x450 [ 474.458865][T20616] elevator_set_none+0xb5/0x140 [ 474.464249][T20616] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 474.470602][T20616] nbd_start_device+0x17f/0xb10 [ 474.475994][T20616] nbd_genl_connect+0x165b/0x1cf0 [ 474.481574][T20616] genl_family_rcv_msg_doit+0x22a/0x330 [ 474.487654][T20616] genl_rcv_msg+0x61c/0x7a0 [ 474.492698][T20616] netlink_rcv_skb+0x232/0x4b0 [ 474.498002][T20616] genl_rcv+0x28/0x40 [ 474.502540][T20616] netlink_unicast+0x80f/0x9b0 [ 474.507864][T20616] netlink_sendmsg+0x813/0xb40 [ 474.513170][T20616] ____sys_sendmsg+0x972/0x9f0 [ 474.518515][T20616] ___sys_sendmsg+0x2a5/0x360 [ 474.523739][T20616] __x64_sys_sendmsg+0x1bd/0x2a0 [ 474.529236][T20616] do_syscall_64+0x14d/0xf80 [ 474.534355][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.540781][T20616] [ 474.540781][T20616] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 474.549405][T20616] blk_alloc_queue+0x546/0x680 [ 474.554726][T20616] __blk_mq_alloc_disk+0x197/0x390 [ 474.560391][T20616] nbd_dev_add+0x499/0xb50 [ 474.565340][T20616] nbd_init+0x168/0x1f0 [ 474.570031][T20616] do_one_initcall+0x250/0x8d0 [ 474.575361][T20616] do_initcall_level+0x104/0x190 [ 474.580839][T20616] do_initcalls+0x59/0xa0 [ 474.585714][T20616] kernel_init_freeable+0x2a6/0x3e0 [ 474.591481][T20616] kernel_init+0x1d/0x1d0 [ 474.596369][T20616] ret_from_fork+0x51e/0xb90 [ 474.601504][T20616] ret_from_fork_asm+0x1a/0x30 [ 474.606824][T20616] [ 474.606824][T20616] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 474.614177][T20616] fs_reclaim_acquire+0x71/0x100 [ 474.619685][T20616] prepare_alloc_pages+0x152/0x650 [ 474.625356][T20616] __alloc_frozen_pages_noprof+0x12f/0x380 [ 474.631712][T20616] __alloc_pages_noprof+0xa/0x30 [ 474.637196][T20616] pcpu_populate_chunk+0x182/0xb30 [ 474.642854][T20616] pcpu_alloc_noprof+0xc6c/0x19c0 [ 474.648426][T20616] xt_percpu_counter_alloc+0x161/0x220 [ 474.654423][T20616] translate_table+0x1332/0x20b0 [ 474.659891][T20616] ip6t_register_table+0x11b/0x800 [ 474.665540][T20616] ip6table_raw_table_init+0x54/0x80 [ 474.671400][T20616] xt_find_table_lock+0x30c/0x3e0 [ 474.676986][T20616] xt_request_find_table_lock+0x26/0x100 [ 474.683163][T20616] do_ip6t_get_ctl+0x716/0x1230 [ 474.688557][T20616] nf_getsockopt+0x26e/0x290 [ 474.693689][T20616] ipv6_getsockopt+0x1fd/0x2b0 [ 474.699015][T20616] do_sock_getsockopt+0x2d3/0x3f0 [ 474.704590][T20616] __x64_sys_getsockopt+0x1a4/0x240 [ 474.710356][T20616] do_syscall_64+0x14d/0xf80 [ 474.715483][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.721922][T20616] [ 474.721922][T20616] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 474.729674][T20616] __lock_acquire+0x15a5/0x2cf0 [ 474.735073][T20616] lock_acquire+0xf0/0x2e0 [ 474.740027][T20616] __mutex_lock+0x19f/0x1300 [ 474.745163][T20616] pcpu_alloc_noprof+0x218/0x19c0 [ 474.750730][T20616] __alloc_workqueue+0xa81/0x1e90 [ 474.756300][T20616] alloc_workqueue_noprof+0xe3/0x210 [ 474.762119][T20616] bond_init+0xd4/0x8a0 [ 474.766821][T20616] register_netdevice+0x6d1/0x1cf0 [ 474.772463][T20616] bond_newlink+0x48/0xd0 [ 474.777330][T20616] rtnl_newlink_create+0x329/0xb70 [ 474.782988][T20616] rtnl_newlink+0x166a/0x1bb0 [ 474.788215][T20616] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 474.793684][T20616] netlink_rcv_skb+0x232/0x4b0 [ 474.798995][T20616] netlink_unicast+0x80f/0x9b0 [ 474.804307][T20616] netlink_sendmsg+0x813/0xb40 [ 474.809617][T20616] sock_sendmsg+0x3fb/0x450 [ 474.814651][T20616] splice_to_socket+0xae2/0x11f0 [ 474.820135][T20616] do_splice+0xee3/0x1910 [ 474.824997][T20616] __se_sys_splice+0x353/0x490 [ 474.830337][T20616] do_syscall_64+0x14d/0xf80 [ 474.835464][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.841897][T20616] [ 474.841897][T20616] other info that might help us debug this: [ 474.841897][T20616] [ 474.852135][T20616] Chain exists of: [ 474.852135][T20616] pcpu_alloc_mutex --> cpu_hotplug_lock --> wq_pool_mutex [ 474.852135][T20616] [ 474.865211][T20616] Possible unsafe locking scenario: [ 474.865211][T20616] [ 474.872690][T20616] CPU0 CPU1 [ 474.878071][T20616] ---- ---- [ 474.883450][T20616] lock(wq_pool_mutex); [ 474.887716][T20616] lock(cpu_hotplug_lock); [ 474.894754][T20616] lock(wq_pool_mutex); [ 474.901618][T20616] lock(pcpu_alloc_mutex); [ 474.906141][T20616] [ 474.906141][T20616] *** DEADLOCK *** [ 474.906141][T20616] [ 474.914304][T20616] 4 locks held by syz.1.4197/20616: [ 474.919513][T20616] #0: ffff88806dc25c68 (&pipe->mutex){+.+.}-{4:4}, at: splice_to_socket+0x15f/0x11f0 [ 474.929204][T20616] #1: ffffffff9011ed80 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 474.938727][T20616] #2: ffffffff8fbcb188 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 474.947804][T20616] #3: ffffffff8e5fccc8 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0x9ef/0x1e90 [ 474.957599][T20616] [ 474.957599][T20616] stack backtrace: [ 474.963501][T20616] CPU: 1 UID: 0 PID: 20616 Comm: syz.1.4197 Not tainted syzkaller #0 PREEMPT(full) [ 474.963528][T20616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 474.963542][T20616] Call Trace: [ 474.963552][T20616] [ 474.963560][T20616] dump_stack_lvl+0xe8/0x150 [ 474.963588][T20616] print_circular_bug+0x2e1/0x300 [ 474.963620][T20616] check_noncircular+0x12e/0x150 [ 474.963651][T20616] __lock_acquire+0x15a5/0x2cf0 [ 474.963677][T20616] ? check_path+0x21/0x40 [ 474.963703][T20616] ? check_noncircular+0xda/0x150 [ 474.963733][T20616] ? lockdep_unlock+0x5d/0xd0 [ 474.963753][T20616] ? __lock_acquire+0x146e/0x2cf0 [ 474.963783][T20616] lock_acquire+0xf0/0x2e0 [ 474.963805][T20616] ? pcpu_alloc_noprof+0x218/0x19c0 [ 474.963832][T20616] __mutex_lock+0x19f/0x1300 [ 474.963850][T20616] ? pcpu_alloc_noprof+0x218/0x19c0 [ 474.963870][T20616] ? __mutex_trylock_common+0x158/0x260 [ 474.963901][T20616] ? __pfx___mutex_trylock_common+0x10/0x10 [ 474.963931][T20616] ? pcpu_alloc_noprof+0x218/0x19c0 [ 474.963951][T20616] ? trace_contention_end+0x3d/0x150 [ 474.963967][T20616] ? __pfx___mutex_lock+0x10/0x10 [ 474.963984][T20616] ? __mutex_lock+0x319/0x1300 [ 474.964007][T20616] ? __alloc_workqueue+0x9ef/0x1e90 [ 474.964027][T20616] pcpu_alloc_noprof+0x218/0x19c0 [ 474.964046][T20616] ? rcu_is_watching+0x15/0xb0 [ 474.964079][T20616] ? __kasan_kmalloc+0x93/0xb0 [ 474.964101][T20616] ? __kmalloc_cache_node_noprof+0x3ef/0x6b0 [ 474.964127][T20616] __alloc_workqueue+0xa81/0x1e90 [ 474.964151][T20616] alloc_workqueue_noprof+0xe3/0x210 [ 474.964169][T20616] ? net_generic+0x1e/0x240 [ 474.964192][T20616] ? net_generic+0x1e/0x240 [ 474.964209][T20616] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 474.964228][T20616] ? net_generic+0x1e/0x240 [ 474.964245][T20616] ? net_generic+0x1e/0x240 [ 474.964265][T20616] bond_init+0xd4/0x8a0 [ 474.964295][T20616] ? __pfx_bond_init+0x10/0x10 [ 474.964322][T20616] ? __kmalloc_cache_noprof+0x31c/0x660 [ 474.964346][T20616] register_netdevice+0x6d1/0x1cf0 [ 474.964365][T20616] ? trace_kmalloc+0x2a/0x110 [ 474.964386][T20616] ? alloc_netdev_mqs+0xc89/0x11b0 [ 474.964404][T20616] ? __pfx_register_netdevice+0x10/0x10 [ 474.964422][T20616] ? validate_linkmsg+0x765/0x950 [ 474.964445][T20616] bond_newlink+0x48/0xd0 [ 474.964463][T20616] ? __pfx_bond_newlink+0x10/0x10 [ 474.964482][T20616] rtnl_newlink_create+0x329/0xb70 [ 474.964509][T20616] ? __pfx___nla_validate_parse+0x10/0x10 [ 474.964534][T20616] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 474.964562][T20616] ? __pfx___mutex_lock+0x10/0x10 [ 474.964584][T20616] ? ns_capable+0x89/0xe0 [ 474.964608][T20616] rtnl_newlink+0x166a/0x1bb0 [ 474.964638][T20616] ? __pfx_rtnl_newlink+0x10/0x10 [ 474.964661][T20616] ? __lock_acquire+0x6b5/0x2cf0 [ 474.964685][T20616] ? __lock_acquire+0x6b5/0x2cf0 [ 474.964710][T20616] ? __lock_acquire+0x6b5/0x2cf0 [ 474.964734][T20616] ? __lock_acquire+0x6b5/0x2cf0 [ 474.964762][T20616] ? unwind_next_frame+0xa5/0x23c0 [ 474.964798][T20616] ? is_bpf_text_address+0x26/0x2b0 [ 474.964819][T20616] ? __lock_acquire+0x6b5/0x2cf0 [ 474.964846][T20616] ? kernel_text_address+0xa5/0xe0 [ 474.964866][T20616] ? __kernel_text_address+0xd/0x30 [ 474.964885][T20616] ? unwind_get_return_address+0x4d/0x90 [ 474.964924][T20616] ? __pfx_rtnl_newlink+0x10/0x10 [ 474.964946][T20616] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 474.964970][T20616] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 474.964992][T20616] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 474.965016][T20616] ? __lock_acquire+0x6b5/0x2cf0 [ 474.965043][T20616] netlink_rcv_skb+0x232/0x4b0 [ 474.965067][T20616] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 474.965095][T20616] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 474.965124][T20616] ? netlink_deliver_tap+0x2e/0x1b0 [ 474.965151][T20616] netlink_unicast+0x80f/0x9b0 [ 474.965175][T20616] ? __pfx_netlink_unicast+0x10/0x10 [ 474.965201][T20616] ? netlink_sendmsg+0x650/0xb40 [ 474.965225][T20616] ? skb_put+0x11b/0x210 [ 474.965250][T20616] netlink_sendmsg+0x813/0xb40 [ 474.965292][T20616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 474.965317][T20616] ? trace_contention_end+0x3d/0x150 [ 474.965331][T20616] ? aa_sock_msg_perm+0xf1/0x1b0 [ 474.965348][T20616] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 474.965368][T20616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 474.965392][T20616] sock_sendmsg+0x3fb/0x450 [ 474.965411][T20616] ? trace_sched_exit_tp+0x3a/0x150 [ 474.965434][T20616] ? __pfx_sock_sendmsg+0x10/0x10 [ 474.965458][T20616] ? __asan_memset+0x22/0x50 [ 474.965474][T20616] ? iov_iter_bvec+0xb8/0x180 [ 474.965495][T20616] splice_to_socket+0xae2/0x11f0 [ 474.965531][T20616] ? __pfx_splice_to_socket+0x10/0x10 [ 474.965576][T20616] ? bpf_lsm_file_permission+0x9/0x20 [ 474.965598][T20616] ? security_file_permission+0x75/0x260 [ 474.965622][T20616] ? rw_verify_area+0x255/0x4d0 [ 474.965641][T20616] ? __pfx_splice_to_socket+0x10/0x10 [ 474.965667][T20616] do_splice+0xee3/0x1910 [ 474.965692][T20616] ? __pfx_do_splice+0x10/0x10 [ 474.965711][T20616] __se_sys_splice+0x353/0x490 [ 474.965730][T20616] ? __pfx___se_sys_splice+0x10/0x10 [ 474.965748][T20616] ? __x64_sys_splice+0x21/0xf0 [ 474.965765][T20616] do_syscall_64+0x14d/0xf80 [ 474.965781][T20616] ? trace_irq_disable+0x3b/0x150 [ 474.965796][T20616] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.965813][T20616] ? clear_bhb_loop+0x40/0x90 [ 474.965834][T20616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.965852][T20616] RIP: 0033:0x7fda26b9c819 [ 474.965869][T20616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 474.965884][T20616] RSP: 002b:00007fda27971028 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 474.965903][T20616] RAX: ffffffffffffffda RBX: 00007fda26e15fa0 RCX: 00007fda26b9c819 [ 474.965916][T20616] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000003 [ 474.965946][T20616] RBP: 00007fda26c32c91 R08: 0000000000010d00 R09: 000000000000000f [ 474.965957][T20616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 474.965968][T20616] R13: 00007fda26e16038 R14: 00007fda26e15fa0 R15: 00007ffedc03b628 [ 474.965989][T20616] [ 475.615432][ T5832] Bluetooth: hci4: command 0x0405 tx timeout [ 475.663868][T20620] syz0: rxe_newlink: already configured on lo [ 475.696279][T20619] IPVS: stopping backup sync thread 16510 ... [ 480.993013][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!