last executing test programs: 2.862609684s ago: executing program 4 (id=3626): r0 = socket(0x21, 0x80000, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) getsockname$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000700)={'bridge_slave_1\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYRES32=r0], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, 0x2}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2000000010000001000000000000000000480000", @ANYRES32=r5, @ANYBLOB="ae1e020000000000a777857c13cd854991af1079febebe77799d8111c60c8d8c449a8a736df680237a503539a8b768d2d2182cbef2b7848519f55badaf59f5b032de50b08d11ad7404a1f4ca44e333ab29f72bcafd3da8a817b337de4ddf15d8d1b0b3e287477454103e1a63a1ca9ff800699e48f9b4657438a173439548887066597a4ce09b2719b801ba7b25a5fb8e99c1f7bb8c379a9c43505596f38a00d12df5f022ff5aa87314a390b19d5b5f4c01757819e9e96aea"], 0x20}}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0) close(r8) socketpair$nbd(0x1, 0x1, 0x0, 0x0) (async) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) (async) r9 = socket$kcm(0x10, 0x2, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_NEW_STATION(r6, &(0x7f0000007380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="c9ffffff", @ANYRES16=r11, @ANYBLOB="f1e6ffffffff0000000013000000c0ff0300", @ANYRES32=r12, @ANYBLOB="04001300010d6e8e4b855cf2ff5cffcc83060012e5050000ffffffffd2ca6cb73600010975c8360634f620ca5e4e3bffffffff726774c0416ef1d72e0a41bc0a051a1bb7567d60aafa4653704d0f8c3eebae57b28d9e039a902d588869ac46773faea1ccf900"/116], 0x44}, 0x1, 0x0, 0x0, 0x200000d0}, 0x8050) (async) sendmsg$kcm(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) (async) r13 = socket$unix(0x1, 0x2, 0x0) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010028b6296be141526b7e00000008000300", @ANYRES32=r15, @ANYBLOB="0c009900ff070000700000001400040073797a6b616c6c6572300000000000000800050006000000"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) writev(r3, &(0x7f00000002c0), 0x2) 2.369114143s ago: executing program 4 (id=3636): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x4, 0xfa, &(0x7f00000007c0)=""/250}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0xa7c, r0, 0x0, 0x1000000}, 0x38) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0xe98, 0x30, 0x25, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x30, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x4}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x7}, {}, {}, {}, {}, {}, {}, {0xfffffffc}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0xe498}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x0, 0x9}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf9}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000140)={0x5, 0x6, 0x8, 0x8, 0x0, 0x2, 0x0, 0x8}, &(0x7f0000000180)={0x80009, 0x40000000002, 0x7fff, 0x22c, 0x5, 0x0, 0xa9e, 0x7}, &(0x7f00000001c0)={0x7fffffff, 0x9, 0x81, 0xa1, 0x3, 0xff, 0x1, 0xffff}, &(0x7f0000000200)={0x77359400}, &(0x7f00000004c0)={&(0x7f0000000240)={[0xc6]}, 0x8}) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) r4 = socket$inet_smc(0x2b, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001e80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r5, 0x84, 0x23, &(0x7f00000000c0)={0x0, 0xe1}, 0x8) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCINQ(r4, 0x541b, &(0x7f0000000040)) sendmsg$can_bcm(r6, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000500)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x73) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x7c}}, 0x0) r9 = accept4(r7, 0x0, 0x0, 0x80000) write(r9, &(0x7f0000000040)="cb", 0xfffffdef) setsockopt$sock_int(r9, 0x1, 0x49, &(0x7f00000009c0)=0xfefffffb, 0x4) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r10, 0x117, 0x1, 0x0, 0x0) 1.876565746s ago: executing program 2 (id=3643): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0600000004000000fd0f000002"], 0x50) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd000000000000000800034000010000050001"], 0x24}}, 0x0) r4 = socket(0x2b, 0x80801, 0x1) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4, 0x3ff, @empty, 0x1}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000008000100", @ANYRES32=r7, @ANYBLOB="400002803c0001"], 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x40000) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20000001) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020301010000000005070000000000100800010001"], 0x1c}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xa, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000004dff0000000085100000fdffffff00"/32], &(0x7f0000000600)='GPL\x00', 0x5, 0x50, &(0x7f0000000680)=""/80, 0x41100, 0x60, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x0, 0x4, 0x3}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f0000000780)=[r1, r1, r1, r1], &(0x7f00000007c0)=[{0x5, 0x3, 0xe, 0x1}], 0x10, 0xcc2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1b, 0x12, &(0x7f0000000ac0)=ANY=[@ANYBLOB="d002c9b18eb7d72b3990598d851aa91030", @ANYRES32=r1, @ANYBLOB="0000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018100000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f00000004c0)='GPL\x00', 0x3, 0x40, &(0x7f0000000500)=""/64, 0x41100, 0x3, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x5, 0x2, 0x400, 0x1}, 0x10, 0xffffffffffffffff, r8, 0x3, &(0x7f00000008c0)=[r0, r1, r1, r1, r1], &(0x7f0000000900)=[{0x5, 0x3, 0xd, 0x3}, {0x3, 0x4, 0x9, 0x6}, {0x0, 0x5, 0x4, 0xf}], 0x10, 0x9}, 0x94) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x20048805}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @numgen={{0xb}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x68}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f9ffffffb703000000080000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000340)={@mcast1, 0xb34, 0x1, 0x1, 0xa, 0x0, 0x1000}, 0x20) 1.732758288s ago: executing program 1 (id=3644): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000100544545000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="500000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0000000004180000280012800b000100697036746e6c00001800028014000200fc00000000000000000000000000000008000a00", @ANYRES32], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x4000) 1.605960501s ago: executing program 2 (id=3645): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407030000060000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0}, 0x10) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000001400)={r1}) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000090000000400000003000006040000000400000007000000020000000400000004000000fcffffff002e71a0"], 0x0, 0x45, 0x0, 0x1, 0x80000001}, 0x28) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'batadv0\x00'}) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001008c000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) (async) recvmmsg(r5, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4082, 0xff2}, {0x0}], 0x2}, 0x5}], 0x1, 0x2000, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r3, @ANYBLOB="1b00040000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r4, @ANYBLOB='\b\x00\n\x00', @ANYBLOB="186b8feb22e97ecb28a1abf8510517c54933", @ANYRESDEC=r4], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4000040) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x14, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x40) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000001440)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000012c0)=ANY=[@ANYBLOB="28000000030601040c39cb7d0000000002000029ff00000000020073797a3100fd308d0a0000000000"], 0x28}, 0x1, 0x0, 0x0, 0x48090}, 0x40000) (async) close(r7) (async) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001300), r3) sendmsg$NL802154_CMD_GET_WPAN_PHY(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="6d9310000000f4dbdf25010000000c00060000000000020000000800010000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20048890}, 0x880) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r11}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0xf1}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x1, 0xb, 0xa, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {}, {0x18, 0x6, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.470779121s ago: executing program 1 (id=3646): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x9c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x3c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0x8, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x110}, 0x1, 0xfc00}, 0x0) 1.27264681s ago: executing program 1 (id=3647): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000001c0)={&(0x7f0000000100)=@ll={0x11, 0x9, r4, 0x1, 0xb, 0x6, @local}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000000080)="2705670f28665a6dfcfc002f86dd", 0xe}], 0x1}, 0x4000141) (async) close(r1) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) (async) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r10, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2, 0x400ddf}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) (async) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.25657022s ago: executing program 3 (id=3648): bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000096d132478102268d00", @ANYRES32, @ANYBLOB="0000000000000000b7080000002000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000f00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x5, 0x0, 0x1, 0xfffffffd}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfeffffff}, 0x50) 1.18487152s ago: executing program 4 (id=3649): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="180300007000008000000000001000008510000006000000180000000000000000000000000000006500000000000000180000000000000000000000000000009500000000000000840300000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 1.104784218s ago: executing program 3 (id=3650): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240410000012c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000100544545000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) 1.097089906s ago: executing program 2 (id=3651): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='illinois\x00', 0x9) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000240)=' ', 0x1}], 0x1}}], 0x1, 0x48800) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2, 0x13, 0xffffffffffffffff, 0x4fee9000) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='cdg\x00', 0x4) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="03040200020005003400000007000000000048a5004b00680000007390787f000001ac1414aa0186095c3d396d0503c0000097662b5d49718f4a7fbb00009bb009aa49dc1700d96b735893b001b201ac708d248c32a7624f1372cd"], 0x5d) sendmsg$ETHTOOL_MSG_WOL_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x4004) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) setsockopt$sock_linger(r2, 0x1, 0xd, 0x0, 0x0) shutdown(r2, 0x0) shutdown(r0, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000d80)={&(0x7f0000000d40)='mmap_lock_acquire_returned\x00'}, 0x10) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) pipe(0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x19, 0x4, &(0x7f00000003c0)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xa9, 0x0, &(0x7f0000000680)="ba894cb1acdab876f1aac9f4f0392bf53f675d6420e88c4a27f76d6852a3d8c7e51e23ab5687d7d339ab9b0927225365077ff358e2fafb1bf3eddb6521d7469759961791a31aefa4f8d279af2c8b067270efbb56e973189d3f42c83e39b1dcb8e96a77d88f6193f6bc22989e7a256e03a2c555124778b6d81acf1ef1f64196051fcafe4afc7e21df0ff181606295ffd9169479e797a1982ab195888a77d06bc814e5c95a0ad54ac2f9", 0x0, 0x1005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000007380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000800)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="f1e6ffffffff0000000013000000080003003178416ce6cad5c3641ef760bf28302e234cc30bf360b11943758c840330968558a22be0545a22d836b0aa08ed5b9e7923b274989e651f298181f67edd4c04d65a62", @ANYRES32=0x0, @ANYBLOB="0c009900050000003300000006001401000800000600ab0009000000240081000500020000000000050001000100000005000100d600000005000200080000000500130100000000"], 0x64}, 0x1, 0x0, 0x0, 0x7a27cb33b36494f8}, 0x200080b0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) 1.067569678s ago: executing program 4 (id=3652): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f0000001840)={@val={0x8, 0x800}, @val={0x6, 0x0, 0x9, 0x0, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x6, 0xfc0, 0x64, 0x0, 0x0, 0x2, 0x0, @rand_addr=0x64010104, @broadcast}, "3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68c5b0dc11832dbb5eecb5c88c2f8f02bdbd88569ad4a740359cbca8c378118220d73bdd1e661c3a74f77aa931b11cd38119b0f084bb96e84803fca6566c33ee1e4e34ab0253fbf24f9f5974af5e1fc2a43a4ec9dd9928a8f38a128ea27c429300ae5a6bd7740471f973d8224b2b07879f4fbe7dcbed776a72ebdc713bcf1d7aa45b01c32a1003e6670d58510bd79ba2fde5cb2b82cef2cc315648f4e9d96d848ba327949b8926253cbdef6888a8982108b6ac7a1108533dd3fe125002e2e286362d1055082a9d73ec5ac3080f2a501ff27250b62c8965f371cf92b32d6422d79f66261eb08a2f8fe50049e102c69ce703d116d0834208cc957d0f1376457a90245816d7642412897fdd2f982fdfbc3af65aa0446b00c767b79aec40e460887ea02188e3a0960eea39b144859467b881978378c9fd593259e0f63148179fe2c2f6d40987b63a6e384e63027f03d8039d707522942d5dc88fd842524d006290b6a65e9cc86cc5b401a60ec4aedfb3bf4d0447bb681810a16b9684b72c2f4593ef834a0203e78cd1d9dbc978e9ae8f3ab62c07f1e41d59470decee7b0cc41ac49e4b7589ab6da65849f62ec217bb39ed161e7d337822d96badbd74d66451ea9a74bed591dc9631bf639dcf7846ee428a9fa55bfceedf3b1c23642f3b58dd0a7273664c6c49c9160a4b9cc5b72d0210e305b94e2cb09ae1d4af9d365b5093851f229c8c30aef75d45ccdbab4b86d801a9ad3b27f26ba601d531c0743717aa7aae29d37f496fec7682c5a1abd321ad61941a2d23fcac6af1d1875e308c8d8c64a5152be47b59c09d293f46b857310a99f1885f0a49d432aa0d39a3e8fc885e75e66b63215133175a19267c8d0adf7d8f644e742ed5369d1405e99e63b78727f135e0243f24d9ce354a1562102ee8de4c191508343b86bf7e7519ddd770ce55e17e590561b2f437194c97ad46622a6ae3dd68d9993e6744954f4cd308bd6594fdccedc578e80aed274a65219697229059723ac37d535cca0e9c314e7941b4160bbd2ffba71f26ffe3228431bc81463078ad70583277ef18bce23ca2e5b9a00670956ea8e0e2c739c006106c8c9ee3f92ba728d8490742b74a9a18cbedfc4e69bb87e0da4c7dfb964374c28c837d4641fb99a19b233675f8526af395335e0185cf3934805442ac379980b687a7128e53284ba9e741b5fe9bc969bfbd55cbce76842915e076e2adf844338d16d3802c681bafdcc60465bd34dfc2d1c069ceee40060e0570fc1275ccabfe3f9be3e84ceedf72cd649c082232008e2b0c94594588c00e0fe911bbf1c12eb6c37ce05674a7597feecf27f5e051ffa824d9ff93638dfa9a84c77562aa2cf897f55a97b79c18544ad03480e1011b8f93e0ead9c2c6672448f585c5803ae99be777fbc662ef4450c1e936ed8b3c8047f00e72adc84561f417f8e5e1dde4967005d96a64fc75d9f486b3ebdb5904a0a56ec48542f0efce939f66fd69259e7376ad37e84434ea90f35b2d3bd63b5c36b267d8f2c7dc5a50b46e00ed086dff8b039e07b84c60611269d4f282ad04dc8e0b481eece2f8a614734be73617f0ad5be195446b09dca4cf1f32653dd3e188aece76f3014deb2ba61744835c0f735234b6a4637c948a7b4fd4203b286ca87d669e325d70277075b094f59eb1dff6c9c05c40d5e464c563df79486e1a32e6ed9bcf675aac7968b4e98dc4e210215b0d3b6a2525b2e3df11f3f1490eb39cabffbe32e23659121fde8e4e346e0f595aaf3666a5f6f118c1a1128039502ac04c40b85eb4c54e6c95b8d1c2aac74ae9e1c355ccde9d54d5d833293f5df09224482179e5bcd8e227c99172a6e14c2cd4e6462ceb0a905a1d64804840ce62e350c6efac10a7fcb029f84af64e2256d45afd3b3f59379895740e0cd2fd24c63264f785bb6e3f40ec72ed67d1a7d87dd264743d9c951cb5aa8bc6f1d1bc9b23303d5aa7f8f6f961326757456057000cb2bacf78cc229002777e932c2640b8dfa793846ca49fa93996db95104a8808a1906b19df17e754b90582b6c49efb3ddce067dd9292291cfd2bb0323ce8098f29e4fce0de31cf5c7e2e2da5d0d0996a8be776de8fecfd3ce68e80d21f1701f6b90ac51278abbd727d19415e0ebe001b990b177b8db0c592b18a4b5e4a6221902362e5b20e6e6f2131a5a5e03c1150b179ef40c933c2fef1b79de738652ec4c32565f5cf751a11db177099c4e2e5bd7616cd0dd501d5bfccf5691de3cca590365328648baf8a9487a3c212193c9bb837594460967e823067a9465eba7001eaf609a810488ef5c147aaa5e9e8c75b585ac3582b6915e20b5aa2f79b7a94857122988c56dbce1ea52de1a56652e839bb853be3ee16052b33fb83ca54d8e4e19440a5e81492107043a66286f63ca87a1f7b8a4e9547a7eb6005419cfd28cb37e9e374f4d0143973286e87070754025c1a6fccfdc6858eaca8c35ecb19584ce7141cc79a5bc813469161b87a19fc21f3373d1f25b3427916dd1be2a589b70ea3b39fcc7801e13beaf19b76164faf3dc4ab8faa5648d24eddd6caceaa0d5ac9cad633c19a4a4d059ee823a49b7cf82c5777d376c111f58ea8fd473429907852301a2c856f27bd0c687ab5be0e2bbef64ddee1601375a4440e3f59d60f57caebfe457f82432523ec4a61cdbb7f1e91e4b05fda892df131c274b19929d26f7a5a6d3ca487983f729601ed9bb4bf5c1cc3d453d406e9534688dec6a2dd0b9db149365c125a95e129565e62cc91f7d960abe1055b730ae0994e7eb08392d5745d0e4f529c4defc3d3e43d0815b0cc63effa88d20c13b14e780c2f6c89a1ee5e4db45a5c272186cc3e51b13dab3add5f467e8ca0f4c45a1fc76db2f0cbf794102946aafcd8cd8a3e935a606b9721645c4d550ae0907f345593736506efc626498c974753d474a73626041d3a54f8fb50de2a6335611a3779da3a02daceb2256d9b102d4d30dd3cd389a04b1a7a6076879f36534bb3379debb46ed1fa2c40096c752017dd024345c58313b43070ff7bef94dc3cafbe6ec20d59e5ea3c196ba3b783bfa87384407efc664cd350c80ac397516018e35371956e414755cde304d2a228c1540ba6fd6a7402d11c666964f024da4c016eb556ba2c5fab86c60c12efb1496295d80f0383526e8e0fc55a287bbd3cb966a916f57958d8b6ef97aa0c4b47f7746bab6b99698c1c96b25c4e2e084147866fe0970b109dd26984adc0758eb6442712cc46dcd8ed3038b0595252eed1b8a46525862662d1e67eba66ac341f8d27853eed54854f488f079bd48df6ce7a4be8b1b61fd23a2dc4d3ade0992011539cc63f80fcfc75008c20cb639348cb218f8f476a6d56917f4ca07e67fc20ea2e9642eaf2182b397e279f5f6c70438fb8aa39cba788588c181461ea7efe1a0dd5b95eb26f7158b91012f7ce0ee1b4e79ce4da377bea4551738a0f491a84f19b3be9827b4469c299527aa9c20b8bf12f919976a0356bba720fb91010763c79bcbb10d89280f0f97cdd19aa0d54828b308195fac170613cf4b515e340a9ef2c97f618a9f50b30ae34ebeed9a38b4c6969680accc740b154ecb014fb5d543a59ccb98a7de2823a2dec39f331cb503eb74fef61262c6d4050bc723caee834eb28c64ce007f6027375e936b62387cf1778970e88b0574a0106d4c855be7425767c551b2fa644d9d8a59f787e7610581b768057d229673344571c3d6e3f10975b2859f568398b1f38f89524d9ad0c1588617c3883a1227b714c81cdf28da54f33968c1c50f28da01c308eb31d319b3e77f96bec001c9300000000000000009cc0062283ac112868592619db14d629c47bfb793a723dcd2f7b07ae4ec14ca3ef4b955ea5b2b153a279b080f6236d418075b86850974c8850efb306d5c304e726bf2643b4403e6d46b0e0395b02e93308b4b2c3e957308d497dc51c753344a7878f1f0c91295fd76e3d1cc9ef813161c6b92b7ea6068ceb97d8f45a4ce57af7d7632d699951f7fe3c71c3a32b014c74425c67e5030546b10cf7edcec2eca5ba31dc62c08f83f35bc2e36b93f15f071bc2537ebe9ca19f86dce4e84272e10323d0ceaa2cc47fe4f6ad101d454c761f9863e94af91199ce5f12469bca7ba39314b84aa7efa4bdc18f7700c19511d48d6132450111d70401a8ac73565d5386ca12345e884d08b23f9c901000a95eb4167865e58c28b112f47c96beeaa6657c923e25e56529107c5c30e65bb485d5ed21b91332db4e09df7e59dcfa05c994570deb3f9b838e22ae4abbf9a9a8c319cc9112c8dba7c2278f78b9578b0254c46a4c04b8fa4fedad6bd275f70b1618971ef6503379bfb0a508c9944328af2c820091a89e3f75e68e7f980ddc9154d273f7f2ce7a6294aefe93136860786679b80e41f6636ff45efeacfb52e2ba2bd9bd9c9030079a46caca5c4b340c17d01ba8ecbc5c561b2038481a8321c009d12136a3ad5461881d998eeaac5236fdcd8f81fb5e53848bb096d9198fd0d38830d1809f2a632b31e2b67754140c907ed58aead048b2d8af9a1c407e48db815212cfdcca97222dabdfe01f311a73e1e82c3e189ec5add48d3f8190eb9e14b58e540f7f1388a7c687629eadb19fd8a133dc8177629270ecaabff79efb6c1f750d89b9e6c5f34c6238066f8e3e425e46a27b3c0d2e9e2ed3cffe2a6f39b8e0137ea5de689b94107fb4748a5feb3902f0feba64dae4c2e69bc8d86463575c6b0ef4a8a64fef41121e57a8c67eda07e9fc8f98299677de198ea0a649ef3c00591940b2c27ba1414aaa1633deb52e3a44cfa8d7a00d014317c026a7d7f42a34b97128e1bf9cda4d8315819ac73ed5061bf9b5631d07b09b85b78ff1b6eb86e9e8c4faa0f991cd6fa0b0eb71b39c20ca9bc7c156f3bd255a5b408df172396bafd7f0fb11c6eaf1eb0a06576d37bee00424bf699584b1dfed68f0d8d8a35f0427c783fe2d79b4373628971e87501a5e4bb05b5058d0b2132741f26e76065b6f4017d963c8ee5605c4c5b6eebb96fca0a41893cb6add3fb0d728abeb860f22cedbd36e464bdaf124a7041460f7af3d64b54e9ffd240b5afad9baf6e5dd8406bc1b205da5848f51fc9dd5197716e144e1b0386614bd3cfd5ddb80ada1e5ca74c8960093a553b1f6288aa7f53663cdd867f658e51b95772dc7a6fa45fa03e14988a33250e6c16fbf0351769080d64ddfbdbf77e1215563bf2e82ecc38a682846d7e2e2ac4e87d715f97f15e84c3df04affee49612a735907d3c4d310a54a6f609873ad56f29a138f4d5661f6865e030487"}}, 0xfce) setsockopt$sock_int(r1, 0x1, 0x2b, &(0x7f0000000100)=0xe, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0) r4 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x80fe) r5 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0xfffffffd, @private1, 0x40000}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x80fe) r6 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, 0x0, 0x0) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="3f000000010040", 0x7) 1.038871442s ago: executing program 0 (id=3653): sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)="2f0000001c0005fffffff7000d000000020000000b000000ec0091c913000180f0ffffeb46860f21244e36c3fd", 0x2d}], 0x1}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0xc}], 0x492492492492856, 0x0) (fail_nth: 5) 848.380688ms ago: executing program 0 (id=3654): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x2}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffffff}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x102}]}], {0x14, 0x10}}, 0x64}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2000, &(0x7f0000001580)) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') (async) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r4, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000180)="0b032212e0ff25000200475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r7}, 0x14) (async) recvfrom(r1, &(0x7f0000000d40)=""/4096, 0x1000, 0x12040, &(0x7f0000000140)=@ll={0x11, 0x2, r7, 0x1, 0xbd, 0x6, @remote}, 0x80) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xf, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0xed41d0969ec4053c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000500)={r5, r9, 0x4, r3}, 0x10) (async) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0xfffe, 0x0, 0x0, 0x2, 0x0, @empty, @broadcast}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x4062d13c}}}}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000061042c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) 822.227101ms ago: executing program 3 (id=3655): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0600000004000000fd0f000002"], 0x50) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd000000000000000800034000010000050001"], 0x24}}, 0x0) r4 = socket(0x2b, 0x80801, 0x1) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4, 0x3ff, @empty, 0x1}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000008000100", @ANYRES32=r7, @ANYBLOB="400002803c0001"], 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x40000) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20000001) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020301010000000005070000000000100800010001"], 0x1c}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xa, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000004dff0000000085100000fdffffff00"/32], &(0x7f0000000600)='GPL\x00', 0x5, 0x50, &(0x7f0000000680)=""/80, 0x41100, 0x60, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x0, 0x4, 0x3}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f0000000780)=[r1, r1, r1, r1], &(0x7f00000007c0)=[{0x5, 0x3, 0xe, 0x1}], 0x10, 0xcc2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1b, 0x12, &(0x7f0000000ac0)=ANY=[@ANYBLOB="d002c9b18eb7d72b3990598d851aa91030", @ANYRES32=r1, @ANYBLOB="0000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018100000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f00000004c0)='GPL\x00', 0x3, 0x40, &(0x7f0000000500)=""/64, 0x41100, 0x3, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x5, 0x2, 0x400, 0x1}, 0x10, 0xffffffffffffffff, r8, 0x3, &(0x7f00000008c0)=[r0, r1, r1, r1, r1], &(0x7f0000000900)=[{0x5, 0x3, 0xd, 0x3}, {0x3, 0x4, 0x9, 0x6}, {0x0, 0x5, 0x4, 0xf}], 0x10, 0x9}, 0x94) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x20048805}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @numgen={{0xb}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x68}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f9ffffffb703000000080000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000340)={@mcast1, 0xb34, 0x1, 0x1, 0xa, 0x0, 0x1000}, 0x20) 612.28592ms ago: executing program 2 (id=3656): socket$inet6_udplite(0xa, 0x2, 0x88) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4051}, 0x20008001) socket$kcm(0x29, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xb}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000000840)={@link_local, @link_local, @void, {@llc_tr={0x11, {@snap={0xaa, 0x0, "e3", "f71f97", 0x0, "231034b79aa983fb78"}}}}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0a00000004000000f10000000500000000000000a24c68461c2bbdf85d79962346dfc1a00dec9aad61f6224dc5eba3151c24f984130aeec43f6ebc022f745ecd65ad215e9a023494fa1cb531877ab4fc032824f80e759848aaa7", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = socket$inet6(0xa, 0x3, 0xff) sendmsg$inet6(r4, &(0x7f0000000000)={&(0x7f0000000040)={0xa, 0xf5, 0x40000, @dev}, 0x1c, &(0x7f00000012c0)=[{&(0x7f0000000100)="daffc38b69363a52fe8000480000000021845a91f64fddcf51f405595faeea41974e5559ea91f7", 0x27}, {&(0x7f0000000200)="01", 0x1}], 0x2}, 0xb00) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100"], 0x128}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x4) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@'], 0x40}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) write$tun(r8, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r8, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x8010, r9, 0x952de000) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0xa, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x24048014}, 0x4000) write(r7, &(0x7f00000002c0)="29000000140005b7ff00000004eabdeb0101b6ff02159f7e5520756b1933b49db96ad24d12595fbea5", 0x29) 568.55153ms ago: executing program 0 (id=3657): socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x3e, &(0x7f0000000280)=ANY=[@ANYBLOB="ffffffffffffffffffffffff080041000030000000000067907800000000ff2100907812000228250000090000df00000000279f454300e0000002e0000000"], 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010028bd7000f6dbdf250900020073797a31001800000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x810) r1 = socket(0x1, 0x803, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000880)={&(0x7f0000000340)={0x2, 0x4e21, @private=0xa010100}, 0x10, &(0x7f0000000680)=[{&(0x7f0000000600)="a39de0103385", 0x6}, {&(0x7f0000000740)="7aeefbeda1da7f18bc167559a82617e690181a6d732dc20b8c82eaa306dee94454b15ce15b244222a4668eb73ec90f63b69de9b22272edf0504d6bdb20365830a4a55ac5f9d1272064c0d541d77464eed967565bb6f6be8c5129aa4f5fef7df3fecd54d168f2deb0bf8aeb7e2cb1c76b6dd07943f23bf9abca9d18c4d2a4ad851af00b6da9a68d2fb9629bc033f56b90", 0x90}, {&(0x7f00000008c0)="5e2b5f580d8b8dd6c96e35d71e29c4173c1ad4987cdd160ea4fb318fc77c393a2ebd1ec2ec676c646e49239061e2514bdb60f6aac10c4216a758238928", 0x3d}], 0x3, &(0x7f0000000840)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x435}}], 0x30}, 0xc000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="0200000004000000010000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x48) r5 = socket(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x5}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x50}, @TCA_FQ_PIE_ECN={0x8, 0xa, 0x1}]}}]}, 0x44}}, 0x400c4) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRES16=r7, @ANYRES16, @ANYBLOB="00f308000000", @ANYRES32=0x0, @ANYRESDEC=r3, @ANYBLOB="00000000000000000000000000000000000000000000ecff00000000", @ANYRES32=r4], 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000040)={0xffffffffffffffff, r8}, 0xc) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000ff7f0000000000000d00000095000000e2ff0000"], &(0x7f00000000c0)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r9}, 0x10) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x23}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}]}}}]}], {0x14, 0x10}}, 0xa4}}, 0x4) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000180)={0xffffffffffffffff, r8}, 0xc) r11 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r11, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r11, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0xc851) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r11, 0x84, 0x71, &(0x7f0000000080)={r12, 0x8}, &(0x7f00000000c0)=0x8) sendmmsg$inet_sctp(r11, &(0x7f0000003640)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000000000000006c000000008400000002000000", @ANYRES32=r13], 0x20, 0x4c004}], 0x1, 0x10) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x3c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 462.880251ms ago: executing program 3 (id=3658): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xae}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x48) 449.958932ms ago: executing program 0 (id=3659): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="180200000100e1ff0000000000000103850000001900000095"], &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 364.614553ms ago: executing program 1 (id=3660): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0500000006000000020000000400000000000000", @ANYRES64, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000000e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000040)='fib_table_lookup\x00', r2}, 0x18) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r3, 0x29, 0x37, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x5}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000007e40)=[{{&(0x7f0000000340)={0xa, 0x4e20, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1c, 0x0}}], 0x1, 0x4049) r4 = socket$rds(0x15, 0x5, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r8, &(0x7f0000000240)={0x1f, @any, 0x6}, 0xa) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r9, 0x0, r7, 0x0, 0xffffffbfffff8000, 0x8) close(r10) getsockname$netrom(0xffffffffffffffff, &(0x7f00000003c0)={{0x3, @rose}, [@null, @rose, @rose, @default, @remote, @null, @null, @rose]}, &(0x7f0000000080)=0x48) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r11) sendmsg$NLBL_CIPSOV4_C_ADD(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES8=r1, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000000000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008000900975b9b5e04000b801c000b8008000900000009"], 0x184}}, 0x0) setsockopt$inet_int(r5, 0x0, 0xa, 0x0, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8, 0xffffffff}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x10000000}, 0x4}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}}, 0x0) r13 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000540)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x2, 0x0, 0x0, 0xffffffff}, 0x0, 0x0, 0x7, 0x8, 0x101, 0x14, 0xd}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000000)=0xffffffffffffffff, 0x4) 364.211772ms ago: executing program 2 (id=3661): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x5, 0xfffffffb}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000901000000000001010002000000000800040001000000", 0x24) 338.873988ms ago: executing program 0 (id=3662): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x17) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0}, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000b80)=ANY=[@ANYBLOB="1800000000000000000000000000000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000790000000000000095"], &(0x7f0000000d40)='syzkaller\x00'}, 0x94) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r2 = socket$isdn(0x22, 0x3, 0x4974e3be15b7ebd2) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000440)={r2, 0x40, 0x3, "22c6d8f40ac4facf86434bd55acff19a4ff0a76f93ee67cbe3da6a7a92ec9d0a98a2788b3bbc5110548b118f281e4c4728846c4d9f5bb9a68f89e340e41aa6fc84941947ce4814c7eaf7282ec8a3d3e686489260ebc95f053d67d1eccc881aa01cc80e3075d9c5b6b6c562eab0dd29be66e12c235661ccf78a0b1a0885a40414e4e2bddce377c383a681b86874def6c86f14ad7002105034878ac9e2eacfc8fe82e6a2434fc69835fc6365cb61b90ef1077244f1524a2f7729a154d11a0af5bb9f618d4c250fe8cc1a933e9a73bb70e9c1d6e2"}) r3 = socket(0x10, 0x803, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x0, 0xa}, 0x10) ioctl$int_in(r2, 0x5421, &(0x7f0000000180)=0xf894) r4 = socket$vsock_stream(0x28, 0x1, 0x0) shutdown(r4, 0x8c5d47e95537ac9b) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000040)=""/102, 0x66}, {&(0x7f0000000280)=""/78, 0x4e}, {&(0x7f0000001e00)=""/4108, 0x100c}, {&(0x7f0000000340)=""/109, 0x6d}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/74, 0x4a}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}, {&(0x7f0000000140)=""/53, 0x35}, {&(0x7f0000000540)=""/172, 0xac}, {&(0x7f0000000d00)=""/188, 0xbc}, {&(0x7f00000003c0)=""/128, 0x80}, {&(0x7f0000000ac0)=""/143, 0x8f}, {&(0x7f00000000c0)=""/57, 0x39}], 0xe}}], 0x1, 0x0, 0x0) 274.210941ms ago: executing program 3 (id=3663): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000e80b00000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000030900010073797a30000000000900030073797a310000000054000000060a010400000000000000000100000008000b40000000002c0004802800018007000100637400001c0002800800014000000001080002400000000805000300190000000900010073797a30"], 0xc8}, 0x1, 0x0, 0x0, 0x4001090}, 0x0) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SIGNAL_INFO(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3f2, 0x100, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x480c0}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00 \x00\x00\x00'], 0x20}}, 0x0) r5 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000002680)=[{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000000240)="bee449b9af3fb1026b683bc30623ac7027863cb44bef4951cdffeab878693541be752507631a77c3c2aa133f4853c66e3c79bb722fc4a8d379abe3a403e780a0", 0x40}, {&(0x7f0000000280)="53b83f5db17d83bd705e16bea694a4161fba0ebd341860f66d4fcd0cb4bc693c511751510d41edeed3cc7c6e98c6078521112e20607d0bf5dcb7d8103b717b97965bc1b34e7d87c899a1d5738e3837abe323373e297e9ded92611d80fea8465e53f036bc703d508b2c7d65727adb8932f25974a88ad1b0c081f74d76075d8ccbd8c2714f72b8884ef5e9eeefa3326bb48fc3f76d8c70beaaf84e9f4a6030d328060848b199cc359a86b519a3cfec04fae82cd749", 0xb4}, {&(0x7f0000000480)="408db9daca05df3d9563e96525a65219e0968873af64935d835c67fbae9f965540127ca6b76ac7e709ffd979b415fbfcab37a7786203e4cf0cfce583b54ec185c24b86e27b50ac560224d0b40c18e07b337b34c0c7c8949bb2060997c2450059abda9108b63419264e0f1a7aa4149135179ebcd15469251367f7e0eaf168ee3e6329136951fbb80df63ab9091601b16332179d56d014d833190c5e0565a8dbf02b3322060f4431c31f2079d3feff0abb6e6ac67d9723893188f1f8911b71f7cb1f6ffce75973940127517b36447efc9fce47be8b34169471fc964abb06d1eccf2cb01f9b148f2678d2beed55f771be48d09c46d8bc808a081fbc2dd2a24ec30b53594e113847a3acd20d161c753bca4d6313158df21207f50a75a4ee0c283a60c97f45ebffad997a2fee4f28176afe3ae3cd50601e9923ae981bb09e6ad8e2c078a806b138ad94c4b7a1f348468162ba8b25f37862260040b73c8278d1371f87dfc812560185acdd556245bb9a2dae3c1cb1fe3d79deba56da99ff64cb72147cee9007f11313de4b1bca1258adb312017dab7cd9d88e75748025fe62dd90ac940735ff1df766858d87d14bbbb6e22c98618a49e0aca3e947e3da2f360816600028be38d332538dc6829f434a9e5d5ee59eecec6b7f207b1922387f9b96c28af27c8620cfc7a6922c075858fe098359b469ce86932a4cc6d25bf6f52c7e750fabdb31bac6d664c6e85c0ff2ea43df9e4f38d1bec08c13d0d69f2b82bfa747eb8acf5a618c94509ed2cecce7f360c4b18855b26e348f32184e0af2e6bcb58828a833326d9ac04f6c4bb5a0636138360d7c462dc1a98124b18face4783c94f182a2484400be7e426496a3a0a1a71f2351001d683cc1bb94e32f39bd5df45a3082ef4e9958b5a740c5c455b412b479c76ebfb495086af5f7e2eb48004ec7a66f39d54c038df82984e4779850d90a7abe0bdf103cf6c7e58b02379390690d01b73cd772f2930015c6ca3857fe54d44b9a4c779fe5908d3c5767f5bd638a34b28c9bc20eb2553e66382d7154dc42969c4725bc0919ddf1e39fd9ab38655dbea6e57385e78bd495d85c10e5f3d5c9f42c89307d16a2af51ea60954ed954a10d5b3aaabebe35b818342014f7271a61c63da4e7b9d28de695a229c19b691888edc54c94dd38754d82c4b5aaea0cf847dd2d73d0f844790a291b4a578b08e27306affc4261d6943ffaf025d1839cc300ee775e3fe5b65ed2f3d185386e0b488fadcf59841a8062533c6e550e121e89e6755e586b66bd9efa774ecaee5ddf05537d8d5b87e668ba4741178abc9a8c3b4995490929c4fb3f7cf01e2ac59cb41bc9ab429945eaa82292f74d92695799d94b033bb0f35988712f0cded01ca4d1576220465f163a08a6d7a3a01ba382c0cfbb38e8c58d196d8b8b2dccdbadae97523e202649dc2df20936d457692d607d842113a0d27dd40f316c8139c2a3f4c0220cd10b8c89593b4e75e1a5772618ee1d9f3f6bba2049aaaba03839af3a3730a7b6f889c7966340f25dad3c3456c9f3c21692701f00fdacbf0878cf8a8806e10225c6523c1fac2aff40e18ee133b39bfaccb6e54e4b7b329554cb0dc1fb71ae1e82a83663e90e3f17ea67437058063af23cef7280e1d9ccee97e26e86a3180404459bfd86019e982a39bac6ba16a3fe43668bb49bd8cd142a64c865c919687e0578dd87cbab7209fbfefb3382c1693c55c2e8cf93996353e4e44e8b30c2a314f7cea634bd9f41f3e126d74ca4947158e40bdce7b51fcacf1011cc9b8306eb830e9762a7219bda1dfb84b5b2b15345fe705db8de3129ed69e9d01b6059a1c1f1e69123cadda9f0c7a331824703fafbf214f7576b5704283ecbdbb1390c6ce47c785252cc067c2ffb00e9077067218e13733d5340ae84a07c1de3414d15e08f2e5080bd77e4a4e8898055e1d4e0707bdcaaf7514f82ba354ed9502a4224300d083c0828f1900c09b0eaae89eb22b8228b10e5c04c1d1dbc9c26ad8c90050bc21fc3e0023c065e1a4f1a715b981971b0114be1730fcd7f4618a25454051e451e8671491687f6fcae61532455ed374cb52c7ff3f03cc6b162d0dbefcf816bf1ccb1cb03924153ad1ac5a72153a39a42e02cfa6c2cffa0235ce0ed5874a23b027377ab6298386e9c878516512956571d9327cca4e06cd1e6961a99eca3df774d0760c81c9f52241cd10ffce01eaec9b03b9b3deaccd3be363261f7af105263a8cc5255353eb782910ccf166f7ccddd8f2cb338b03a185a1feabb872eb6e31d15b8e15193639c1cdc77a9b2f13baa7a765d135064218ff5b9b419f5028fa378d4309ee87c02ded8dcf583c3bbf5a2693d1e2aa77c73e211dab7b55122e7382659e9c942086e88e2805daef9d3e9c1e6ceff84355551213d030bda589341e6212052b3361234af2e7aa9455984e33638d1e01952272f64d2712e43b61e3216e9a8fbd4af272a5426d5f079ba42333fda722cbfeebb7613232d7a085d898fd947b347e5719669b3003fbc8719a81f2eb8df00b7de371633103cb0b1e9dfb7f26fc09b98a0aa2bac1843f09218951f26a1e08a5d23b0eb32ec876fb6f44a6c4e706dc53269e41f8a73002a1487cefcb4e6d501b05e311df3d64d611de0e20affd3c9123b4a9b585bb3343ce53f3ce067376314293f0a7195c60a45607ace51944c3c6844a5732ffe39e580574b7749939d73c645953fe85ae2011ac15f75f5020f4db9977cf9487a5f41d5b79e59934f5ab46d5c0795481d0c82fd7a923a20ffa175fd5005f2cc35c6258c8c2f396721569cfcfdaa8761b76963c8839584c6076646da1d227a18c071dc2219f13f0a54cf0b340bba6f734871e271172747d3394b9c91ef9ff0f77c723e7c947ab922a94bf8c493c7e4a5373246575fdc6ead3d74d7657200f4be0d30bf9e04d53fccef3e25ed1b8c90e6f25d7a13cb81e8168a176d925660b5f23ee0064d16d747ee06915099bf9f95e3bfaed0e0176cfc7038b65a4dac12f76a8c905ed2786e0a39621d67f1dee02b072a424a4ed6d1e21c58b53ec4dc45df5d95b297194241997d1b4587d7a52f7247ed356b4777075bcaad3b69c61c7bd4f76aebeed13130dc43d3913c01f148b712a29949fd5de5543cb1651296bfef6a3265f9832cb06ccde59b76ff894db42682c1ef7a3f828ebedddff5873ae479ad6639935fe78c3f8b262f4485708299965d2a9a2892733cd97830aeb8d5761429f755c9cf916bea1108ba074b21c744f01134807d18d527bb9f43c99eabfaa5fb94d4b1dc8cb1e3bfa4e60f55f0b8993059917f5e0354220856b5973afa9c42b6e40dc84ef4ce0eb528f1fc432c8012d7c8166c5a0faaa0672135bad9360b560849e4fe6a57fabf8b2b2817b7112be3292b7bc8400fbc5726fca823b9ff91880bd81f6e32dc676cf009bd39409ce78d3012491d214e0e8dade8ed880ab940894efcbaee5f7fcf460410b0833c1a244e98c7cdb74d0bb2133bdc179ca4784c8da113c5d7d62f3c99c6bc7315793bd6c961fff86f3fe4a77fbd6231d7df432ec1e424bba770d28afad7517a53bcccd0246207483bae204602348e367cfe1ded7ce210bd6c70df30cdcf29d2e51c15dc0b5d4604d8c64923a60b10aa2f059b26b91126d75a0d09470e8fdcf6e0c59b568206b2fe377a5f2135a9c60b2de9721233b2f0ca6ea177f5942c5d25c1cb46b40bb6fe56ef39651b15e1ee748d8e33cc7009533a54e8ef8964c3106c2e7e6cfdf0fb407b2a56ca33696dc89fff7d291220a2365b3a6745e5fb24153bce10d48c226ffe369981fe5e50827b202bcb96fd9c806ff2506a3826557cb4793e22ca59d66d0eab8ace77ecccb63cc60ad0e92d1cb825572b8ac57abc4c9ef97e8d83587794cb550f26ad011fb61e71b2da5680b527f7b19089822541fcd9a7b8af8473a008d15a27efe7dae5c4858de419d847a41bcdf3370cdf5122450720727df065a48e84aa0769cdc48409818ee47bdb05473ec240880577b5f18ba687a9b953504d3cd3155299909706eb6ed27d1aaa1503e840455d1f079ead5bd80b909e6c0ca891dd8af20015b4cf0d5d0bde96425ade030cc72580a5502c1d9bf6bfaf5578bc823ed4b76cbd17450306d90ad97912f984d0f257b707adf20d54d7f4f035c3427a34b5ba3ebb68ed51daac75c9ad1742067cc6848e500c1378747864584ba9d46596dc4d5f15d98d76b26e53742d20621f510d16e2c93778f7df547e1cfccd564733ed983b461da0b8f5c2b27e1e0c6350b33988ec8e19f2287457b14ec1e4b1c77114d3de970fd229e962b272ef0ec19dc2bfb9a7bf2ddef57508c9fe3e26df6ce8844043bff28dff5da4c4eac97d07b7535c8037a6668a407d97082051a567473632806cadf67353bd7e66ede7143472f77b8524238b6f5766c28e49ebce770a317cf37e650ad33b915509ae8be8eeb84e4afad130e283f8e04228f3734eb82407e58e6fa44b5b3dc8cbfb5bd60f8ae35999e2c1b4cca621f9e69fa630fc18ab83086db7d83c56b91981c1670269763244a257323450954a779c78bb7eb9cd415d6c00eaa965ee01ec01069724bcb3289feac53ce9799c9de2e0ecbf711d1ca29a7c63e01632a54196dfd2a82e1d6f8da36e54de204242b6f4c4d3870a407b62864dbb864ade9c6e499f22484b5e6421bac17f0c04ec8b86a327847cccc57cd0494d8e31938be41bbc80d9b22c5ade04c4140f06bd7b3f2bf8db3147424111d20d63822d38c61da9b22f715ea107cc5ef9c7bc0391eef34dfa762deb60881c06cc1e6b6dfe0950f5e44adb669190e944fd6989d3d0884fdb5b04d2fa143077726356b4c796b5ec0586c5bd03f9ba8c7b658fea052595d702c471844fac234b5df8ac337259bab815f4770149bb33e559f1e127745586982fc5aa1f2d73abfa54bd37a36ce6035df2565533bb165cbcd90982eda63ad6838af7abb15c10e13ff2fc575783542e7ca377edba66d16aa2ed95f2336b8d0940f9198bcf086b7097a3425dad10460e941c62698d809e4c47f8290bdb0b935e5610e6adf86ef21fc3fbfd072194e691633df5f69cb19d2ee5cedd5f3058680c82c4703a9cd58082a212f25d4f55235e3435eeab594f53a692c50c954f10462aef9100647e324352cf3d73cca553126417dcaface91dfa2226dfc686c52a9bddfec5feae49198d70fcd2c93dac48c55d87ad7f20ee9c771be8cacfe48d5a2e21f6699d8ee50fa86001c3ade6fc98fc99e894812b5f6c63e19542d97ed056fdc9111ed782c0ed18333e16d5e55f8d7e29c22a84ce58ab166164499eb809d44f6afc3d347e49a609ce81c4be97f291f196144b55f307876b9ac4988bde180b4ffb50768a1793ea62ea1625f502a90ca8e4c35a7bdbf2d271e1a3db469a8fe161db590bb8db250b396c8ea46529f58571815f4211ed451c2ba54762e5c2440a0d832f451ee1b50dcfbad07f4a4140468b0e4e19a342e3caf2ef104580473b7098651428f9c1326390cf081813c71c9aeee399383123adc991a87489fef3d9aa409eebba043329b5e376f26f2c55b759b67ff9bb45d76175746b75c0e6d8446ac405898088b06730de88eef62e5111c6214ccba8990eed861774befa8a69e98e87efe6e30baf16bff480e8616144ebcf5f4dbef669b3e9517d01783b7f5eb83016ce041d2e56c86cdc8dd4c7a052809f893c708202f28242619649e654a99d1727c998d8bdda42b3abb6f7bd44be5172c5081144ed8c604f1d484308061c76ff92", 0x1000}, {&(0x7f0000001480)="049b08657e6c356113e90776e5beceaf61eb963c68f645972752cf305bf40b57eec34955fe6a9744ba3c4698388a27a733d848877872a765727eacce50cc0867a4734a4e3b8a9353a32e58827e2c8277928741d1b0d8c73224eed3aff845f37fe629929fe954a372902087c03ca3dce0b1a1e5c7e3c844d0cf5cae2066384469f6e1ade1f8167e68", 0x88}, {&(0x7f0000001540)="67c8f83a772ce200bbd7704efa8b7d6258f110ddcc0c174131d9e6b232c730bdfcf39ecc9690f4cc10e21b5fafe8276f87ad5e13bda5b3cc76c279d441792ca77e8e9e7b833e1df34087c458a3ab2dadafc17fa50d11e8022aa26259f7cc514199b0105e1a041c46a69440f9d13b15154f3bd727e9c6ae7979825c5e19ee66a9f428556b97575c471fc7e2b6d4191cbe56e0e1fc022eaa92a00ae9ba042f19e4c1c66f40614bf54ab4efc3032223d24795948901b1bec6c2aa718f989c671c8a54b3132683439646bc30de66d9ed330fb95dd7383b53b8937a3d3e7d2c5c197445315887056d2c46be4430b78935d52a95436be9fbc266aeb581b4488f1110a3392eb451e8acd9aca0d0095cffb059a6c7cddd2134385f45918ae08961c2a717503b8a490eefb9e1d2d94e6fb025a1dafd9bde59d1c9baaaaf87d58a8c049f812507a6195894062941e2383aba1abd966b84171e0334a64ed2c975bb86f4bdf3cefb8c283f1bff6e199f615de460b5dfc88997f469c91adc3a277ca25b1627e5759dface909cb000f67afa97de78a696bfc32d7399ee20c923ac9baa56269abc47925063fff4b0edf33654cf0fadcd310b8b5f48fd3b8ea9f56be78048e174440d9ea5cdef3d1f15e0f2b5979fb8de1b1d95c69b2a1f4cfcc428663f79c3f4a9f4782b879926e9f4fb7183d6a47f2c4ad0393caf76c8b6814429db7571c67b6e631f6a121cd30bee2727291aba0dbedef306361cf65bf727e72a645cff2d09db25f45054b4bb7a30f5695212ad5096570f952f092f388258ca277dc000d1ad6116a077bf0a72af818d78cba55ae9b3c0e85e4b100f3a42e7225760a158f149255e64bf8f4ae635612542177046045616e5dfd95834565c3048ff519424141eb2d267552d845e962bbe55862c8a8385ae92d3b0b773446926c36f4e3c110b1f25245d3eb1b1b6e26050e8043e5683d4497dc7385d75e7f7da90558f4b9c60ef67e21be9794c1981353e3665b8bc5ef6c480e4c58e949db698983c51cf850662d34473005ef287666bc3a7de3a5995814b89d5742eb544b989ffe42c8706be63ed1140799efb6c136b71082cfe98440d1102ec211cd0e395b660b7c0c582d6981291062cba5f8da2b358c6903e49323dc239fc2c8ba76c4ef56e34e67f6ec7c4db88681d34765c7e419cfbde06f6d5fc42a5828a73827121640242c05ab76a8cedee9db033bde9e7e3b82bb46052b19710f33c85f3c8a92bc6ec05cc7832ee1ba7526f28e748ed382f09966e02b9c5ee1b4db1c126f73e0845b294e013312a05abb539ed094b796daa08fca90956cfa18baa3c7b42e55705b429c6a38a331377a3440aef787974561079f2b373ac5240b8f0790f524367f5bc5cbbd9c0cfe4436b617ab2552a449ead1292d430472c9c219671e69a4d12508a175f523461f351c9deda3973236631acbf54b33b35d3f06e78708876d9891509d7588874df0d881bafa7ba1059eff976a9154f5f7e60f1b6a858a157d9ab8967dcbe060a013edc313b6583c6b291614a66f20b8bfe9a119414c51894fc2dddc36a787050cc72435f620f95a6468d60498c2b5c7a6875497ff325b9a78fb411ce0d1c87b48d5b8dbc05439039af42da21303e1879c9c9462b3d81795820cb46025687576fd3662705bcc470cc99a7bf96be7d393bfce4eaed0a004afd448e608f02699d02faa0f500ef69ccc6281ab82af74037ea8e8a2a5c821d6224ced5a49e0fcb86d787ca04122045a794b1d992b412e2e763445592d63f1131259a936b611c61cee63b6752c17ed42297512f72a1721c9ea8b8353dcf911737ae5b1a40c1024f9f509c253ad28a62ead5905abe543f3c1145d2d5d109ff74354eae108891b3fbe5d565e0333629a9b794de40164d0fbaf95f9f83896607af93390a6b1b602e927a114a628822d58e6313000f994fcb96760894da83464c832c668adc43c0004cf1de510088db8620e01934316869949e5ad1e6ca1ec7b931ce38a6fe38495617be86408da4ce935ab5f0b49e0ce3fd348d4d44cfa9cc884638f33eba0cc2d87ed8f1a588d1d98abb3407e62b7119bab6c9efb492b1e83c755c947054e1a430c3b96ad9aa327ccbaa05ab110705ae347ecd409d76e651c3e26c9fd2b91f4548f2f6188d4901480f2d1b7d9e073e735dc66b25b5ddf2fcfefa1708ee56e39c6716a7d2bc30d982d9818fb023b12abab4b5c24ca2dcdd2a4c9ab52d3d85171a0f18fde12916413283b2ca5f934cbe9a24872b2c010201c9a70f4304a62eca2ead61ef5a53f14d68404123b69f3c18dbb4e2ceb0e43ad001935e053c9d161870a8540b56161df533ed069386568352ecd64fac6f3f43b730342877b9c5be9844289ba85c0fc3fc592c3df780ca07489e3b61a3bd215222b994aceeb11d9261765b6e8459bf882f0bdc1eed7e809e0398ee35f94166ee08c5fe4462c3bcf8f97f36416a574b424eb62ccdae0cd74b7512e3483c82331fd66ffe4403267658095b358beda0a6c57ca21634ae0646924fddc3822df2fc78360c495a2b5f0bff9640ddfbc965c5abdde265cac13f23a781dadc9f00365ce68d5ba03ca55e86c84f39863a8d4a17a7eefe70f32e6606d03a29fdf67c4136bcec8144b4d864f3feaedafcf26d679454c4809ecaa7953419cf3d4a4b09a89090c0de7f78f07fd1e0fe1a2a54326ad51f0d5b637d3395975c6a58adba99de2ce726f5a722554196de1506e7bb24114f7279e0d9ebbc55fadc0ca8ff21fb48df99290309c07602ece5687731b673ee1fa974f748f7bfefc1b7e12d0cd277193443ce7b8e0884785bc45f03e5df134a42eeca8fe5de5e97f424618e1e901351226a0908e7fa06550a1094cc29a1cf7d10d8ee6acab435b8c4823b0790c3d932704f9105e94e27edc05254285b9b73d37bce51c1c77d61128a7d1950f7a7eb7df876941a57c25f3193054cb19e9609dae08f635906a6e7b7658b7684b7537a2bc1fdf8b2e0dd92011f2615821cf30f098a3704fcae5f32776c32720ca1681823458650c27ab5d295ec17b53753f21dc6d86913995f0e281330fb9bb2d0eda1d547b34a59f518ab711bae777a70aa9bc2f46d1aa9a77282e88e5579398d13e82614513c21f01df06384c50ab909ee7c4e392d0169452d77163e04c01d59ff665829f0aa07554d345c05d927898118288d362976bc82218edbfbaeb03553914e528df91ffeb75d9823558d688a2ac6ed22151ec33545df7bd05c52aed02dcc5ef0cf32918316b966524a26f89676151d99bb9f5b6e23d7cca78bc4eb425d54dddac2839350052a401d0a84fc4f9262fe37bf462cc0e706ce377c09172ffada183cfab7fe629e09cc5d0f6ee7ac10a4f321f03ea00ee68fe3d8946f03d8044ae60b81c1434d56dabf3d7602724f076bcdddcf2369b68d3cf5f53d6df292d654287aac65c5b3d5056cafdb803521ec5e38b87c36b1ba4c247eb24156d77570ececd17fe1ef5e5e7fd776e63c2f762bfb7b7c7ad8d1dbeb97b2247d5302550413970ddff90b81e135ac48f73c1feb718c6a3b77364b0d8589e3ccb97032d4441af654745c1f1eded86325b910b498f077a39ec507daf9e974b393ff613567ab250fcdbc3e22ccf5bce167b5c4c9e086a0bb7e99442ad97bd5a827092c530568ed2e51dc8a1ae976a84f286ceac8d022719f1fc98c13792e63c135426b131ae0a5b420a1c84e14bbee5bd84811d540d1c9582814e821c816d3c290e04a76776fe9d7637182438a5d0d7ca42be9985f74781d61dad3820bcbb7ec49bb90536af7f3e8c554633dc078ed6d89fa8a1e9028df2e080910becb59bcbcd23a5205ed746689f9b675e89298df269ed857d8f36980f6760983dd9dbe90f643a85849d1de441fc003cb9b4c90be2d9e3c338b554721d97077f2926b900a48dc4392eeefd81361b1efc18f412530fbff7a30eaa27fdfddebc18f06c79161c0f17a324a41acd99db7ef0228ca16dad837580a1a3e56287348fabda867f96dd2206c76e123e0ecf8e46e434c8027af32ae0131b6d51d907a647b52469d0b05834bd61c201b6270c42d19e88bcad6c78717c2aaf53de1cdc8c93f64fe94f437beb82bf7e1030d30b9285ba66b37817c250db7d9e1ec8c8d829203ccf066612ab50868162bf5b45152e0e56e2388350bd5f6ceb7dfe6cdf52aa80c812425c74725ea9212b9196b411c28bf07725dd5251acc4122fe159168887a385783cf227bb7ba0ddb2fdd3e4f8c78384dd133777dce6d461ba8513cac22efe36c81298886b46a0c2ec661aa6f9b86d63ca56870fdb9235d79b3db4d11ccdee8a07cdc65a4e23c5552a55b8f6bb15dccb0ed644668d7a72eaaa9763d27551890c1dd1361c9fe558b5a601f52ee355341053f899ca5b5c95c8b6153af4a28701ab951d10a0a7beb1e3306faf014e5efc19a7025756e2a3c5c8ab51193050f8a34f3e1743f8a5a8679f812a162f09a84086131f450d59f747df5d768a4c8ae536c857fe60d2aa32f390bdf4adabade5e1c1eb5660eb05221f330e64e6753711b6cf8e852ebf7411862e2d2bf8c8216cb705b96df1322206dfb68528be2c3693111e1d0883097b6fb16b7996eff69ccf9fc7be1e1dd9e1fe2a3a63ba3565bb0664bba589ceb64c789fe99869f4425717652212dfa17f60faff42bbfef41d978a4969507ff252dcff47562662842d70b8253d03314bb8c42ba932e460edb86e2bae0a94eacf53dac7f00777c87ba5de858e32b0d6dd28f683a8916b0a8412c5eac45d471cf94e482f95c4b7b3a6611fc1732aafa77020509f61c09d685daceffa67fc7620186365fa46fa6cc61ea31bdff8c5dbef74e17c1b391943769c9d6389442b0c82b6123f60bea5f19b7549dac1c97b905a7963fd8a560f0e0fdda551f5ab162bbc06b92fb283e134b49be2b818a04f8c3bf1a730f03c3581fb38d544c56306fef8a16d1db4c64dd6c60bc9bebc5d77d18520455a56dd5f8a426fb81fbcfc5ece2420b92a788f8cf9ceff5a93b96d56f428ea8c05a9641dd7f53956ecd7ef87646f4423ce0a2c1ae442b305d0138ac09f2dd2440f910167478f891ca5143dad79f559073465096c30b845e68ff1a07b2dcc62ac3abf29ba9c8b933dc4cccc4655596f486f9746950785b18dcb234e8eb3ce2cd4e08e0721027c94c33f0e4b8ae86601be5425f48c16565f18b2bcc576d2ca96a5ede8e4f181c09893f494ec0697020c14d6d4d0df1b38957ff297a9a813a65d116ed53964cb2c9027d0dc7d6e88b10b1122bf7d867ebd011bf45e0f52287312f96ce57b2f425de4fceb6b57ee56c024975f988fcd5f982a327d854b761634060b64558423c4510286aef584a5764257ca885de79b4427ee1dae017ed7b53f1f35db49ab8df1d034366c4a88ebdc12e86e9d9bc78139d0bd6ac3a3eda8e565a1762aadc0b133a26ee9a8e13197c912275db3b10c8b0e277615dc44dbebbb87cf4b056eaf6d16762e00fce4bd4604ec72af24da98c21480cdea5539fedf15f6c8d0335ee9f293fb934918149c9f0ea610f9c437e43d93869a057b644b5ebc342ec5ea0d68d8fd041ecd3450b75a61921e617dede05cb9fd66771972c79ced743af2988f763be99f4b5b6ab6f4e0b51cf4a5410499f118719dafe943f71d1608d15bb084801aeecc59e1166c4a857240e688e3b3efd7e560f0f0ccd42123cddbb1a0a288b1c333fc359dcbc1b05808cc56356c130b75bf39aadd587861150fefa65554de6cf59b21dd300349279a93cbf", 0x1000}, {&(0x7f0000002540)="f3ae0429dc2fc4f1c9a0517cdba195ed9c1498c62b6022026aaeca186d2bf2ae0fb97774f6c2da5f669031cf96781a4810086cd6def95c2d893aa1fec40f9b394eb993c15c0b1ca5a4ba17eef78885888e870b74de7bac234b1634e6a1a96da5f69de354701736c92d52bbce0fa109ad5af2bbd1c934f19a901b544154b533af369999132e", 0x85}], 0x6, &(0x7f0000000340)=[@assoc={0x18, 0x117, 0x4, 0x6d}, @op={0x18}], 0x30, 0x20000080}], 0x1, 0xc0d4) 192.745225ms ago: executing program 4 (id=3664): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a01040000000000000000010000000900030073797a31000000000900010073797a31f5ff0000280004800800014000000005080002401b2fd2e4060003006970"], 0xc4}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000010) 192.259448ms ago: executing program 0 (id=3665): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = accept4$tipc(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x80400) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x41, 0x2, 0x3}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400}) r2 = socket$kcm(0x21, 0x2, 0x2) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000540)={0x2, 0x3, 0x0, 0x8, 0x2c, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x1}, @sadb_x_sec_ctx={0x1f, 0x18, 0x7, 0x7, 0xef, "d56015c6be61ccd173eb7b2a75efe19f151d46e9e97e99bc59b6ebbbde73cfcfb1f7f91006a83981d5fa24aa0547413cb6f15b90496a3561ed8d0af310ec6d1d8de76d846376fe01218baafd50051704d1510836b2019fc43a60de6a8c11902a2384de46092d21a2936bad12f5f0ec2620688c0a3910f19eac0f2770170ebd62ef86ea4ea593e7b985fd06125ad9b1e8a95c33e37a7badd2b346fe1fc86ef14a4c62abcec76267539da5fbfbd66060f1c1d9bc263276cf65424c8dd5531753ea2f44104928190894d96d3960ca293a5c3f20cce854d42d9f4e202b36eecef0eb8131e87dd0e0784f962625b6c80b85"}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x6, 0xb}, @sadb_x_policy={0x8, 0x12, 0x2, 0xd145bfd553fee0ef, 0x0, 0x6e6bb8, 0x9, {0x6, 0x32, 0xcb, 0x0, 0x0, 0x1981000, 0x0, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@loopback}}]}, 0x160}, 0x1, 0x7}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r4, 0x0, 0x60, &(0x7f00000003c0)={'filter\x00', 0x0, [0x3, 0xa333, 0x2]}, &(0x7f0000000080)=0x44) sendmsg$inet(r2, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0200000000", @ANYRES32=0x0, @ANYBLOB="e000000200000000000000001800000000000000100100000c0000004404000100000000"], 0x38}, 0x0) socket$packet(0x11, 0x2, 0x300) r5 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000014c0)=@newtfilter={0x34, 0x2c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xd, 0x2}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x24004000) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000018c0)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x8c, 0x24, 0x4ee4e6a52ff56d41, 0x2000, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0xffe9}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}, @TCA_STAB={0x5c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x5, 0xb48, 0x3, 0x1, 0x200, 0x9, 0x9}}, {0x16, 0x2, [0x1, 0x9, 0x9, 0x1, 0x4, 0x4, 0x7, 0x5, 0x7]}}, {{0x1c, 0x1, {0x1, 0x6, 0x7fff, 0xffffffff, 0x2, 0x78, 0x8, 0x2}}, {0x8, 0x2, [0x9, 0x0]}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000010) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) pselect6(0x40, &(0x7f00000000c0)={0x3, 0x8, 0x7fffffff, 0x2, 0x3, 0x100000001, 0x27e2, 0xd}, &(0x7f0000000100)={0x5, 0x3, 0x101, 0xb21b, 0x0, 0x8000000000000001, 0x10001, 0x6}, 0x0, &(0x7f00000001c0)={0x77359400}, &(0x7f0000000280)={&(0x7f0000000240)={[0x6e3]}, 0x8}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b402000000000000631108000000000005200000000000009500740000000080"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x21) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xc}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "c5"}]}], {0x14}}, 0x70}, 0x1, 0x0, 0x0, 0x20004049}, 0x0) 192.02107ms ago: executing program 2 (id=3666): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='illinois\x00', 0x9) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000240)=' ', 0x1}], 0x1}}], 0x1, 0x48800) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2, 0x13, 0xffffffffffffffff, 0x4fee9000) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='cdg\x00', 0x4) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="03040200020005003400000007000000000048a5004b00680000007390787f000001ac1414aa0186095c3d396d0503c0000097662b5d49718f4a7fbb00009bb009aa49dc1700d96b735893b001b201ac708d248c32a7624f1372cd"], 0x5d) sendmsg$ETHTOOL_MSG_WOL_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x4004) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) setsockopt$sock_linger(r2, 0x1, 0xd, 0x0, 0x0) shutdown(r2, 0x0) shutdown(r0, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000d80)={&(0x7f0000000d40)='mmap_lock_acquire_returned\x00'}, 0x10) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) pipe(0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x19, 0x4, &(0x7f00000003c0)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xa9, 0x0, &(0x7f0000000680)="ba894cb1acdab876f1aac9f4f0392bf53f675d6420e88c4a27f76d6852a3d8c7e51e23ab5687d7d339ab9b0927225365077ff358e2fafb1bf3eddb6521d7469759961791a31aefa4f8d279af2c8b067270efbb56e973189d3f42c83e39b1dcb8e96a77d88f6193f6bc22989e7a256e03a2c555124778b6d81acf1ef1f64196051fcafe4afc7e21df0ff181606295ffd9169479e797a1982ab195888a77d06bc814e5c95a0ad54ac2f9", 0x0, 0x1005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000007380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000800)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="f1e6ffffffff0000000013000000080003003178416ce6cad5c3641ef760bf28302e234cc30bf360b11943758c840330968558a22be0545a22d836b0aa08ed5b9e7923b274989e651f298181f67edd4c04d65a62", @ANYRES32=0x0, @ANYBLOB="0c009900050000003300000006001401000800000600ab0009000000240081000500020000000000050001000100000005000100d600000005000200080000000500130100000000"], 0x64}, 0x1, 0x0, 0x0, 0x7a27cb33b36494f8}, 0x200080b0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) 151.033966ms ago: executing program 1 (id=3667): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x1, &(0x7f0000000480)}}], 0x400, 0x10) (fail_nth: 4) 107.499938ms ago: executing program 4 (id=3668): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0600000004000000fd0f000002"], 0x50) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd00000000000000080003400001000005000100"], 0x24}}, 0x0) r4 = socket(0x2b, 0x80801, 0x1) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4, 0x3ff, @empty, 0x1}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000008000100", @ANYRES32=r7, @ANYBLOB="400002803c0001"], 0x5c}, 0x1, 0x0, 0x0, 0xc004}, 0x40000) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20000001) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020301010000000005070000000000100800010001"], 0x1c}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xa, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000004dff0000000085100000fdffffff00"/32], &(0x7f0000000600)='GPL\x00', 0x5, 0x50, &(0x7f0000000680)=""/80, 0x41100, 0x60, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x0, 0x4, 0x3}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f0000000780)=[r1, r1, r1, r1], &(0x7f00000007c0)=[{0x5, 0x3, 0xe, 0x1}], 0x10, 0xcc2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1b, 0x12, &(0x7f0000000ac0)=ANY=[@ANYBLOB="d002c9b18eb7d72b3990598d851aa91030", @ANYRES32=r1, @ANYBLOB="0000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018100000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f00000004c0)='GPL\x00', 0x3, 0x40, &(0x7f0000000500)=""/64, 0x41100, 0x3, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x5, 0x2, 0x400, 0x1}, 0x10, 0xffffffffffffffff, r8, 0x3, &(0x7f00000008c0)=[r0, r1, r1, r1, r1], &(0x7f0000000900)=[{0x5, 0x3, 0xd, 0x3}, {0x3, 0x4, 0x9, 0x6}, {0x0, 0x5, 0x4, 0xf}], 0x10, 0x9}, 0x94) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x20048805}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @numgen={{0xb}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x68}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f9ffffffb703000000080000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000340)={@mcast1, 0xb34, 0x1, 0x1, 0xa, 0x0, 0x1000}, 0x20) 32.536844ms ago: executing program 3 (id=3669): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, &(0x7f0000000100)) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c00)=ANY=[@ANYBLOB="84010000", @ANYRES16=r2, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b80080009000000fffe080009000000000008000a000000000008000a00000000000800090000000000080009000000000008000a000000000008000a000000000008000a000000000008"], 0x184}}, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@ccm_128={{0x304}, "000000009b993e68", "75df9881592b9fd38bcad042e286f2cd", ')\x00\x000', "578619a280c847dd"}, 0x28) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000140)=[{&(0x7f00000001c0)="580000001400192340834b80040d8c560a067f0202ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100060c10000000010000000000", 0x58}], 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1, 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="1803000096000000000000000000000085100000060000001810000089726a9bfe6397b0ae2d64fd1ffb14e6d9ee99da464841889877e9443366568a7a618ba00cae1c6e8068c51853a3833fd25d551ccdf34566491837bc4316001b30004fb14d7c38a8a46821813afa34efff"], 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x1e, 0x2, &(0x7f0000000000)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x9e8, 0x0, 0x0, 0x0, 0x5}], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94) r5 = accept4$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x14, 0x0) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000300)=@req3={0x8000, 0x3, 0xd, 0xfffffffd, 0x11, 0x9, 0x7}, 0x1c) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000780)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x6, '\x00', r6, 0xffffffffffffffff, 0x8, 0x2, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r7, &(0x7f0000000800)="246fb6004e616becf90162ed15dc5b4bb65e03b81f7cd1069d8bb27e3d08c6c1dec9d26898059abdff7209a450a8c3bf789f2006c1908a9f8a1126d4b7867a3c1ca0d07c786d64d0221ba42ed623692ab552c58a34915699f007206c54734896355fe6788f5279b4d6f84843e6c79cbcd2f7fcd5f1f34c51f52ea51fa81df023e046d461a3344b8d944751111bbbe238d6eb3d4ffc56e66c4eb5d2c509d8e5d518a55c4fa39675b27bbab772304120c4347995f58964617c2cf684cd6a07ef94793b5fcb751e4d375690675221fab540ea55d610d7db5665a13076dd485373", &(0x7f0000000400)=@tcp6=r0, 0x2}, 0x20) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = epoll_create1(0x0) r10 = socket$unix(0x1, 0x1, 0x0) close(r10) r11 = socket(0x23, 0x80805, 0x0) listen(r11, 0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r10, &(0x7f0000000280)={0x10000000}) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x38, r12, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_TIMEOUT={0x62, 0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x6}, @IPVS_SVC_ATTR_PROTOCOL={0x6}]}]}, 0x38}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, 0x0, 0xdf64, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, 0x25, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f00000006c0)={0x5, 0xc, 0x7, 0x7fffffff}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0xfffffffffffffd28) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) 0s ago: executing program 1 (id=3670): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000540)={0x14, r1, 0x1, 0x70bd2b, 0xfffffffe}, 0x14}, 0x1, 0x0, 0x0, 0x40008090}, 0x2048044) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000009c0)=ANY=[@ANYBLOB="c00100001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000480000004800128009000100766c616e00000000380002800c0003000000000005000000280004800c200100ff0f0000000000000c00010006000000050000000c000100060000000900000014000300766c616e30"], 0x1c0}, 0x1, 0xba01}, 0x20048050) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1b0000001a007f029e", 0x9}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x4000000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000a40)={0x0, @in6={{0xa, 0x4e23, 0xb, @remote, 0x5}}, [0x7fffffffffffffff, 0x0, 0x5, 0x3, 0x2, 0x0, 0x1, 0x0, 0x3, 0xf5, 0x6df, 0x100000001, 0x100000000, 0x3ff, 0x3b1]}, &(0x7f0000000300)=0x100) setsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={r4, 0x81}, 0x8) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r6, 0x0, 0xd}, 0x18) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000350901000000000095000000000000006e98000000000000c6080000000000008500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004a40)=ANY=[@ANYBLOB="c0260000410007010000000007000000027c00000400fc80"], 0x26c0}}, 0x4010) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r10, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x1c}}, 0x200000000000000) sendmsg$FOU_CMD_ADD(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="0902000000000000000001000000050004000200000016aab296fdadbbb3c44df80cacfb6f5a34072c9157a0db5843145798565e589959e769735228d91d75b10194bc6453402da096535db0841bdf2b2c8211ae8e126c0f4dda2e8927003ee1"], 0x1c}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="a400000010000104000000006f00000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000007c0012800e00010069703665727370616e000000680002800600030006000000060002"], 0xa4}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010300000010fcdbdf25240000766504000000766c616e000000000000"], 0x2c}}, 0x20000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000480), &(0x7f0000000500)=r6}, 0x20) r15 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x10, 0x1a, &(0x7f0000000e00)=@raw=[@ldst={0x3, 0x0, 0x3, 0xf, 0x0, 0x8, 0x8}, @ldst={0x1, 0x2, 0x1, 0x6, 0x5, 0x11c, 0xfffffffffffffffc}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}, @map_fd={0x18, 0x2, 0x1, 0x0, r7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r14}}, @ldst={0x0, 0x0, 0x2, 0xb, 0x7, 0x20, 0xffffffffffffffff}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r15}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe92}}], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r11, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0xc00, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x40, 0x101, 0x8, 0xf46}}}, ["", ""]}, 0x30}}, 0x20) kernel console output (not intermixed with test programs): [T13596] ? rcu_is_watching+0x15/0xb0 [ 370.355172][T13596] ? do_syscall_64+0xbe/0x3b0 [ 370.355203][T13596] do_syscall_64+0xfa/0x3b0 [ 370.355226][T13596] ? lockdep_hardirqs_on+0x9c/0x150 [ 370.355250][T13596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.355290][T13596] ? clear_bhb_loop+0x60/0xb0 [ 370.355316][T13596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.355335][T13596] RIP: 0033:0x7f76f398ebe9 [ 370.355355][T13596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 370.355373][T13596] RSP: 002b:00007f76f481d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 370.355396][T13596] RAX: ffffffffffffffda RBX: 00007f76f3bb5fa0 RCX: 00007f76f398ebe9 [ 370.355411][T13596] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 370.355424][T13596] RBP: 00007f76f481d090 R08: 0000000000000000 R09: 0000000000000000 [ 370.355437][T13596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 370.355449][T13596] R13: 00007f76f3bb6038 R14: 00007f76f3bb5fa0 R15: 00007ffd04522cb8 [ 370.355485][T13596] [ 371.049892][T13613] netlink: 'syz.3.2542': attribute type 2 has an invalid length. [ 371.057965][ T5858] IPVS: starting estimator thread 0... [ 371.155409][T13616] IPVS: using max 25 ests per chain, 60000 per kthread [ 371.197695][T13620] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2544'. [ 371.648413][T13639] netlink: 'syz.0.2552': attribute type 3 has an invalid length. [ 371.664982][T13639] netlink: 'syz.0.2552': attribute type 1 has an invalid length. [ 371.674842][T13639] NCSI netlink: No device for ifindex 0 [ 372.147029][T13665] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 372.737319][T13690] lo speed is unknown, defaulting to 1000 [ 372.909542][T13702] __nla_validate_parse: 5 callbacks suppressed [ 372.909566][T13702] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2574'. [ 372.989579][T13702] sysfs: cannot create duplicate filename '/class/ieee80211/!å' [ 373.025643][T13702] CPU: 1 UID: 0 PID: 13702 Comm: syz.1.2574 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 373.025678][T13702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 373.025691][T13702] Call Trace: [ 373.025700][T13702] [ 373.025710][T13702] dump_stack_lvl+0x189/0x250 [ 373.025746][T13702] ? __pfx_dump_stack_lvl+0x10/0x10 [ 373.025773][T13702] ? __pfx__printk+0x10/0x10 [ 373.025809][T13702] ? kernfs_path_from_node+0x2f/0x290 [ 373.025834][T13702] ? kernfs_path_from_node+0x250/0x290 [ 373.025854][T13702] ? kernfs_path_from_node+0x2f/0x290 [ 373.025882][T13702] sysfs_warn_dup+0x8e/0xa0 [ 373.025905][T13702] sysfs_do_create_link_sd+0xc0/0x110 [ 373.025932][T13702] device_add_class_symlinks+0x1cf/0x240 [ 373.025987][T13702] device_add+0x475/0xb50 [ 373.026023][T13702] wiphy_register+0x1ba6/0x28d0 [ 373.026072][T13702] ? __pfx_wiphy_register+0x10/0x10 [ 373.026097][T13702] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 373.026138][T13702] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 373.026176][T13702] ieee80211_register_hw+0x3425/0x4080 [ 373.026230][T13702] ? ieee80211_register_hw+0x1431/0x4080 [ 373.026279][T13702] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 373.026325][T13702] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 373.026359][T13702] ? __hrtimer_setup+0x187/0x210 [ 373.026379][T13702] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 373.026409][T13702] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 373.026482][T13702] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 373.026529][T13702] ? trace_kmalloc+0x1f/0xd0 [ 373.026553][T13702] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 373.026582][T13702] ? kstrndup+0xbf/0x160 [ 373.026618][T13702] hwsim_new_radio_nl+0xea4/0x1b10 [ 373.026645][T13702] ? __pfx___nla_validate_parse+0x10/0x10 [ 373.026692][T13702] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 373.026732][T13702] ? __nla_parse+0x40/0x60 [ 373.026764][T13702] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 373.026797][T13702] genl_family_rcv_msg_doit+0x215/0x300 [ 373.026828][T13702] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 373.026868][T13702] ? bpf_lsm_capable+0x9/0x20 [ 373.026895][T13702] ? security_capable+0x7e/0x2e0 [ 373.026931][T13702] genl_rcv_msg+0x60e/0x790 [ 373.026970][T13702] ? __pfx_genl_rcv_msg+0x10/0x10 [ 373.026990][T13702] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 373.027032][T13702] netlink_rcv_skb+0x208/0x470 [ 373.027057][T13702] ? __lock_acquire+0xab9/0xd20 [ 373.027087][T13702] ? __pfx_genl_rcv_msg+0x10/0x10 [ 373.027110][T13702] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 373.027164][T13702] ? down_read+0x1ad/0x2e0 [ 373.027197][T13702] genl_rcv+0x28/0x40 [ 373.027234][T13702] netlink_unicast+0x82c/0x9e0 [ 373.027270][T13702] ? __pfx_netlink_unicast+0x10/0x10 [ 373.027297][T13702] ? netlink_sendmsg+0x642/0xb30 [ 373.027322][T13702] ? skb_put+0x11b/0x210 [ 373.027357][T13702] netlink_sendmsg+0x805/0xb30 [ 373.027398][T13702] ? __pfx_netlink_sendmsg+0x10/0x10 [ 373.027431][T13702] ? aa_sock_msg_perm+0xf1/0x1d0 [ 373.027464][T13702] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 373.027494][T13702] ? __pfx_netlink_sendmsg+0x10/0x10 [ 373.027523][T13702] __sock_sendmsg+0x21c/0x270 [ 373.027551][T13702] ____sys_sendmsg+0x505/0x830 [ 373.027590][T13702] ? __pfx_____sys_sendmsg+0x10/0x10 [ 373.027634][T13702] ? import_iovec+0x74/0xa0 [ 373.027660][T13702] ___sys_sendmsg+0x21f/0x2a0 [ 373.027695][T13702] ? __pfx____sys_sendmsg+0x10/0x10 [ 373.027774][T13702] ? __fget_files+0x2a/0x420 [ 373.027804][T13702] ? __fget_files+0x3a0/0x420 [ 373.027849][T13702] __x64_sys_sendmsg+0x19b/0x260 [ 373.027885][T13702] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 373.027930][T13702] ? rcu_is_watching+0x15/0xb0 [ 373.027966][T13702] ? do_syscall_64+0xbe/0x3b0 [ 373.027999][T13702] do_syscall_64+0xfa/0x3b0 [ 373.028023][T13702] ? lockdep_hardirqs_on+0x9c/0x150 [ 373.028048][T13702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.028069][T13702] ? clear_bhb_loop+0x60/0xb0 [ 373.028095][T13702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.028115][T13702] RIP: 0033:0x7f8ce358ebe9 [ 373.028136][T13702] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 373.028154][T13702] RSP: 002b:00007f8ce17f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 373.028178][T13702] RAX: ffffffffffffffda RBX: 00007f8ce37b5fa0 RCX: 00007f8ce358ebe9 [ 373.028193][T13702] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000006 [ 373.028204][T13702] RBP: 00007f8ce3611e19 R08: 0000000000000000 R09: 0000000000000000 [ 373.028217][T13702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 373.028230][T13702] R13: 00007f8ce37b6038 R14: 00007f8ce37b5fa0 R15: 00007ffed118b2d8 [ 373.028267][T13702] [ 373.561959][T13706] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2575'. [ 373.760120][T13716] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 373.840478][T13690] lo speed is unknown, defaulting to 1000 [ 373.847566][T13722] siw: device registration error -23 [ 374.256915][T13739] sctp: [Deprecated]: syz.0.2588 (pid 13739) Use of struct sctp_assoc_value in delayed_ack socket option. [ 374.256915][T13739] Use struct sctp_sack_info instead [ 374.334286][T13745] netlink: 'syz.4.2589': attribute type 10 has an invalid length. [ 374.359586][T13745] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2589'. [ 374.698205][T13755] netlink: 84 bytes leftover after parsing attributes in process `syz.0.2595'. [ 374.900640][T13761] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2598'. [ 374.927972][ T96] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 180 seconds [ 374.941059][ T96] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 180 seconds [ 374.953437][ T96] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 180 seconds [ 374.965392][ T96] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 180 seconds [ 375.142437][T13769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2602'. [ 375.398559][T13780] netlink: 'syz.0.2605': attribute type 4 has an invalid length. [ 375.399170][T13779] netlink: 'syz.3.2606': attribute type 10 has an invalid length. [ 375.436438][T13779] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2606'. [ 375.469991][T13782] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2607'. [ 375.987303][T13795] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2611'. [ 376.089602][T13795] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2611'. [ 376.301930][T13803] netlink: 'syz.4.2614': attribute type 10 has an invalid length. [ 376.317452][T13803] veth0_vlan: left promiscuous mode [ 376.326286][T13803] veth0_vlan: entered promiscuous mode [ 376.339325][T13803] team0: Device veth0_vlan failed to register rx_handler [ 376.541745][T13816] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 377.119931][T13850] IPVS: set_ctl: invalid protocol: 59 0.0.0.0:20003 [ 377.465157][T13858] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 377.616107][ T5858] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 377.673093][T13872] vlan2: entered promiscuous mode [ 377.679754][T13872] bridge0: entered promiscuous mode [ 377.685750][T13872] vlan2: entered allmulticast mode [ 377.691164][T13872] bridge0: entered allmulticast mode [ 378.061647][T13889] __nla_validate_parse: 2 callbacks suppressed [ 378.061670][T13889] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2645'. [ 378.189848][T13895] netlink: 'syz.1.2647': attribute type 13 has an invalid length. [ 378.225119][T13897] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2648'. [ 378.501333][T13903] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 378.718073][T13914] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2653'. [ 378.760802][ T1306] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 378.779899][T13912] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2651'. [ 378.859286][T13921] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2655'. [ 378.872638][T13924] sctp: [Deprecated]: syz.1.2657 (pid 13924) Use of struct sctp_assoc_value in delayed_ack socket option. [ 378.872638][T13924] Use struct sctp_sack_info instead [ 378.919709][T13924] sctp: [Deprecated]: syz.1.2657 (pid 13924) Use of struct sctp_assoc_value in delayed_ack socket option. [ 378.919709][T13924] Use struct sctp_sack_info instead [ 379.260189][T13940] batadv_slave_0: entered promiscuous mode [ 379.376551][T13939] batadv_slave_0: left promiscuous mode [ 379.385309][T13942] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2663'. [ 379.501406][T13944] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 379.705916][T13956] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2668'. [ 380.220884][T13977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2673'. [ 380.241934][T13977] openvswitch: netlink: nsh attr 0 has unexpected len 7 expected 0 [ 380.254956][T13977] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 380.298194][T13981] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 380.338089][T13981] netlink: 'syz.2.2671': attribute type 17 has an invalid length. [ 380.499376][T13981] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2671'. [ 380.512757][T13981] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 380.570646][ T6730] lo speed is unknown, defaulting to 1000 [ 380.578404][T13979] lo speed is unknown, defaulting to 1000 [ 380.582170][ T6730] syz1: Port: 1 Link ACTIVE [ 380.765398][T13992] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2676'. [ 380.776352][T13992] IPVS: length: 148 != 24 [ 381.132969][T13979] lo speed is unknown, defaulting to 1000 [ 381.317650][T14003] netlink: 'syz.1.2680': attribute type 13 has an invalid length. [ 383.182997][T14055] netlink: 'syz.2.2697': attribute type 13 has an invalid length. [ 383.337629][T14060] __nla_validate_parse: 3 callbacks suppressed [ 383.337651][T14060] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2699'. [ 383.384763][ T6730] lo speed is unknown, defaulting to 1000 [ 383.414965][ T6730] syz1: Port: 1 Link DOWN [ 383.736375][T14072] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2705'. [ 383.870494][T14080] netlink: 'syz.1.2707': attribute type 10 has an invalid length. [ 383.879454][T14078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2708'. [ 384.417697][ T5872] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 384.428370][ T5872] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 384.438887][ T5872] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 384.447894][ T5872] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 384.457290][ T5872] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 384.531414][T14100] tipc: Started in network mode [ 384.541441][T14100] tipc: Node identity 1e78fbee4ade, cluster identity 4711 [ 384.549704][T14100] tipc: Enabled bearer , priority 0 [ 384.598271][T14104] netlink: 'syz.0.2718': attribute type 1 has an invalid length. [ 384.642655][T14100] syzkaller0: entered promiscuous mode [ 384.650694][T14100] syzkaller0: entered allmulticast mode [ 384.684969][T14094] lo speed is unknown, defaulting to 1000 [ 384.705777][T14102] sch_tbf: burst 151 is lower than device syzkaller0 mtu (1514) ! [ 384.737728][T14100] tipc: Resetting bearer [ 384.809744][T14098] tipc: Resetting bearer [ 384.829666][T14116] FAULT_INJECTION: forcing a failure. [ 384.829666][T14116] name failslab, interval 1, probability 0, space 0, times 0 [ 384.851063][T14116] CPU: 1 UID: 0 PID: 14116 Comm: syz.1.2722 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 384.851093][T14116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 384.851105][T14116] Call Trace: [ 384.851112][T14116] [ 384.851120][T14116] dump_stack_lvl+0x189/0x250 [ 384.851148][T14116] ? __pfx____ratelimit+0x10/0x10 [ 384.851172][T14116] ? __pfx_dump_stack_lvl+0x10/0x10 [ 384.851194][T14116] ? __pfx__printk+0x10/0x10 [ 384.851227][T14116] ? __pfx___might_resched+0x10/0x10 [ 384.851250][T14116] should_fail_ex+0x414/0x560 [ 384.851277][T14116] should_failslab+0xa8/0x100 [ 384.851305][T14116] __kmalloc_node_noprof+0xd1/0x4e0 [ 384.851329][T14116] ? crypto_create_tfm_node+0x83/0x3f0 [ 384.851357][T14116] crypto_create_tfm_node+0x83/0x3f0 [ 384.851386][T14116] crypto_ahash_init_tfm+0x162/0x770 [ 384.851406][T14116] ? __kmalloc_node_noprof+0x293/0x4e0 [ 384.851438][T14116] crypto_create_tfm_node+0x189/0x3f0 [ 384.851467][T14116] crypto_spawn_tfm2+0x5c/0x90 [ 384.851494][T14116] crypto_authenc_init_tfm+0x47/0x1c0 [ 384.851526][T14116] crypto_create_tfm_node+0x189/0x3f0 [ 384.851554][T14116] crypto_spawn_tfm2+0x5c/0x90 [ 384.851581][T14116] aead_init_geniv+0x169/0x240 [ 384.851608][T14116] crypto_create_tfm_node+0x189/0x3f0 [ 384.851636][T14116] crypto_alloc_tfm_node+0x172/0x3f0 [ 384.851683][T14116] esp_init_state+0x5b6/0x1140 [ 384.851708][T14116] ? pfkey_sendmsg+0xbfb/0x1090 [ 384.851730][T14116] ? __sock_sendmsg+0x21c/0x270 [ 384.851752][T14116] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.851780][T14116] ? __pfx_esp_init_state+0x10/0x10 [ 384.851829][T14116] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 384.851864][T14116] ? __xfrm_init_state+0x7ef/0x13f0 [ 384.851889][T14116] __xfrm_init_state+0xa73/0x13f0 [ 384.851905][T14116] ? __xfrm_init_state+0x7ef/0x13f0 [ 384.851938][T14116] xfrm_init_state+0x18/0xa0 [ 384.851964][T14116] pfkey_add+0x1d38/0x2e00 [ 384.852012][T14116] ? __pfx_pfkey_add+0x10/0x10 [ 384.852033][T14116] ? kmem_cache_free+0x18f/0x400 [ 384.852074][T14116] pfkey_sendmsg+0xbfb/0x1090 [ 384.852117][T14116] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 384.852173][T14116] ? aa_sock_msg_perm+0xf1/0x1d0 [ 384.852201][T14116] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 384.852220][T14116] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 384.852244][T14116] __sock_sendmsg+0x21c/0x270 [ 384.852270][T14116] ____sys_sendmsg+0x505/0x830 [ 384.852304][T14116] ? __pfx_____sys_sendmsg+0x10/0x10 [ 384.852342][T14116] ? import_iovec+0x74/0xa0 [ 384.852365][T14116] ___sys_sendmsg+0x21f/0x2a0 [ 384.852395][T14116] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.852468][T14116] ? __fget_files+0x2a/0x420 [ 384.852494][T14116] ? __fget_files+0x3a0/0x420 [ 384.852534][T14116] __x64_sys_sendmsg+0x19b/0x260 [ 384.852564][T14116] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 384.852603][T14116] ? __pfx_ksys_write+0x10/0x10 [ 384.852624][T14116] ? rcu_is_watching+0x15/0xb0 [ 384.852649][T14116] ? do_syscall_64+0xbe/0x3b0 [ 384.852678][T14116] do_syscall_64+0xfa/0x3b0 [ 384.852700][T14116] ? lockdep_hardirqs_on+0x9c/0x150 [ 384.852720][T14116] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.852739][T14116] ? clear_bhb_loop+0x60/0xb0 [ 384.852763][T14116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.852780][T14116] RIP: 0033:0x7f8ce358ebe9 [ 384.852799][T14116] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 384.852816][T14116] RSP: 002b:00007f8ce17f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 384.852838][T14116] RAX: ffffffffffffffda RBX: 00007f8ce37b5fa0 RCX: 00007f8ce358ebe9 [ 384.852852][T14116] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 384.852865][T14116] RBP: 00007f8ce17f6090 R08: 0000000000000000 R09: 0000000000000000 [ 384.852876][T14116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 384.852888][T14116] R13: 00007f8ce37b6038 R14: 00007f8ce37b5fa0 R15: 00007ffed118b2d8 [ 384.852922][T14116] [ 385.287898][T14098] tipc: Disabling bearer [ 385.490879][T14094] lo speed is unknown, defaulting to 1000 [ 385.740037][T14138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2728'. [ 385.901432][T14094] chnl_net:caif_netlink_parms(): no params data found [ 385.994456][T14094] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.001752][T14094] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.009377][T14094] bridge_slave_0: entered allmulticast mode [ 386.018708][T14094] bridge_slave_0: entered promiscuous mode [ 386.026823][T14094] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.035349][T14094] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.042658][T14094] bridge_slave_1: entered allmulticast mode [ 386.050124][T14094] bridge_slave_1: entered promiscuous mode [ 386.089427][T14094] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 386.102686][T14094] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 386.142508][T14094] team0: Port device team_slave_0 added [ 386.151369][T14094] team0: Port device team_slave_1 added [ 386.185640][T14094] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 386.192624][T14094] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 386.219084][T14094] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 386.231209][T14094] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 386.238488][T14094] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 386.265199][T14094] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 386.318405][T14094] hsr_slave_0: entered promiscuous mode [ 386.326209][T14094] hsr_slave_1: entered promiscuous mode [ 386.332370][T14094] debugfs: 'hsr0' already exists in 'hsr' [ 386.338165][T14094] Cannot create hsr debugfs directory [ 386.515105][ T5872] Bluetooth: hci3: command tx timeout [ 386.768012][T14094] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 386.781408][T14094] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 386.791418][T14094] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 386.801931][T14094] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 386.888764][T14094] 8021q: adding VLAN 0 to HW filter on device bond0 [ 386.916436][T14094] 8021q: adding VLAN 0 to HW filter on device team0 [ 386.934915][ T1109] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.942114][ T1109] bridge0: port 1(bridge_slave_0) entered forwarding state [ 386.960764][ T1109] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.967972][ T1109] bridge0: port 2(bridge_slave_1) entered forwarding state [ 387.183723][T14094] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 387.431716][T14094] veth0_vlan: entered promiscuous mode [ 387.446355][T14094] veth1_vlan: entered promiscuous mode [ 387.478430][T14094] veth0_macvtap: entered promiscuous mode [ 387.490561][T14094] veth1_macvtap: entered promiscuous mode [ 387.512017][T14094] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 387.527816][T14094] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 387.547660][ T1150] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.557665][ T1150] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.572631][ T1150] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.581773][ T1150] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.653210][ T1015] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.668998][ T1015] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.695693][ T3515] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.706703][ T3515] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 388.594187][ T5872] Bluetooth: hci3: command tx timeout [ 390.674793][ T5872] Bluetooth: hci3: command tx timeout [ 392.754754][ T5872] Bluetooth: hci3: command tx timeout [ 404.998083][ T96] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 210 seconds [ 405.008926][ T96] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 210 seconds [ 405.020038][ T96] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 210 seconds [ 405.031508][ T96] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 210 seconds [ 435.080841][ T96] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 240 seconds [ 435.091684][ T96] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 240 seconds [ 435.102967][ T96] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 240 seconds [ 435.114462][ T96] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 240 seconds [ 440.196291][ T1306] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 465.154319][ T55] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 270 seconds [ 465.166616][ T55] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 270 seconds [ 465.177851][ T55] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 270 seconds [ 465.189094][ T55] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 270 seconds [ 495.234570][ T55] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 300 seconds [ 495.245710][ T55] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 300 seconds [ 495.257297][ T55] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 300 seconds [ 495.268436][ T55] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 300 seconds [ 501.637715][ T1306] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 508.834801][ T5873] Bluetooth: hci3: command 0x0406 tx timeout [ 511.310022][ T1150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 511.329996][ T1150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 511.703092][T14188] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 512.007203][T14193] tipc: Started in network mode [ 512.017715][T14193] tipc: Node identity 16a0c23d0cdc, cluster identity 4711 [ 512.125964][T14193] tipc: Enabled bearer , priority 0 [ 512.245253][T14195] syzkaller0: entered promiscuous mode [ 512.257203][T14195] syzkaller0: entered allmulticast mode [ 512.393493][T14193] tipc: Resetting bearer [ 512.545209][T14191] tipc: Resetting bearer [ 512.664393][T14191] tipc: Disabling bearer [ 513.054557][T14203] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (65535) [ 513.074674][T14203] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023 [ 513.104675][T14205] netlink: 'syz.0.2742': attribute type 10 has an invalid length. [ 513.151569][T14205] veth0_vlan: left promiscuous mode [ 513.185536][T14205] veth0_vlan: entered promiscuous mode [ 513.208524][T14205] team0: Device veth0_vlan failed to register rx_handler [ 513.545906][T14215] 8021q: adding VLAN 0 to HW filter on device bond14 [ 513.581257][T14212] lo speed is unknown, defaulting to 1000 [ 514.050641][T14227] netlink: 'syz.4.2747': attribute type 10 has an invalid length. [ 514.127989][T14227] team0: Device veth0_vlan is up. Set it down before adding it as a team port [ 514.424220][T14234] netlink: 'syz.4.2749': attribute type 1 has an invalid length. [ 514.487031][T14212] lo speed is unknown, defaulting to 1000 [ 514.502741][T14236] netlink: 3 bytes leftover after parsing attributes in process `syz.4.2749'. [ 514.643466][T14236] batadv1: entered promiscuous mode [ 514.649205][T14236] batadv1: entered allmulticast mode [ 514.676434][T14214] lo speed is unknown, defaulting to 1000 [ 518.075197][T14181] Set syz1 is full, maxelem 65536 reached [ 518.499701][T14248] lo speed is unknown, defaulting to 1000 [ 518.586768][T14248] lo speed is unknown, defaulting to 1000 [ 518.651051][T14248] lo speed is unknown, defaulting to 1000 [ 518.652342][T14254] netlink: 'syz.1.2755': attribute type 10 has an invalid length. [ 518.740896][T14248] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 518.900236][T14266] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2760'. [ 518.900393][T14264] syz.2.2759 uses old SIOCAX25GETINFO [ 518.923614][T14248] lo speed is unknown, defaulting to 1000 [ 519.040381][T14268] nbd: must specify at least one socket [ 519.052121][T14268] netlink: 324 bytes leftover after parsing attributes in process `syz.0.2761'. [ 519.085034][T14268] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2761'. [ 519.099441][T14268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2761'. [ 519.124115][T14248] lo speed is unknown, defaulting to 1000 [ 519.132932][T14248] lo speed is unknown, defaulting to 1000 [ 519.157519][T14268] netlink: 9896 bytes leftover after parsing attributes in process `syz.0.2761'. [ 519.183561][T14268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2761'. [ 519.192750][T14268] netlink: 84 bytes leftover after parsing attributes in process `syz.0.2761'. [ 519.220964][T14248] lo speed is unknown, defaulting to 1000 [ 519.235051][T14248] lo speed is unknown, defaulting to 1000 [ 519.243701][T14279] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2765'. [ 519.245579][T14248] lo speed is unknown, defaulting to 1000 [ 519.262246][T14248] lo speed is unknown, defaulting to 1000 [ 519.689144][T14288] lo speed is unknown, defaulting to 1000 [ 520.346455][T14328] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2780'. [ 520.403261][T14328] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2780'. [ 520.448789][T14288] lo speed is unknown, defaulting to 1000 [ 520.786115][T14344] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2786'. [ 520.958292][T14355] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2790'. [ 521.155825][T14362] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2792'. [ 521.185982][T14364] tipc: Enabled bearer , priority 0 [ 521.232951][T14364] syzkaller0: entered promiscuous mode [ 521.267611][T14364] syzkaller0: entered allmulticast mode [ 521.320898][T14368] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 521.352362][T14363] tipc: Resetting bearer [ 521.410096][T14363] tipc: Disabling bearer [ 521.643326][T14383] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2798'. [ 521.693632][T14383] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2798'. [ 521.834903][T14387] 8021q: VLANs not supported on ip6_vti0 [ 521.871799][T14396] FAULT_INJECTION: forcing a failure. [ 521.871799][T14396] name failslab, interval 1, probability 0, space 0, times 0 [ 521.893300][T14396] CPU: 0 UID: 0 PID: 14396 Comm: syz.4.2804 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 521.893332][T14396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 521.893345][T14396] Call Trace: [ 521.893353][T14396] [ 521.893363][T14396] dump_stack_lvl+0x189/0x250 [ 521.893396][T14396] ? __pfx____ratelimit+0x10/0x10 [ 521.893423][T14396] ? __pfx_dump_stack_lvl+0x10/0x10 [ 521.893457][T14396] ? __pfx__printk+0x10/0x10 [ 521.893490][T14396] ? __pfx___might_resched+0x10/0x10 [ 521.893511][T14396] ? fs_reclaim_acquire+0x7d/0x100 [ 521.893547][T14396] should_fail_ex+0x414/0x560 [ 521.893578][T14396] should_failslab+0xa8/0x100 [ 521.893610][T14396] __kmalloc_noprof+0xcb/0x4f0 [ 521.893637][T14396] ? iovec_from_user+0x87/0x250 [ 521.893663][T14396] iovec_from_user+0x87/0x250 [ 521.893689][T14396] __import_iovec+0x163/0x7f0 [ 521.893723][T14396] import_iovec+0x74/0xa0 [ 521.893749][T14396] ___sys_recvmsg+0x43a/0x510 [ 521.893788][T14396] ? __pfx____sys_recvmsg+0x10/0x10 [ 521.893850][T14396] ? __fget_files+0x3a0/0x420 [ 521.893897][T14396] do_recvmmsg+0x307/0x770 [ 521.893937][T14396] ? __pfx_do_recvmmsg+0x10/0x10 [ 521.893980][T14396] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 521.894026][T14396] __x64_sys_recvmmsg+0x190/0x240 [ 521.894059][T14396] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 521.894087][T14396] ? rcu_is_watching+0x15/0xb0 [ 521.894112][T14396] ? do_syscall_64+0xbe/0x3b0 [ 521.894142][T14396] do_syscall_64+0xfa/0x3b0 [ 521.894165][T14396] ? lockdep_hardirqs_on+0x9c/0x150 [ 521.894187][T14396] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.894206][T14396] ? clear_bhb_loop+0x60/0xb0 [ 521.894230][T14396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.894249][T14396] RIP: 0033:0x7f3ff4f8ebe9 [ 521.894268][T14396] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 521.894285][T14396] RSP: 002b:00007f3ff5e25038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 521.894308][T14396] RAX: ffffffffffffffda RBX: 00007f3ff51b5fa0 RCX: 00007f3ff4f8ebe9 [ 521.894322][T14396] RDX: 0000000000000001 RSI: 00002000000037c0 RDI: 0000000000000003 [ 521.894335][T14396] RBP: 00007f3ff5e25090 R08: 0000000000000000 R09: 0000000000000000 [ 521.894348][T14396] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 521.894360][T14396] R13: 00007f3ff51b6038 R14: 00007f3ff51b5fa0 R15: 00007ffc91289148 [ 521.894394][T14396] [ 522.190889][T14398] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2805'. [ 522.471615][T14413] siw: device registration error -23 [ 522.495173][T14415] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2810'. [ 523.181413][T14444] syzkaller0: entered promiscuous mode [ 523.188086][T14444] syzkaller0: entered allmulticast mode [ 523.281541][T14449] netlink: 'syz.1.2823': attribute type 9 has an invalid length. [ 523.319722][T14453] siw: device registration error -23 [ 523.503352][T14455] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2827'. [ 523.613822][T14461] tipc: Enabled bearer , priority 0 [ 523.628893][T14461] syzkaller0: entered promiscuous mode [ 523.653819][T14465] FAULT_INJECTION: forcing a failure. [ 523.653819][T14465] name failslab, interval 1, probability 0, space 0, times 0 [ 523.674351][T14461] syzkaller0: entered allmulticast mode [ 523.684099][T14465] CPU: 1 UID: 0 PID: 14465 Comm: syz.0.2832 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 523.684130][T14465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 523.684142][T14465] Call Trace: [ 523.684150][T14465] [ 523.684159][T14465] dump_stack_lvl+0x189/0x250 [ 523.684196][T14465] ? __pfx____ratelimit+0x10/0x10 [ 523.684223][T14465] ? __pfx_dump_stack_lvl+0x10/0x10 [ 523.684245][T14465] ? __pfx__printk+0x10/0x10 [ 523.684276][T14465] ? __pfx___might_resched+0x10/0x10 [ 523.684295][T14465] ? fs_reclaim_acquire+0x7d/0x100 [ 523.684331][T14465] should_fail_ex+0x414/0x560 [ 523.684361][T14465] should_failslab+0xa8/0x100 [ 523.684392][T14465] __kmalloc_node_noprof+0xd1/0x4e0 [ 523.684416][T14465] ? __pfx___up_read+0x10/0x10 [ 523.684435][T14465] ? crypto_create_tfm_node+0x83/0x3f0 [ 523.684466][T14465] crypto_create_tfm_node+0x83/0x3f0 [ 523.684497][T14465] crypto_spawn_tfm2+0x5c/0x90 [ 523.684527][T14465] crypto_authenc_init_tfm+0x47/0x1c0 [ 523.684561][T14465] crypto_create_tfm_node+0x189/0x3f0 [ 523.684591][T14465] crypto_spawn_tfm2+0x5c/0x90 [ 523.684621][T14465] aead_init_geniv+0x169/0x240 [ 523.684649][T14465] crypto_create_tfm_node+0x189/0x3f0 [ 523.684679][T14465] crypto_alloc_tfm_node+0x172/0x3f0 [ 523.684717][T14465] esp_init_state+0x5b6/0x1140 [ 523.684744][T14465] ? pfkey_sendmsg+0xbfb/0x1090 [ 523.684768][T14465] ? __sock_sendmsg+0x21c/0x270 [ 523.684792][T14465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.684822][T14465] ? __pfx_esp_init_state+0x10/0x10 [ 523.684875][T14465] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 523.684913][T14465] ? __xfrm_init_state+0x7ef/0x13f0 [ 523.684939][T14465] __xfrm_init_state+0xa73/0x13f0 [ 523.684957][T14465] ? __xfrm_init_state+0x7ef/0x13f0 [ 523.684983][T14465] xfrm_init_state+0x18/0xa0 [ 523.685011][T14465] pfkey_add+0x1d38/0x2e00 [ 523.685061][T14465] ? __pfx_pfkey_add+0x10/0x10 [ 523.685083][T14465] ? kmem_cache_free+0x18f/0x400 [ 523.685124][T14465] pfkey_sendmsg+0xbfb/0x1090 [ 523.685168][T14465] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 523.685233][T14465] ? aa_sock_msg_perm+0xf1/0x1d0 [ 523.685263][T14465] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 523.685283][T14465] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 523.685311][T14465] __sock_sendmsg+0x21c/0x270 [ 523.685337][T14465] ____sys_sendmsg+0x505/0x830 [ 523.685374][T14465] ? __pfx_____sys_sendmsg+0x10/0x10 [ 523.685415][T14465] ? import_iovec+0x74/0xa0 [ 523.685437][T14465] ___sys_sendmsg+0x21f/0x2a0 [ 523.685468][T14465] ? __pfx____sys_sendmsg+0x10/0x10 [ 523.685541][T14465] ? __fget_files+0x2a/0x420 [ 523.685568][T14465] ? __fget_files+0x3a0/0x420 [ 523.685609][T14465] __x64_sys_sendmsg+0x19b/0x260 [ 523.685642][T14465] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 523.685682][T14465] ? __pfx_ksys_write+0x10/0x10 [ 523.685715][T14465] ? do_syscall_64+0xbe/0x3b0 [ 523.685745][T14465] do_syscall_64+0xfa/0x3b0 [ 523.685768][T14465] ? lockdep_hardirqs_on+0x9c/0x150 [ 523.685790][T14465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.685809][T14465] ? clear_bhb_loop+0x60/0xb0 [ 523.685834][T14465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.685852][T14465] RIP: 0033:0x7f76f398ebe9 [ 523.685872][T14465] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 523.685890][T14465] RSP: 002b:00007f76f481d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 523.685912][T14465] RAX: ffffffffffffffda RBX: 00007f76f3bb5fa0 RCX: 00007f76f398ebe9 [ 523.685927][T14465] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 523.685940][T14465] RBP: 00007f76f481d090 R08: 0000000000000000 R09: 0000000000000000 [ 523.685952][T14465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 523.685965][T14465] R13: 00007f76f3bb6038 R14: 00007f76f3bb5fa0 R15: 00007ffd04522cb8 [ 523.686000][T14465] [ 524.150157][T14472] tipc: Resetting bearer [ 524.161159][T14460] tipc: Resetting bearer [ 524.234221][T14460] tipc: Disabling bearer [ 524.279399][T14482] tipc: Enabled bearer , priority 0 [ 524.303120][T14480] syzkaller0: entered promiscuous mode [ 524.332523][T14480] syzkaller0: entered allmulticast mode [ 524.438104][T14479] tipc: Resetting bearer [ 524.506164][T14496] siw: device registration error -23 [ 524.541005][T14479] tipc: Disabling bearer [ 524.673676][T14502] netlink: 'syz.0.2845': attribute type 10 has an invalid length. [ 524.863615][T14502] bond0: (slave netdevsim0): Releasing backup interface [ 524.914888][T14514] nbd: must specify at least one socket [ 524.949946][T14516] IPVS: set_ctl: invalid protocol: 135 224.0.0.2:65535 [ 525.321189][ T55] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 330 seconds [ 525.333021][ T55] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 330 seconds [ 525.345011][ T55] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 330 seconds [ 525.359788][ T55] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 330 seconds [ 525.496173][T14539] __nla_validate_parse: 13 callbacks suppressed [ 525.496195][T14539] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2856'. [ 525.740973][T14556] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2867'. [ 525.986225][T14567] netlink: 'syz.3.2872': attribute type 4 has an invalid length. [ 526.009805][T14571] vlan2: entered promiscuous mode [ 526.016418][T14571] bridge0: entered promiscuous mode [ 526.022033][T14571] vlan2: entered allmulticast mode [ 526.027454][T14571] bridge0: entered allmulticast mode [ 526.113807][T14577] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2876'. [ 526.278295][T14584] netlink: 'syz.3.2877': attribute type 13 has an invalid length. [ 526.413703][T14594] siw: device registration error -23 [ 526.729099][T14585] lo speed is unknown, defaulting to 1000 [ 526.770966][T14606] pim6reg: entered allmulticast mode [ 526.965994][T14614] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2886'. [ 527.120634][T14619] netlink: 'syz.0.2888': attribute type 4 has an invalid length. [ 527.175128][T14590] lo speed is unknown, defaulting to 1000 [ 527.186556][T14585] lo speed is unknown, defaulting to 1000 [ 527.218579][T14625] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2890'. [ 527.429305][T14633] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2893'. [ 527.767821][T14642] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (65535) [ 527.819043][T14642] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023 [ 527.972837][T14658] netlink: 'syz.2.2901': attribute type 10 has an invalid length. [ 527.988260][T14658] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2901'. [ 528.090008][T14661] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2902'. [ 528.101388][T14661] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2902'. [ 528.105158][T14590] lo speed is unknown, defaulting to 1000 [ 528.915969][T14671] netlink: 'syz.0.2905': attribute type 4 has an invalid length. [ 529.332741][ T5873] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 529.344088][ T5873] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 529.354872][ T5873] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 529.371019][ T5873] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 529.380941][ T5873] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 529.397104][T14681] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2908'. [ 529.645576][T14685] lo speed is unknown, defaulting to 1000 [ 530.055191][T14699] netlink: 'syz.4.2913': attribute type 10 has an invalid length. [ 530.097679][T14699] team0: Port device geneve0 added [ 530.171593][T14685] lo speed is unknown, defaulting to 1000 [ 530.178640][T14692] siw: device registration error -23 [ 530.379025][T14702] netlink: 'syz.3.2914': attribute type 13 has an invalid length. [ 530.683393][T14716] netlink: 'syz.1.2918': attribute type 4 has an invalid length. [ 530.779015][T14685] chnl_net:caif_netlink_parms(): no params data found [ 530.845855][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 530.921715][ T9652] lo speed is unknown, defaulting to 1000 [ 531.056873][T14730] lo speed is unknown, defaulting to 1000 [ 531.170111][T14685] bridge0: port 1(bridge_slave_0) entered blocking state [ 531.178393][T14685] bridge0: port 1(bridge_slave_0) entered disabled state [ 531.186575][T14685] bridge_slave_0: entered allmulticast mode [ 531.196434][T14685] bridge_slave_0: entered promiscuous mode [ 531.208089][T14685] bridge0: port 2(bridge_slave_1) entered blocking state [ 531.215403][T14685] bridge0: port 2(bridge_slave_1) entered disabled state [ 531.222702][T14685] bridge_slave_1: entered allmulticast mode [ 531.242122][T14685] bridge_slave_1: entered promiscuous mode [ 531.304304][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 531.330365][T14741] netlink: 'syz.4.2926': attribute type 10 has an invalid length. [ 531.364576][T14741] __nla_validate_parse: 1 callbacks suppressed [ 531.364596][T14741] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2926'. [ 531.474057][ T5872] Bluetooth: hci4: command tx timeout [ 531.571162][T14739] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2924'. [ 531.597637][T14725] lo speed is unknown, defaulting to 1000 [ 531.627672][T14730] lo speed is unknown, defaulting to 1000 [ 531.637517][T14685] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 531.705292][T14752] netlink: 'syz.4.2929': attribute type 13 has an invalid length. [ 531.761295][T14685] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 532.091087][T14752] bridge0: port 2(bridge_slave_1) entered disabled state [ 532.098645][T14752] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.210812][T14752] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 532.227301][T14752] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 532.439080][T14758] netlink: 'syz.0.2931': attribute type 4 has an invalid length. [ 532.447078][ T10] lo speed is unknown, defaulting to 1000 [ 532.459776][ T10] syz1: Port: 1 Link DOWN [ 532.494764][T14725] lo speed is unknown, defaulting to 1000 [ 532.522068][ T49] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.537481][ T49] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.562416][T14685] team0: Port device team_slave_0 added [ 532.607516][ T49] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.683262][T14685] team0: Port device team_slave_1 added [ 532.712307][ T49] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.870744][T14685] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 532.894090][T14685] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 532.906056][T14780] netlink: 'syz.4.2938': attribute type 10 has an invalid length. [ 532.921916][T14685] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 532.948184][T14780] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2938'. [ 532.967539][T14685] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 532.986199][T14685] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 533.090060][T14685] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 533.216362][T14784] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2939'. [ 533.357730][T14685] hsr_slave_0: entered promiscuous mode [ 533.380509][T14685] hsr_slave_1: entered promiscuous mode [ 533.387711][T14685] debugfs: 'hsr0' already exists in 'hsr' [ 533.393573][T14685] Cannot create hsr debugfs directory [ 533.491036][T14791] netlink: 'syz.4.2942': attribute type 13 has an invalid length. [ 533.556049][ T5872] Bluetooth: hci4: command tx timeout [ 533.736186][T14796] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 533.809085][T14798] netlink: 'syz.4.2945': attribute type 4 has an invalid length. [ 534.133836][T14810] netlink: 'syz.4.2949': attribute type 10 has an invalid length. [ 534.151401][T14810] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2949'. [ 534.163003][T14812] siw: device registration error -23 [ 534.507114][T14685] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 534.529258][T14685] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 534.549447][T14823] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 534.598573][T14685] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 534.619362][T14685] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 534.801433][T14685] 8021q: adding VLAN 0 to HW filter on device bond0 [ 534.899636][T14685] 8021q: adding VLAN 0 to HW filter on device team0 [ 534.915550][T14843] lo speed is unknown, defaulting to 1000 [ 534.939357][ T1150] bridge0: port 1(bridge_slave_0) entered blocking state [ 534.946611][ T1150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 535.108420][ T1150] bridge0: port 2(bridge_slave_1) entered blocking state [ 535.115730][ T1150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 535.165624][T14851] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2960'. [ 535.507458][T14862] validate_nla: 2 callbacks suppressed [ 535.507479][T14862] netlink: 'syz.3.2965': attribute type 10 has an invalid length. [ 535.549629][T14845] lo speed is unknown, defaulting to 1000 [ 535.551402][T14862] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2965'. [ 535.558201][T14843] lo speed is unknown, defaulting to 1000 [ 535.635223][ T5872] Bluetooth: hci4: command tx timeout [ 535.920331][T14870] netlink: 'syz.0.2967': attribute type 4 has an invalid length. [ 535.957931][T14875] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 535.998192][T14876] netlink: 'syz.1.2968': attribute type 13 has an invalid length. [ 536.434896][T14845] lo speed is unknown, defaulting to 1000 [ 536.728713][T14894] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2974'. [ 536.819153][T14685] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 536.912688][T14900] siw: device registration error -23 [ 537.055305][T14685] veth0_vlan: entered promiscuous mode [ 537.116985][T14685] veth1_vlan: entered promiscuous mode [ 537.199643][T14902] netlink: 'syz.1.2978': attribute type 10 has an invalid length. [ 537.235627][T14902] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2978'. [ 537.238114][T14685] veth0_macvtap: entered promiscuous mode [ 537.312250][T14902] team0: Port device geneve0 added [ 537.340842][ T1150] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.360775][ T1150] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.379641][T14904] netlink: 'syz.3.2979': attribute type 4 has an invalid length. [ 537.396979][T14685] veth1_macvtap: entered promiscuous mode [ 537.406456][ T1150] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.451593][ T1150] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.560014][T14685] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 537.591163][T14911] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 537.659010][T14916] netlink: 'syz.1.2982': attribute type 13 has an invalid length. [ 537.681697][T14685] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 537.707040][ T49] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.716501][ T5872] Bluetooth: hci4: command tx timeout [ 537.763752][ T49] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.790638][ T49] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.833760][ T49] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.899180][ T49] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.953095][ T49] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.972281][ T49] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.993637][T14928] siw: device registration error -23 [ 538.023376][ T49] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.116745][T14930] netlink: 'syz.4.2989': attribute type 4 has an invalid length. [ 538.129111][ T1015] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 538.129332][T14933] netlink: 'syz.0.2990': attribute type 10 has an invalid length. [ 538.152170][ T1015] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 538.164824][T14933] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2990'. [ 538.258396][ T1015] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 538.300201][ T1015] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 538.334991][T14939] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2992'. [ 538.523246][T14941] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 538.593851][T14950] lo speed is unknown, defaulting to 1000 [ 538.847191][T14963] netlink: 'syz.2.2998': attribute type 13 has an invalid length. [ 539.102318][T14963] bridge0: port 2(bridge_slave_1) entered disabled state [ 539.110497][T14963] bridge0: port 1(bridge_slave_0) entered disabled state [ 539.251541][T14963] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 539.268850][T14963] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 539.437742][T14946] lo speed is unknown, defaulting to 1000 [ 539.441762][T14950] lo speed is unknown, defaulting to 1000 [ 539.506235][T14973] netlink: 'syz.1.3002': attribute type 4 has an invalid length. [ 539.578625][ T59] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.606664][ T59] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.629087][T14980] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3004'. [ 539.697173][ T59] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.714798][ T59] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.965872][T14946] lo speed is unknown, defaulting to 1000 [ 539.973255][T14966] siw: device registration error -23 [ 540.030578][T14988] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 540.052645][T14992] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3008'. [ 540.112881][T14992] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3008'. [ 540.396878][T14992] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 540.910530][T15013] validate_nla: 1 callbacks suppressed [ 540.910554][T15013] netlink: 'syz.3.3016': attribute type 13 has an invalid length. [ 541.259369][T15018] netlink: 'syz.4.3017': attribute type 10 has an invalid length. [ 541.298273][T15018] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3017'. [ 541.695695][T15024] siw: device registration error -23 [ 541.797902][ T5873] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 541.803504][T15026] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3020'. [ 541.842660][ T5873] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 541.856231][ T5873] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 541.872924][ T5873] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 541.883174][ T5873] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 541.976381][T15029] lo speed is unknown, defaulting to 1000 [ 542.168227][T15034] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 542.356654][T15029] lo speed is unknown, defaulting to 1000 [ 542.409761][T15048] netlink: 'syz.3.3028': attribute type 13 has an invalid length. [ 542.479264][T15053] netlink: 'syz.4.3030': attribute type 10 has an invalid length. [ 542.501892][T15053] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3030'. [ 542.798965][T15063] siw: device registration error -23 [ 543.057180][ T59] bond6 (unregistering): (slave gretap3): Releasing active interface [ 543.162566][ T59] team0: Port device geneve0 removed [ 543.241505][ T59] team0: Port device bridge2 removed [ 543.549901][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 543.559104][ T59] bond_slave_0: left promiscuous mode [ 543.567852][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 543.577379][ T59] bond_slave_1: left promiscuous mode [ 543.584631][ T59] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 543.593281][ T59] mac80211_hwsim hwsim11 wlan1: left promiscuous mode [ 543.601985][ T59] bond0 (unregistering): Released all slaves [ 543.621126][ T59] bond1 (unregistering): Released all slaves [ 543.640370][ T59] bond2 (unregistering): Released all slaves [ 543.661262][ T59] bond3 (unregistering): Released all slaves [ 543.682275][ T59] bond4 (unregistering): Released all slaves [ 543.697759][ T59] bond5 (unregistering): Released all slaves [ 543.823221][ T59] bond6 (unregistering): Released all slaves [ 543.839447][ T59] bond7 (unregistering): Released all slaves [ 543.853397][ T59] bond8 (unregistering): Released all slaves [ 543.870371][ T59] bond9 (unregistering): Released all slaves [ 543.893066][ T59] bond10 (unregistering): Released all slaves [ 543.908741][ T59] bond11 (unregistering): Released all slaves [ 543.926971][ T59] bond12 (unregistering): Released all slaves [ 543.950071][ T59] bond13 (unregistering): Released all slaves [ 543.967100][ T59] bond14 (unregistering): Released all slaves [ 543.983770][ T59] bond15 (unregistering): Released all slaves [ 544.033861][T15070] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3034'. [ 544.203608][T15082] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 544.328480][T15071] lo speed is unknown, defaulting to 1000 [ 544.522904][T15029] chnl_net:caif_netlink_parms(): no params data found [ 544.638753][T15097] netlink: 'syz.3.3042': attribute type 13 has an invalid length. [ 544.653628][T15096] netlink: 'syz.0.3043': attribute type 10 has an invalid length. [ 544.671315][T15096] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3043'. [ 545.049953][T15029] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.063092][T15029] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.073228][T15029] bridge_slave_0: entered allmulticast mode [ 545.082369][T15029] bridge_slave_0: entered promiscuous mode [ 545.094362][T15071] lo speed is unknown, defaulting to 1000 [ 545.123466][T15029] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.133077][T15029] bridge0: port 2(bridge_slave_1) entered disabled state [ 545.149997][T15029] bridge_slave_1: entered allmulticast mode [ 545.162860][T15029] bridge_slave_1: entered promiscuous mode [ 545.316878][T15029] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 545.331820][T15029] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 545.476772][T15117] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 545.607711][T15120] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3050'. [ 545.651068][T15029] team0: Port device team_slave_0 added [ 545.715410][T15029] team0: Port device team_slave_1 added [ 545.847127][T15029] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 545.872189][T15029] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 545.912515][T15029] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 545.934944][ T59] : left promiscuous mode [ 545.991554][T15133] netlink: 'syz.3.3054': attribute type 10 has an invalid length. [ 546.015890][T15133] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3054'. [ 546.039202][T15029] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 546.065296][T15029] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 546.107934][T15140] netlink: 'syz.4.3055': attribute type 13 has an invalid length. [ 546.150603][T15029] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 546.203196][T15144] siw: device registration error -23 [ 546.215010][ T59] tipc: Left network mode [ 546.429677][T15029] hsr_slave_0: entered promiscuous mode [ 546.450483][T15029] hsr_slave_1: entered promiscuous mode [ 546.459474][T15029] debugfs: 'hsr0' already exists in 'hsr' [ 546.465531][T15029] Cannot create hsr debugfs directory [ 546.472891][T15151] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 546.608864][T15157] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3062'. [ 546.932574][T15171] lo speed is unknown, defaulting to 1000 [ 547.114783][T15178] netlink: 'syz.3.3070': attribute type 10 has an invalid length. [ 547.130251][T15178] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3070'. [ 547.413567][T15181] netlink: 'syz.3.3071': attribute type 13 has an invalid length. [ 547.791013][T15173] lo speed is unknown, defaulting to 1000 [ 547.945040][T15194] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 548.163717][T15205] netlink: 'syz.3.3080': attribute type 10 has an invalid length. [ 548.177953][T15029] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 548.210445][T15205] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3080'. [ 548.243699][T15209] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3081'. [ 548.274438][T15029] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 548.299922][T15029] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 548.344569][T15029] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 548.388002][T15173] lo speed is unknown, defaulting to 1000 [ 548.463992][T15171] lo speed is unknown, defaulting to 1000 [ 548.714925][ T59] hsr_slave_0: left promiscuous mode [ 548.728755][ T59] hsr_slave_1: left promiscuous mode [ 548.740713][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 548.743955][T15224] netlink: 'syz.3.3085': attribute type 13 has an invalid length. [ 549.141996][ T59] team0 (unregistering): Port device team_slave_1 removed [ 549.223656][ T59] team0 (unregistering): Port device team_slave_0 removed [ 550.087635][T15029] 8021q: adding VLAN 0 to HW filter on device bond0 [ 550.140419][T15240] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 550.240275][T15246] netlink: 'syz.4.3092': attribute type 10 has an invalid length. [ 550.287122][T15246] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3092'. [ 550.412854][T15029] 8021q: adding VLAN 0 to HW filter on device team0 [ 550.517038][ T1168] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.524383][ T1168] bridge0: port 1(bridge_slave_0) entered forwarding state [ 550.586022][T15256] netlink: 'syz.4.3096': attribute type 13 has an invalid length. [ 550.610261][ T1150] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.617724][ T1150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 550.973839][T15265] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3098'. [ 551.479729][T15029] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 551.502252][T15283] netlink: 'syz.3.3105': attribute type 10 has an invalid length. [ 551.538240][T15283] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3105'. [ 551.563082][T15279] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 551.664698][T15029] veth0_vlan: entered promiscuous mode [ 551.693316][T15029] veth1_vlan: entered promiscuous mode [ 551.730077][T15292] netlink: 'syz.2.3107': attribute type 13 has an invalid length. [ 551.827445][T15296] siw: device registration error -23 [ 551.920220][T15029] veth0_macvtap: entered promiscuous mode [ 551.973187][T15029] veth1_macvtap: entered promiscuous mode [ 552.063779][T15029] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 552.118763][T15029] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 552.241494][ T49] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.273421][T15307] lo speed is unknown, defaulting to 1000 [ 552.289347][ T59] IPVS: stop unused estimator thread 0... [ 552.332608][ T49] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.416597][T15318] netlink: 'syz.0.3117': attribute type 10 has an invalid length. [ 552.429911][T15318] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3117'. [ 552.442801][ T49] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.463133][ T49] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.515102][T15312] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3115'. [ 552.739302][T15307] lo speed is unknown, defaulting to 1000 [ 552.745999][T15308] lo speed is unknown, defaulting to 1000 [ 552.783337][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 552.805447][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 552.894916][T15324] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3119'. [ 552.941755][T15322] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 553.110049][ T1109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 553.124872][ T1109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 553.352098][T15308] lo speed is unknown, defaulting to 1000 [ 553.371165][T15337] siw: device registration error -23 [ 553.372989][T15335] netlink: 'syz.1.3014': attribute type 4 has an invalid length. [ 553.398651][T15339] netlink: 'syz.4.3123': attribute type 13 has an invalid length. [ 553.746372][T15345] netlink: 'syz.4.3127': attribute type 10 has an invalid length. [ 553.811486][T15345] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3127'. [ 554.163280][T15355] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 554.509009][ T5873] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 554.526062][ T5873] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 554.535827][ T5873] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 554.549257][ T5873] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 554.598255][ T5873] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 554.647933][T15361] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3132'. [ 554.823745][T15370] siw: device registration error -23 [ 554.851358][T15363] lo speed is unknown, defaulting to 1000 [ 555.053638][T15375] netlink: 'syz.1.3137': attribute type 13 has an invalid length. [ 555.062967][T15372] netlink: 'syz.3.3136': attribute type 4 has an invalid length. [ 555.392170][T15375] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.400203][T15375] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.411533][ T55] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 360 seconds [ 555.422376][ T55] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 360 seconds [ 555.435153][ T55] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 360 seconds [ 555.446268][ T55] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 360 seconds [ 555.480358][T15389] netlink: 'syz.2.3141': attribute type 10 has an invalid length. [ 555.488591][T15389] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3141'. [ 555.566696][T15375] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 555.586772][T15375] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 555.783237][T15363] lo speed is unknown, defaulting to 1000 [ 555.798761][T15389] team0: Port device geneve0 added [ 555.833994][ T3515] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.885253][ T3515] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.941930][ T3515] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.962990][ T3515] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.002306][T15395] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 556.026637][T15401] siw: device registration error -23 [ 556.069450][ T3515] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.079235][ T3515] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.117305][ T3515] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.127953][ T3515] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.292926][ T1150] dummy0: left allmulticast mode [ 556.314288][ T1150] dummy0: left promiscuous mode [ 556.325286][ T1150] bridge0: port 3(dummy0) entered disabled state [ 556.348031][ T1150] bridge_slave_1: left allmulticast mode [ 556.353734][ T1150] bridge_slave_1: left promiscuous mode [ 556.359784][ T1150] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.372262][ T1150] bridge_slave_0: left allmulticast mode [ 556.386512][ T1150] bridge_slave_0: left promiscuous mode [ 556.392378][ T1150] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.448471][ T1150] vlan3: left allmulticast mode [ 556.453542][ T1150] vlan3: left promiscuous mode [ 556.458934][ T1150] bridge1: port 1(vlan3) entered disabled state [ 556.640117][T15425] netlink: 'syz.4.3152': attribute type 13 has an invalid length. [ 556.680594][ T5872] Bluetooth: hci2: command tx timeout [ 556.812249][ T1150] geneve0 (unregistering): left promiscuous mode [ 556.823235][ T1150] team0: Port device geneve0 removed [ 556.859053][ T1150] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 557.088754][ T1150] team0: Port device bridge3 removed [ 557.169964][ T1150] bridge4 (unregistering): left promiscuous mode [ 557.486385][ T1150] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 557.497153][ T1150] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 557.507972][ T1150] bond0 (unregistering): Released all slaves [ 557.523387][ T1150] bond1 (unregistering): Released all slaves [ 557.540878][ T1150] bond2 (unregistering): Released all slaves [ 557.556233][ T1150] bond3 (unregistering): Released all slaves [ 557.583427][ T1150] bond4 (unregistering): Released all slaves [ 557.708661][ T1150] bond5 (unregistering): Released all slaves [ 557.722995][ T1150] bond6 (unregistering): Released all slaves [ 557.737445][ T1150] bond7 (unregistering): Released all slaves [ 557.755403][ T1150] bond8 (unregistering): Released all slaves [ 557.781988][ T1150] bond9 (unregistering): Released all slaves [ 557.797798][ T1150] bond10 (unregistering): Released all slaves [ 557.818352][ T1150] bond11 (unregistering): Released all slaves [ 557.836447][ T1150] bond12 (unregistering): Released all slaves [ 557.856500][ T1150] bond13 (unregistering): Released all slaves [ 557.887834][ T1150] bond14 (unregistering): Released all slaves [ 557.907224][ T1150] bond15 (unregistering): Released all slaves [ 557.921795][ T1150] bond16 (unregistering): Released all slaves [ 557.939357][ T1150] bond17 (unregistering): Released all slaves [ 557.953795][ T1150] bond18 (unregistering): Released all slaves [ 557.979367][T15416] netlink: 'syz.3.3149': attribute type 4 has an invalid length. [ 558.052663][T15430] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3153'. [ 558.152894][T15418] lo speed is unknown, defaulting to 1000 [ 558.217418][T15436] netlink: 'syz.4.3155': attribute type 10 has an invalid length. [ 558.237769][T15436] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3155'. [ 558.260732][T15438] FAULT_INJECTION: forcing a failure. [ 558.260732][T15438] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 558.324860][T15438] CPU: 0 UID: 0 PID: 15438 Comm: syz.3.3154 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 558.324893][T15438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 558.324905][T15438] Call Trace: [ 558.324913][T15438] [ 558.324923][T15438] dump_stack_lvl+0x189/0x250 [ 558.324953][T15438] ? __pfx____ratelimit+0x10/0x10 [ 558.324978][T15438] ? __pfx_dump_stack_lvl+0x10/0x10 [ 558.325011][T15438] ? __pfx__printk+0x10/0x10 [ 558.325055][T15438] should_fail_ex+0x414/0x560 [ 558.325085][T15438] _copy_to_user+0x31/0xb0 [ 558.325108][T15438] simple_read_from_buffer+0xe1/0x170 [ 558.325143][T15438] proc_fail_nth_read+0x1b3/0x220 [ 558.325171][T15438] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 558.325197][T15438] ? rw_verify_area+0x2a6/0x4d0 [ 558.325221][T15438] ? __lock_acquire+0xab9/0xd20 [ 558.325247][T15438] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 558.325271][T15438] vfs_read+0x200/0x980 [ 558.325295][T15438] ? fdget_pos+0x247/0x320 [ 558.325318][T15438] ? __pfx___mutex_lock+0x10/0x10 [ 558.325345][T15438] ? __pfx_vfs_read+0x10/0x10 [ 558.325372][T15438] ? __fget_files+0x2a/0x420 [ 558.325406][T15438] ? __fget_files+0x3a0/0x420 [ 558.325434][T15438] ? __fget_files+0x2a/0x420 [ 558.325473][T15438] ksys_read+0x145/0x250 [ 558.325502][T15438] ? __pfx_ksys_read+0x10/0x10 [ 558.325535][T15438] ? do_syscall_64+0xbe/0x3b0 [ 558.325565][T15438] do_syscall_64+0xfa/0x3b0 [ 558.325588][T15438] ? lockdep_hardirqs_on+0x9c/0x150 [ 558.325611][T15438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.325630][T15438] ? clear_bhb_loop+0x60/0xb0 [ 558.325655][T15438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.325674][T15438] RIP: 0033:0x7ffbec18d5fc [ 558.325693][T15438] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 558.325710][T15438] RSP: 002b:00007ffbed03d030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 558.325732][T15438] RAX: ffffffffffffffda RBX: 00007ffbec3b6090 RCX: 00007ffbec18d5fc [ 558.325747][T15438] RDX: 000000000000000f RSI: 00007ffbed03d0a0 RDI: 0000000000000004 [ 558.325760][T15438] RBP: 00007ffbed03d090 R08: 0000000000000000 R09: 0000000000000000 [ 558.325772][T15438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 558.325785][T15438] R13: 00007ffbec3b6128 R14: 00007ffbec3b6090 R15: 00007ffe9ba74158 [ 558.325819][T15438] [ 558.777602][ T5872] Bluetooth: hci2: command tx timeout [ 558.830634][T15445] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 558.894812][T15418] lo speed is unknown, defaulting to 1000 [ 558.937379][T15413] lo speed is unknown, defaulting to 1000 [ 559.050627][T15363] chnl_net:caif_netlink_parms(): no params data found [ 559.299117][T15463] netlink: 'syz.4.3163': attribute type 4 has an invalid length. [ 559.417947][T15363] bridge0: port 1(bridge_slave_0) entered blocking state [ 559.441992][T15363] bridge0: port 1(bridge_slave_0) entered disabled state [ 559.449727][T15363] bridge_slave_0: entered allmulticast mode [ 559.459002][T15363] bridge_slave_0: entered promiscuous mode [ 559.469926][T15363] bridge0: port 2(bridge_slave_1) entered blocking state [ 559.477495][T15363] bridge0: port 2(bridge_slave_1) entered disabled state [ 559.484809][T15363] bridge_slave_1: entered allmulticast mode [ 559.493157][T15363] bridge_slave_1: entered promiscuous mode [ 559.573677][T15413] lo speed is unknown, defaulting to 1000 [ 559.582772][T15452] siw: device registration error -23 [ 559.589137][T15363] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 559.607050][T15363] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 559.688468][T15474] netlink: 'syz.2.3166': attribute type 13 has an invalid length. [ 559.703852][ T1150] tipc: Left network mode [ 559.806251][T15472] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3165'. [ 559.881251][T15363] team0: Port device team_slave_0 added [ 559.891403][ T3515] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.986716][T15363] team0: Port device team_slave_1 added [ 560.027016][T15479] netlink: 'syz.3.3168': attribute type 10 has an invalid length. [ 560.057073][T15479] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3168'. [ 560.178950][ T3515] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.239772][ T3515] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.255016][ T3515] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.273553][T15363] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 560.285215][T15363] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 560.312799][T15363] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 560.333250][T15484] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 560.512252][T15363] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 560.524764][T15363] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 560.551842][T15363] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 560.843032][ T5872] Bluetooth: hci2: command tx timeout [ 560.894630][T15363] hsr_slave_0: entered promiscuous mode [ 560.903130][T15502] siw: device registration error -23 [ 560.904431][T15363] hsr_slave_1: entered promiscuous mode [ 560.916095][T15363] debugfs: 'hsr0' already exists in 'hsr' [ 560.921859][T15363] Cannot create hsr debugfs directory [ 560.955751][T15498] netlink: 'syz.4.3174': attribute type 4 has an invalid length. [ 561.189359][T15508] netlink: 'syz.3.3178': attribute type 13 has an invalid length. [ 561.232281][T15510] netlink: 'syz.4.3179': attribute type 10 has an invalid length. [ 561.256773][T15510] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3179'. [ 561.499188][ T1150] team0: left promiscuous mode [ 561.508683][ T1150] team_slave_0: left promiscuous mode [ 561.518833][ T1150] team_slave_1: left promiscuous mode [ 561.519169][ T49] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 561.540279][ T1150] batadv_slave_1: left promiscuous mode [ 561.551043][ T1150] veth1: left promiscuous mode [ 561.590056][ T1150] hsr_slave_0: left promiscuous mode [ 561.604563][ T1150] hsr_slave_1: left promiscuous mode [ 561.610911][ T1150] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 561.620159][ T1150] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 561.650553][ T1150] pim6reg (unregistering): left allmulticast mode [ 562.291139][ T1150] team0 (unregistering): Port device team_slave_1 removed [ 562.345154][ T1150] team0 (unregistering): Port device team_slave_0 removed [ 562.853654][T15524] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 562.865718][T15524] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 562.899497][T15538] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3184'. [ 562.924273][ T5872] Bluetooth: hci2: command tx timeout [ 563.081814][ T1306] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 563.085472][T15548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3187'. [ 563.129958][T15548] netlink: 452 bytes leftover after parsing attributes in process `syz.3.3187'. [ 563.172170][T15550] siw: device registration error -23 [ 563.312940][T15554] netlink: 'syz.3.3190': attribute type 10 has an invalid length. [ 563.322032][T15554] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3190'. [ 563.350939][T15552] netlink: 'syz.4.3189': attribute type 4 has an invalid length. [ 563.362340][T15557] netlink: 'syz.2.3191': attribute type 13 has an invalid length. [ 563.597238][T15567] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 563.746449][T15570] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3197'. [ 563.822592][T15363] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 563.844008][T15363] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 563.862744][T15363] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 563.881248][T15574] lo speed is unknown, defaulting to 1000 [ 563.882684][T15363] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 564.128968][T15363] 8021q: adding VLAN 0 to HW filter on device bond0 [ 564.173107][T15363] 8021q: adding VLAN 0 to HW filter on device team0 [ 564.200469][ T3515] bridge0: port 1(bridge_slave_0) entered blocking state [ 564.207736][ T3515] bridge0: port 1(bridge_slave_0) entered forwarding state [ 564.250526][T15588] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3200'. [ 564.250711][ T3515] bridge0: port 2(bridge_slave_1) entered blocking state [ 564.266674][ T3515] bridge0: port 2(bridge_slave_1) entered forwarding state [ 564.440674][T15572] lo speed is unknown, defaulting to 1000 [ 564.440674][T15574] lo speed is unknown, defaulting to 1000 [ 564.536032][T15593] netlink: 'syz.2.3202': attribute type 13 has an invalid length. [ 564.747295][T15597] netlink: 'syz.1.3203': attribute type 4 has an invalid length. [ 564.755716][T15600] netlink: 'syz.2.3204': attribute type 10 has an invalid length. [ 564.755743][T15600] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3204'. [ 564.862055][ T1150] IPVS: stop unused estimator thread 0... [ 564.939415][T15572] lo speed is unknown, defaulting to 1000 [ 564.970162][T15591] siw: device registration error -23 [ 565.245863][T15608] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 565.305675][T15363] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 565.376923][T15610] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3207'. [ 565.513009][T15622] netlink: 'syz.2.3212': attribute type 5 has an invalid length. [ 565.651429][T15626] netlink: 'syz.2.3213': attribute type 13 has an invalid length. [ 565.792133][T15363] veth0_vlan: entered promiscuous mode [ 565.848742][T15363] veth1_vlan: entered promiscuous mode [ 565.996454][T15363] veth0_macvtap: entered promiscuous mode [ 566.027781][T15363] veth1_macvtap: entered promiscuous mode [ 566.109809][T15631] netlink: 'syz.2.3215': attribute type 4 has an invalid length. [ 566.142870][T15363] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 566.177059][T15363] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 566.220104][ T1109] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.249718][ T1109] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.290089][T15636] netlink: 'syz.1.3216': attribute type 10 has an invalid length. [ 566.290616][ T1109] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.311451][ T1109] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.329687][T15636] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3216'. [ 566.348622][T15639] siw: device registration error -23 [ 566.465529][T15636] team0: Port device geneve0 added [ 566.558724][ T59] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.602569][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.673061][ T1015] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.733424][ T1109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 566.736792][ T1015] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.758177][ T1109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 566.773562][T15650] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 566.874987][T15658] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3225'. [ 566.909280][ T1015] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 566.919910][ T1015] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 567.057265][T15663] lo speed is unknown, defaulting to 1000 [ 567.261983][T15671] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.269967][T15671] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.650023][T15671] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 567.688616][T15671] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 568.038030][T15663] lo speed is unknown, defaulting to 1000 [ 568.099878][ T3515] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.123963][ T3515] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.170640][T15661] lo speed is unknown, defaulting to 1000 [ 568.171250][ T5873] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 568.188066][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 568.197237][ T3515] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.198838][ T5873] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 568.214964][ T5873] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 568.222992][ T5873] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 568.295601][T15693] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3233'. [ 568.371235][ T3515] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.436846][T15693] team0: Port device geneve0 added [ 568.442896][ T3515] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.460411][ T3515] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.617984][T15702] validate_nla: 3 callbacks suppressed [ 568.618007][T15702] netlink: 'syz.2.3236': attribute type 13 has an invalid length. [ 568.677724][ T3515] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.704207][ T3515] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.881778][T15661] lo speed is unknown, defaulting to 1000 [ 568.900309][T15705] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 568.957890][T15712] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3239'. [ 568.968789][T15686] lo speed is unknown, defaulting to 1000 [ 569.365034][T15718] netlink: 'syz.4.3241': attribute type 4 has an invalid length. [ 569.486322][T15686] lo speed is unknown, defaulting to 1000 [ 569.508234][T15729] siw: device registration error -23 [ 569.807683][T15736] netlink: 'syz.4.3247': attribute type 10 has an invalid length. [ 569.816342][T15736] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3247'. [ 570.203688][ T1015] team0: Port device geneve0 removed [ 570.274781][ T5872] Bluetooth: hci1: command tx timeout [ 570.661291][ T1015] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 570.671356][ T1015] bond0 (unregistering): Released all slaves [ 570.689707][ T1015] bond1 (unregistering): Released all slaves [ 570.703610][ T1015] bond2 (unregistering): Released all slaves [ 570.826286][ T1015] bond3 (unregistering): Released all slaves [ 570.840033][ T1015] bond4 (unregistering): Released all slaves [ 570.856072][ T1015] bond5 (unregistering): Released all slaves [ 570.871942][ T1015] bond6 (unregistering): Released all slaves [ 570.895347][ T1015] bond7 (unregistering): Released all slaves [ 570.912136][ T1015] bond8 (unregistering): Released all slaves [ 570.928061][ T1015] bond9 (unregistering): Released all slaves [ 570.951418][ T1015] bond10 (unregistering): Released all slaves [ 570.966766][ T1015] bond11 (unregistering): Released all slaves [ 570.980651][ T1015] bond12 (unregistering): Released all slaves [ 570.995648][ T1015] bond13 (unregistering): Released all slaves [ 571.011559][ T1015] bond14 (unregistering): Released all slaves [ 571.037943][ T1015] bond15 (unregistering): Released all slaves [ 571.056573][ T1015] bond16 (unregistering): Released all slaves [ 571.072906][ T1015] bond17 (unregistering): Released all slaves [ 571.094371][ T1015] bond18 (unregistering): Released all slaves [ 571.110557][ T1015] bond19 (unregistering): Released all slaves [ 571.126930][ T1015] bond20 (unregistering): Released all slaves [ 571.143386][ T1015] bond21 (unregistering): Released all slaves [ 571.168219][ T1015] bond22 (unregistering): Released all slaves [ 571.188491][ T1015] bond23 (unregistering): Released all slaves [ 571.202089][ T1015] bond24 (unregistering): Released all slaves [ 571.220552][ T1015] bond25 (unregistering): Released all slaves [ 571.240529][ T1015] bond26 (unregistering): Released all slaves [ 571.257899][ T1015] bond27 (unregistering): Released all slaves [ 571.413832][T15740] netlink: 'syz.0.3248': attribute type 13 has an invalid length. [ 571.643462][ T3588] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.657444][ T3588] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.682601][T15745] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 571.755887][ T3588] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.765992][ T3588] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.952579][T15755] netlink: 'syz.2.3254': attribute type 4 has an invalid length. [ 572.249220][T15772] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3258'. [ 572.253043][T15686] chnl_net:caif_netlink_parms(): no params data found [ 572.311689][T15774] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3258'. [ 572.357375][ T5872] Bluetooth: hci1: command tx timeout [ 572.392149][T15779] netlink: 'syz.4.3262': attribute type 10 has an invalid length. [ 572.401751][T15779] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3262'. [ 572.549350][T15778] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3261'. [ 572.715100][T15785] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 572.818456][T15686] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.839683][T15686] bridge0: port 1(bridge_slave_0) entered disabled state [ 572.855651][T15686] bridge_slave_0: entered allmulticast mode [ 572.863775][T15686] bridge_slave_0: entered promiscuous mode [ 572.873290][T15686] bridge0: port 2(bridge_slave_1) entered blocking state [ 572.880829][T15686] bridge0: port 2(bridge_slave_1) entered disabled state [ 572.888976][T15686] bridge_slave_1: entered allmulticast mode [ 572.897587][T15686] bridge_slave_1: entered promiscuous mode [ 572.989770][T15686] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 573.028352][T15686] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 573.113811][T15799] netlink: 'syz.0.3267': attribute type 4 has an invalid length. [ 573.122975][T15802] netlink: 'syz.4.3268': attribute type 13 has an invalid length. [ 573.137081][T15686] team0: Port device team_slave_0 added [ 573.199403][T15686] team0: Port device team_slave_1 added [ 573.226256][ T1015] tipc: Left network mode [ 573.429078][T15686] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 573.444628][T15686] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 573.514120][T15686] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 573.574408][T15686] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 573.581414][T15686] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 573.614753][T15814] netlink: 'syz.1.3273': attribute type 10 has an invalid length. [ 573.622830][T15686] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 573.641027][T15814] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3273'. [ 573.777620][T15812] lo speed is unknown, defaulting to 1000 [ 573.869996][ T3515] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.892396][ T3515] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.029681][ T3515] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.050146][ T3515] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.072008][T15822] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 574.099049][T15832] netlink: 'syz.1.3278': attribute type 13 has an invalid length. [ 574.176898][T15686] hsr_slave_0: entered promiscuous mode [ 574.186541][T15686] hsr_slave_1: entered promiscuous mode [ 574.203100][T15686] debugfs: 'hsr0' already exists in 'hsr' [ 574.212694][T15686] Cannot create hsr debugfs directory [ 574.338013][T15836] netlink: 'syz.2.3279': attribute type 4 has an invalid length. [ 574.416843][T15812] lo speed is unknown, defaulting to 1000 [ 574.434078][ T5872] Bluetooth: hci1: command tx timeout [ 574.451300][T15815] lo speed is unknown, defaulting to 1000 [ 574.592367][T15843] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3282'. [ 574.792899][T15850] netlink: 'syz.1.3285': attribute type 10 has an invalid length. [ 574.801112][T15850] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3285'. [ 574.990195][T15815] lo speed is unknown, defaulting to 1000 [ 574.998671][T15828] siw: device registration error -23 [ 575.220100][T15859] netlink: 'syz.1.3289': attribute type 13 has an invalid length. [ 575.294422][T15857] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 575.621215][T15869] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3292'. [ 575.647415][T15867] netlink: 'syz.0.3291': attribute type 4 has an invalid length. [ 575.694151][T15869] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3292'. [ 575.963281][T15880] netlink: 'syz.1.3295': attribute type 10 has an invalid length. [ 575.982343][T15880] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3295'. [ 576.105359][T15883] siw: device registration error -23 [ 576.192215][T15686] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 576.261676][T15686] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 576.431641][T15886] netlink: 'syz.1.3299': attribute type 13 has an invalid length. [ 576.514367][ T5872] Bluetooth: hci1: command tx timeout [ 576.554372][T15686] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 576.616977][T15686] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 576.665185][ T1015] hsr_slave_0: left promiscuous mode [ 576.673102][ T1015] hsr_slave_1: left promiscuous mode [ 577.675730][ T1109] smc: removing ib device syz0 [ 577.694003][T15904] netlink: 'syz.2.3303': attribute type 9 has an invalid length. [ 577.707694][T15891] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 577.719954][T15891] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 577.720899][T15896] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3301'. [ 578.058639][T15911] netlink: 'syz.0.3304': attribute type 4 has an invalid length. [ 578.205407][T15919] siw: device registration error -23 [ 578.392516][T15922] netlink: 'syz.0.3308': attribute type 10 has an invalid length. [ 578.430018][T15922] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3308'. [ 578.469213][T15686] 8021q: adding VLAN 0 to HW filter on device bond0 [ 578.590131][T15686] 8021q: adding VLAN 0 to HW filter on device team0 [ 578.702631][ T3515] bridge0: port 1(bridge_slave_0) entered blocking state [ 578.709894][ T3515] bridge0: port 1(bridge_slave_0) entered forwarding state [ 578.725467][T15931] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3312'. [ 578.790312][T15938] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3312'. [ 578.799698][ T3588] bridge0: port 2(bridge_slave_1) entered blocking state [ 578.806929][ T3588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 578.865282][T15933] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 579.388452][T15942] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3314'. [ 579.589656][T15953] lo speed is unknown, defaulting to 1000 [ 579.871208][T15956] validate_nla: 1 callbacks suppressed [ 579.871230][T15956] netlink: 'syz.4.3317': attribute type 4 has an invalid length. [ 580.775721][T15976] netlink: 'syz.4.3323': attribute type 13 has an invalid length. [ 580.850334][T15686] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 580.910118][T15978] netlink: 'syz.2.3324': attribute type 10 has an invalid length. [ 580.934146][T15978] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3324'. [ 581.026951][T15686] veth0_vlan: entered promiscuous mode [ 581.116967][T15686] veth1_vlan: entered promiscuous mode [ 581.287193][T15686] veth0_macvtap: entered promiscuous mode [ 581.312544][T15686] veth1_macvtap: entered promiscuous mode [ 581.356587][T15983] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 581.645152][T15989] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3327'. [ 581.691758][T15686] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 581.738033][T15686] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.749783][T15992] netlink: 'syz.1.3328': attribute type 4 has an invalid length. [ 581.766831][ T3588] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.793014][ T3588] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.803454][ T3588] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.828293][ T3588] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.932912][T16000] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3331'. [ 581.948482][T16001] siw: device registration error -23 [ 582.027683][ T1109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.063123][ T1109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.119127][ T1015] IPVS: stop unused estimator thread 0... [ 582.170910][T16006] netlink: 'syz.0.3334': attribute type 13 has an invalid length. [ 582.179239][ T3515] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.190419][T16007] netlink: 'syz.1.3335': attribute type 10 has an invalid length. [ 582.192946][ T3515] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.219665][T16007] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3335'. [ 582.402219][T16012] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3337'. [ 582.441635][T16012] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3337'. [ 582.621397][T16016] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 582.673100][T16025] netlink: 'syz.2.3341': attribute type 4 has an invalid length. [ 582.868436][T16034] siw: device registration error -23 [ 583.018641][T16043] netlink: 'syz.1.3346': attribute type 13 has an invalid length. [ 583.029469][T16039] lo speed is unknown, defaulting to 1000 [ 583.304350][T16046] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3348'. [ 583.421997][T16053] netlink: 'syz.2.3350': attribute type 10 has an invalid length. [ 583.725973][T16061] netlink: 'syz.3.3353': attribute type 4 has an invalid length. [ 583.855215][T16070] siw: device registration error -23 [ 583.881260][T16065] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 584.407337][T16076] bridge0: port 2(bridge_slave_1) entered disabled state [ 584.415232][T16076] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.590991][T16076] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 584.610257][T16076] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 584.792560][T16094] __nla_validate_parse: 1 callbacks suppressed [ 584.792585][T16094] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3364'. [ 584.817247][ T1109] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.840435][ T1109] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.869197][ T1109] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.888425][T16087] lo speed is unknown, defaulting to 1000 [ 584.897086][ T1109] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.957286][T16097] validate_nla: 1 callbacks suppressed [ 584.957307][T16097] netlink: 'syz.1.3365': attribute type 10 has an invalid length. [ 585.034728][T16100] netlink: 'syz.1.3367': attribute type 10 has an invalid length. [ 585.042863][T16100] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3367'. [ 585.197307][T16098] netlink: 'syz.3.3366': attribute type 4 has an invalid length. [ 585.283056][T16108] siw: device registration error -23 [ 585.438007][T16112] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3371'. [ 585.475503][T16110] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 585.485395][ T55] block nbd0: Possible stuck request ffff88802518e000: control (read@0,1024B). Runtime 390 seconds [ 585.497260][ T55] block nbd0: Possible stuck request ffff88802518e1c0: control (read@1024,1024B). Runtime 390 seconds [ 585.508755][ T55] block nbd0: Possible stuck request ffff88802518e380: control (read@2048,1024B). Runtime 390 seconds [ 585.519865][ T55] block nbd0: Possible stuck request ffff88802518e540: control (read@3072,1024B). Runtime 390 seconds [ 585.521395][T16118] nbd: must specify at least one socket [ 585.566310][T16118] netlink: 324 bytes leftover after parsing attributes in process `syz.0.3373'. [ 585.575963][T16118] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3373'. [ 585.610138][T16118] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3373'. [ 585.672907][T16126] netlink: 'syz.1.3376': attribute type 13 has an invalid length. [ 585.705464][T16118] netlink: 9896 bytes leftover after parsing attributes in process `syz.0.3373'. [ 585.757649][T16118] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3373'. [ 585.767271][T16118] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3373'. [ 585.883724][T16136] netlink: 'syz.3.3379': attribute type 10 has an invalid length. [ 585.894805][T16136] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3379'. [ 585.911094][T16136] team0: Port device geneve0 added [ 585.917481][ T3515] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.963693][ T3515] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.999918][T16134] lo speed is unknown, defaulting to 1000 [ 586.006273][ T1109] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.007146][ T1109] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.457437][T16158] netlink: 'syz.2.3388': attribute type 13 has an invalid length. [ 586.600835][T16156] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 586.854459][T16173] netlink: 'syz.0.3391': attribute type 10 has an invalid length. [ 587.248238][T16184] vlan2: entered promiscuous mode [ 587.253763][T16184] bridge0: entered promiscuous mode [ 587.263475][T16184] vlan2: entered allmulticast mode [ 587.272198][T16184] bridge0: entered allmulticast mode [ 587.751135][T16192] lo speed is unknown, defaulting to 1000 [ 588.103689][T16204] netlink: 'syz.4.3402': attribute type 13 has an invalid length. [ 588.203486][T16202] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 588.744842][T16229] siw: device registration error -23 [ 589.006168][T16245] netlink: 'syz.4.3417': attribute type 13 has an invalid length. [ 589.161863][T16249] lo speed is unknown, defaulting to 1000 [ 589.194682][T16248] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 589.537099][T16270] siw: device registration error -23 [ 589.651542][T16275] FAULT_INJECTION: forcing a failure. [ 589.651542][T16275] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 589.666069][T16275] CPU: 0 UID: 0 PID: 16275 Comm: syz.3.3427 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 589.666101][T16275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 589.666114][T16275] Call Trace: [ 589.666122][T16275] [ 589.666130][T16275] dump_stack_lvl+0x189/0x250 [ 589.666160][T16275] ? __pfx____ratelimit+0x10/0x10 [ 589.666185][T16275] ? __pfx_dump_stack_lvl+0x10/0x10 [ 589.666209][T16275] ? __pfx__printk+0x10/0x10 [ 589.666237][T16275] ? __might_fault+0xb0/0x130 [ 589.666276][T16275] should_fail_ex+0x414/0x560 [ 589.666306][T16275] _copy_from_user+0x2d/0xb0 [ 589.666326][T16275] ___sys_sendmsg+0x158/0x2a0 [ 589.666360][T16275] ? __pfx____sys_sendmsg+0x10/0x10 [ 589.666432][T16275] ? __fget_files+0x2a/0x420 [ 589.666460][T16275] ? __fget_files+0x3a0/0x420 [ 589.666502][T16275] __sys_sendmmsg+0x227/0x430 [ 589.666537][T16275] ? __pfx___sys_sendmmsg+0x10/0x10 [ 589.666562][T16275] ? __mutex_unlock_slowpath+0x1a1/0x760 [ 589.666619][T16275] ? ksys_write+0x22a/0x250 [ 589.666648][T16275] ? __pfx_ksys_write+0x10/0x10 [ 589.666670][T16275] ? rcu_is_watching+0x15/0xb0 [ 589.666698][T16275] __x64_sys_sendmmsg+0xa0/0xc0 [ 589.666729][T16275] do_syscall_64+0xfa/0x3b0 [ 589.666753][T16275] ? lockdep_hardirqs_on+0x9c/0x150 [ 589.666776][T16275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.666796][T16275] ? clear_bhb_loop+0x60/0xb0 [ 589.666829][T16275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.666848][T16275] RIP: 0033:0x7f0303b8ebe9 [ 589.666867][T16275] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 589.666890][T16275] RSP: 002b:00007f0304918038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 589.666913][T16275] RAX: ffffffffffffffda RBX: 00007f0303db5fa0 RCX: 00007f0303b8ebe9 [ 589.666928][T16275] RDX: 0492492492492856 RSI: 0000200000000140 RDI: 0000000000000003 [ 589.666942][T16275] RBP: 00007f0304918090 R08: 0000000000000000 R09: 0000000000000000 [ 589.666954][T16275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 589.666966][T16275] R13: 00007f0303db6038 R14: 00007f0303db5fa0 R15: 00007fff6f9fa648 [ 589.667000][T16275] [ 589.972960][T16267] tipc: Enabling of bearer rejected, failed to enable media [ 590.232528][T16287] netlink: 'syz.3.3431': attribute type 13 has an invalid length. [ 590.320255][T16292] netlink: 'syz.1.3433': attribute type 10 has an invalid length. [ 590.339757][T16292] __nla_validate_parse: 10 callbacks suppressed [ 590.339781][T16292] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3433'. [ 590.355450][ T1015] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.375155][ T3515] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.404084][ T3515] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.444304][ T3515] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.800673][T16309] siw: device registration error -23 [ 590.803284][T16305] netlink: 'syz.1.3438': attribute type 10 has an invalid length. [ 590.835204][T16305] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3438'. [ 590.970659][T16312] lo speed is unknown, defaulting to 1000 [ 591.220032][T16324] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3443'. [ 591.476825][T16330] netlink: 'syz.0.3446': attribute type 13 has an invalid length. [ 591.655335][T16341] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3450'. [ 591.724285][T16343] siw: device registration error -23 [ 591.953356][T16350] lo speed is unknown, defaulting to 1000 [ 592.861001][T16358] FAULT_INJECTION: forcing a failure. [ 592.861001][T16358] name failslab, interval 1, probability 0, space 0, times 0 [ 592.912141][T16358] CPU: 1 UID: 0 PID: 16358 Comm: syz.2.3456 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 592.912174][T16358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 592.912186][T16358] Call Trace: [ 592.912194][T16358] [ 592.912203][T16358] dump_stack_lvl+0x189/0x250 [ 592.912234][T16358] ? __pfx____ratelimit+0x10/0x10 [ 592.912260][T16358] ? __pfx_dump_stack_lvl+0x10/0x10 [ 592.912284][T16358] ? __pfx__printk+0x10/0x10 [ 592.912319][T16358] ? __pfx___might_resched+0x10/0x10 [ 592.912347][T16358] should_fail_ex+0x414/0x560 [ 592.912376][T16358] should_failslab+0xa8/0x100 [ 592.912406][T16358] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 592.912434][T16358] ? __alloc_skb+0x112/0x2d0 [ 592.912465][T16358] __alloc_skb+0x112/0x2d0 [ 592.912497][T16358] netlink_dump+0x1b7/0xe90 [ 592.912521][T16358] ? __pfx__copy_to_iter+0x10/0x10 [ 592.912546][T16358] ? __skb_try_recv_from_queue+0x58f/0x730 [ 592.912587][T16358] ? __pfx_netlink_dump+0x10/0x10 [ 592.912643][T16358] netlink_recvmsg+0x676/0xa30 [ 592.912680][T16358] ? __pfx_netlink_recvmsg+0x10/0x10 [ 592.912712][T16358] ? aa_sock_msg_perm+0xf1/0x1d0 [ 592.912741][T16358] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 592.912761][T16358] ? security_socket_recvmsg+0x7e/0x2e0 [ 592.912781][T16358] ? __pfx_netlink_recvmsg+0x10/0x10 [ 592.912806][T16358] sock_recvmsg+0x22c/0x270 [ 592.912843][T16358] __sys_recvfrom+0x1f6/0x340 [ 592.912873][T16358] ? __pfx___sys_recvfrom+0x10/0x10 [ 592.912897][T16358] ? __mutex_unlock_slowpath+0x1a1/0x760 [ 592.912939][T16358] ? __fget_files+0x3a0/0x420 [ 592.912981][T16358] ? ksys_write+0x22a/0x250 [ 592.913010][T16358] ? __pfx_ksys_write+0x10/0x10 [ 592.913033][T16358] ? rcu_is_watching+0x15/0xb0 [ 592.913060][T16358] __x64_sys_recvfrom+0xde/0x100 [ 592.913091][T16358] do_syscall_64+0xfa/0x3b0 [ 592.913115][T16358] ? lockdep_hardirqs_on+0x9c/0x150 [ 592.913138][T16358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.913159][T16358] ? clear_bhb_loop+0x60/0xb0 [ 592.913189][T16358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.913208][T16358] RIP: 0033:0x7f2f1fb8ebe9 [ 592.913226][T16358] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 592.913243][T16358] RSP: 002b:00007f2f209ac038 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 592.913266][T16358] RAX: ffffffffffffffda RBX: 00007f2f1fdb5fa0 RCX: 00007f2f1fb8ebe9 [ 592.913280][T16358] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 592.913292][T16358] RBP: 00007f2f209ac090 R08: 0000000000000000 R09: 0000000000000000 [ 592.913305][T16358] R10: 0000000040002062 R11: 0000000000000246 R12: 0000000000000001 [ 592.913317][T16358] R13: 00007f2f1fdb6038 R14: 00007f2f1fdb5fa0 R15: 00007ffe163900c8 [ 592.913352][T16358] [ 593.306780][T16370] netlink: 'syz.4.3461': attribute type 13 has an invalid length. [ 593.621718][T16384] netlink: 'syz.1.3466': attribute type 10 has an invalid length. [ 593.707987][T16387] netlink: 144 bytes leftover after parsing attributes in process `syz.4.3464'. [ 593.723339][T16382] lo speed is unknown, defaulting to 1000 [ 593.757988][T16388] siw: device registration error -23 [ 593.769897][T16390] tipc: Failed to remove unknown binding: 66,1,1/0:266118948/266118949 [ 594.166006][T16407] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3476'. [ 594.199981][T16411] netlink: 'syz.3.3474': attribute type 13 has an invalid length. [ 594.315653][T16403] netlink: 'syz.1.3473': attribute type 4 has an invalid length. [ 594.528465][T16424] siw: device registration error -23 [ 594.540642][T16422] netlink: 84 bytes leftover after parsing attributes in process `syz.3.3480'. [ 594.994449][T16447] netlink: 'syz.1.3490': attribute type 13 has an invalid length. [ 595.153634][T16453] netlink: 'syz.4.3493': attribute type 4 has an invalid length. [ 595.177373][T16448] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 595.208993][T16461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3494'. [ 595.259102][T16454] lo speed is unknown, defaulting to 1000 [ 595.566654][T16481] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3501'. [ 595.845168][T16492] netlink: 'syz.2.3505': attribute type 13 has an invalid length. [ 596.092284][T16499] netlink: 'syz.1.3508': attribute type 4 has an invalid length. [ 596.141254][T16502] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 596.310487][T16518] siw: device registration error -23 [ 596.446803][T16525] netlink: 'syz.0.3517': attribute type 9 has an invalid length. [ 596.462151][T16523] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3516'. [ 596.491325][T16523] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3516'. [ 596.493148][T16521] netlink: 'syz.1.3515': attribute type 2 has an invalid length. [ 597.018418][T16539] netlink: 'syz.3.3521': attribute type 13 has an invalid length. [ 597.069714][T16541] nbd: must specify at least one socket [ 597.098794][T16541] netlink: 324 bytes leftover after parsing attributes in process `syz.2.3523'. [ 597.132458][T16541] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3523'. [ 597.152941][T16541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3523'. [ 597.208620][T16541] netlink: 9896 bytes leftover after parsing attributes in process `syz.2.3523'. [ 597.251323][T16541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3523'. [ 597.260538][T16541] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3523'. [ 597.273265][T16547] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 597.459331][T16556] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3527'. [ 597.812795][T16571] lo speed is unknown, defaulting to 1000 [ 598.206730][T16578] netlink: 'syz.0.3534': attribute type 13 has an invalid length. [ 598.441196][T16581] netlink: 'syz.0.3535': attribute type 4 has an invalid length. [ 598.519687][T16584] netlink: 'syz.4.3536': attribute type 10 has an invalid length. [ 598.683529][T16594] IPVS: set_ctl: invalid protocol: 58 255.255.255.255:6 [ 598.754472][T16598] vlan2: entered promiscuous mode [ 598.767657][T16598] bridge0: entered promiscuous mode [ 598.773193][T16598] vlan2: entered allmulticast mode [ 598.795047][T16598] bridge0: entered allmulticast mode [ 598.839410][T16592] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 598.928953][ T5858] IPVS: starting estimator thread 0... [ 599.035248][T16610] IPVS: using max 24 ests per chain, 57600 per kthread [ 599.188962][T16618] netlink: 'syz.2.3545': attribute type 10 has an invalid length. [ 599.293249][T16627] RDS: rds_bind could not find a transport for 100:806:aaaa:aaaa:aaaa::, load rds_tcp or rds_rdma? [ 599.367816][T16628] netlink: 'syz.1.3550': attribute type 4 has an invalid length. [ 599.737361][T16645] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 599.771949][T16645] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 599.839691][T16646] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 600.747621][T16692] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 600.874154][T16705] __nla_validate_parse: 11 callbacks suppressed [ 600.874175][T16705] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3576'. [ 600.932589][T16707] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3574'. [ 601.282616][T16720] lo speed is unknown, defaulting to 1000 [ 601.764861][T16741] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3589'. [ 601.826030][T16742] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 601.871778][T16754] validate_nla: 3 callbacks suppressed [ 601.871798][T16754] netlink: 'syz.1.3594': attribute type 10 has an invalid length. [ 601.896270][T16754] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3594'. [ 601.908954][T16748] tipc: Started in network mode [ 601.915736][T16748] tipc: Node identity 4ac1ca18df54, cluster identity 4711 [ 601.923191][T16748] tipc: Enabled bearer , priority 0 [ 601.942940][T16748] syzkaller0: entered promiscuous mode [ 601.997522][T16748] syzkaller0: entered allmulticast mode [ 602.114047][T16755] syzkaller0: mtu less than device minimum [ 602.130570][T16761] netlink: 'syz.0.3598': attribute type 13 has an invalid length. [ 602.167884][T16763] netlink: 'syz.3.3595': attribute type 10 has an invalid length. [ 602.176784][T16746] tipc: Resetting bearer [ 602.182883][T16763] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3595'. [ 602.216492][T16746] tipc: Disabling bearer [ 602.225605][T16768] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3597'. [ 602.528598][T16773] netlink: 'syz.0.3601': attribute type 4 has an invalid length. [ 602.595259][T16784] sctp: [Deprecated]: syz.3.3605 (pid 16784) Use of struct sctp_assoc_value in delayed_ack socket option. [ 602.595259][T16784] Use struct sctp_sack_info instead [ 602.678967][T16786] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3606'. [ 602.747858][T16790] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3607'. [ 602.753808][T16792] netlink: 'syz.0.3609': attribute type 10 has an invalid length. [ 602.808741][T16792] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3609'. [ 602.913274][T16798] vlan2: entered promiscuous mode [ 602.955495][T16798] bridge0: entered promiscuous mode [ 602.975471][T16798] vlan2: entered allmulticast mode [ 602.981092][T16798] bridge0: entered allmulticast mode [ 603.041485][T16803] FAULT_INJECTION: forcing a failure. [ 603.041485][T16803] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 603.065673][T16803] CPU: 1 UID: 0 PID: 16803 Comm: syz.3.3613 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 603.065706][T16803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 603.065718][T16803] Call Trace: [ 603.065737][T16803] [ 603.065747][T16803] dump_stack_lvl+0x189/0x250 [ 603.065776][T16803] ? __pfx____ratelimit+0x10/0x10 [ 603.065802][T16803] ? __pfx_dump_stack_lvl+0x10/0x10 [ 603.065826][T16803] ? __pfx__printk+0x10/0x10 [ 603.065869][T16803] should_fail_ex+0x414/0x560 [ 603.065898][T16803] _copy_to_user+0x31/0xb0 [ 603.065921][T16803] bpf_test_finish+0x1ab/0x700 [ 603.065958][T16803] ? __pfx_bpf_test_finish+0x10/0x10 [ 603.065990][T16803] ? bpf_test_init+0x133/0x170 [ 603.066016][T16803] bpf_prog_test_run_xdp+0x79a/0x1000 [ 603.066061][T16803] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 603.066092][T16803] ? __fget_files+0x2a/0x420 [ 603.066127][T16803] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 603.066153][T16803] bpf_prog_test_run+0x2c7/0x340 [ 603.066185][T16803] __sys_bpf+0x581/0x870 [ 603.066213][T16803] ? __pfx___sys_bpf+0x10/0x10 [ 603.066254][T16803] ? ksys_write+0x22a/0x250 [ 603.066282][T16803] ? __pfx_ksys_write+0x10/0x10 [ 603.066305][T16803] ? rcu_is_watching+0x15/0xb0 [ 603.066334][T16803] __x64_sys_bpf+0x7c/0x90 [ 603.066358][T16803] do_syscall_64+0xfa/0x3b0 [ 603.066382][T16803] ? lockdep_hardirqs_on+0x9c/0x150 [ 603.066404][T16803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.066423][T16803] ? clear_bhb_loop+0x60/0xb0 [ 603.066448][T16803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.066467][T16803] RIP: 0033:0x7f0303b8ebe9 [ 603.066486][T16803] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 603.066504][T16803] RSP: 002b:00007f0304918038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 603.066527][T16803] RAX: ffffffffffffffda RBX: 00007f0303db5fa0 RCX: 00007f0303b8ebe9 [ 603.066542][T16803] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 000000000000000a [ 603.066555][T16803] RBP: 00007f0304918090 R08: 0000000000000000 R09: 0000000000000000 [ 603.066568][T16803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 603.066580][T16803] R13: 00007f0303db6038 R14: 00007f0303db5fa0 R15: 00007fff6f9fa648 [ 603.066613][T16803] [ 603.432441][T16816] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3618'. [ 603.801771][T16817] netlink: 'syz.0.3619': attribute type 4 has an invalid length. [ 603.890871][T16837] netlink: 'syz.1.3627': attribute type 2 has an invalid length. [ 603.907320][T16838] bridge_slave_0: left allmulticast mode [ 603.914064][T16838] bridge_slave_0: left promiscuous mode [ 603.919916][T16838] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.928879][T16837] netlink: 'syz.1.3627': attribute type 1 has an invalid length. [ 603.945394][T16838] bridge_slave_1: left allmulticast mode [ 603.960251][T16838] bridge_slave_1: left promiscuous mode [ 603.985049][T16838] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.043128][T16845] netlink: 'syz.2.3629': attribute type 9 has an invalid length. [ 604.070629][T16838] bond0: (slave bond_slave_0): Releasing backup interface [ 604.083484][T16838] bond0: (slave bond_slave_1): Releasing backup interface [ 604.111109][T16838] team0: Port device team_slave_0 removed [ 604.130148][T16838] team0: Port device team_slave_1 removed [ 604.137446][T16838] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 604.150139][T16838] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 604.160080][T16838] team0: Port device geneve0 removed [ 604.436505][T16857] vlan2: left promiscuous mode [ 604.441372][T16857] bridge0: left promiscuous mode [ 604.463583][T16857] vlan2: left allmulticast mode [ 604.483944][T16857] bridge0: left allmulticast mode [ 604.662554][T16859] lo speed is unknown, defaulting to 1000 [ 605.615212][T16896] tipc: Started in network mode [ 605.620140][T16896] tipc: Node identity ba4ef6d95f8c, cluster identity 4711 [ 605.655881][T16896] tipc: Enabled bearer , priority 0 [ 605.684051][T16910] FAULT_INJECTION: forcing a failure. [ 605.684051][T16910] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 605.710725][T16910] CPU: 1 UID: 0 PID: 16910 Comm: syz.0.3653 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 605.710758][T16910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 605.710770][T16910] Call Trace: [ 605.710781][T16910] [ 605.710790][T16910] dump_stack_lvl+0x189/0x250 [ 605.710820][T16910] ? __pfx____ratelimit+0x10/0x10 [ 605.710844][T16910] ? __pfx_dump_stack_lvl+0x10/0x10 [ 605.710868][T16910] ? __pfx__printk+0x10/0x10 [ 605.710896][T16910] ? __might_fault+0xb0/0x130 [ 605.710937][T16910] should_fail_ex+0x414/0x560 [ 605.710966][T16910] _copy_from_iter+0x3f5/0x16f0 [ 605.710999][T16910] ? rcu_is_watching+0x15/0xb0 [ 605.711036][T16910] ? __pfx__copy_from_iter+0x10/0x10 [ 605.711066][T16910] ? __build_skb_around+0x257/0x3e0 [ 605.711094][T16910] ? netlink_sendmsg+0x642/0xb30 [ 605.711117][T16910] ? skb_put+0x11b/0x210 [ 605.711145][T16910] netlink_sendmsg+0x6b2/0xb30 [ 605.711180][T16910] ? __pfx_netlink_sendmsg+0x10/0x10 [ 605.711209][T16910] ? aa_sock_msg_perm+0xf1/0x1d0 [ 605.711238][T16910] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 605.711260][T16910] ? __pfx_netlink_sendmsg+0x10/0x10 [ 605.711286][T16910] __sock_sendmsg+0x21c/0x270 [ 605.711313][T16910] ____sys_sendmsg+0x52d/0x830 [ 605.711387][T16910] ? __pfx_____sys_sendmsg+0x10/0x10 [ 605.711427][T16910] ? import_iovec+0x74/0xa0 [ 605.711451][T16910] ___sys_sendmsg+0x21f/0x2a0 [ 605.711483][T16910] ? __pfx____sys_sendmsg+0x10/0x10 [ 605.711556][T16910] ? __fget_files+0x2a/0x420 [ 605.711584][T16910] ? __fget_files+0x3a0/0x420 [ 605.711625][T16910] __sys_sendmmsg+0x227/0x430 [ 605.711661][T16910] ? __pfx___sys_sendmmsg+0x10/0x10 [ 605.711688][T16910] ? __mutex_unlock_slowpath+0x1a1/0x760 [ 605.711745][T16910] ? ksys_write+0x22a/0x250 [ 605.711772][T16910] ? __pfx_ksys_write+0x10/0x10 [ 605.711794][T16910] ? rcu_is_watching+0x15/0xb0 [ 605.711820][T16910] __x64_sys_sendmmsg+0xa0/0xc0 [ 605.711850][T16910] do_syscall_64+0xfa/0x3b0 [ 605.711873][T16910] ? lockdep_hardirqs_on+0x9c/0x150 [ 605.711896][T16910] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.711916][T16910] ? clear_bhb_loop+0x60/0xb0 [ 605.711940][T16910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.711959][T16910] RIP: 0033:0x7f541838ebe9 [ 605.711978][T16910] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 605.711997][T16910] RSP: 002b:00007f5419242038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 605.712027][T16910] RAX: ffffffffffffffda RBX: 00007f54185b5fa0 RCX: 00007f541838ebe9 [ 605.712043][T16910] RDX: 0492492492492856 RSI: 0000200000000140 RDI: 0000000000000003 [ 605.712056][T16910] RBP: 00007f5419242090 R08: 0000000000000000 R09: 0000000000000000 [ 605.712069][T16910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 605.712082][T16910] R13: 00007f54185b6038 R14: 00007f54185b5fa0 R15: 00007ffd74765d78 [ 605.712116][T16910] [ 605.716494][T16908] syzkaller1: entered promiscuous mode [ 605.893593][T16918] Bluetooth: MGMT ver 1.23 [ 605.915805][T16908] syzkaller1: entered allmulticast mode [ 606.073142][T16924] siw: device registration error -23 [ 606.106813][T16896] tipc: Disabling bearer [ 606.137586][ T30] audit: type=1800 audit(1754995255.104:6): pid=16926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3656" name="@" dev="tmpfs" ino=766 res=0 errno=0 [ 606.388522][T16932] netlink: 'syz.1.3660': attribute type 4 has an invalid length. [ 606.671353][T16954] __nla_validate_parse: 4 callbacks suppressed [ 606.671377][T16954] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3669'. [ 606.686795][ C1] ------------[ cut here ]------------ [ 606.692673][ C1] WARNING: CPU: 1 PID: 23 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x623/0x730 [ 606.702255][ C1] Modules linked in: [ 606.706469][ C1] CPU: 1 UID: 0 PID: 23 Comm: ksoftirqd/1 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 606.718085][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 606.728395][ C1] RIP: 0010:inet_sock_destruct+0x623/0x730 [ 606.734363][ C1] Code: 0f 0b 90 e9 62 fe ff ff e8 6a 33 bd f7 90 0f 0b 90 e9 95 fe ff ff e8 5c 33 bd f7 90 0f 0b 90 e9 bb fe ff ff e8 4e 33 bd f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc [ 606.741187][T16954] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3669'. [ 606.754052][ C1] RSP: 0018:ffffc900001d7868 EFLAGS: 00010246 [ 606.754085][ C1] RAX: ffffffff8a027862 RBX: dffffc0000000000 RCX: ffff88801d2fda00 [ 606.754103][ C1] RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 [ 606.754117][ C1] RBP: 0000000000000fff R08: ffff88807d6b461f R09: 1ffff1100fad68c3 [ 606.754133][ C1] R10: dffffc0000000000 R11: ffffed100fad68c4 R12: ffff88807d6b4380 [ 606.754149][ C1] R13: dffffc0000000000 R14: ffff88807d6b4604 R15: 1ffff1100fad6872 [ 606.754166][ C1] FS: 0000000000000000(0000) GS:ffff888125d21000(0000) knlGS:0000000000000000 [ 606.754185][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 606.754198][ C1] CR2: 00007f04c13b6980 CR3: 00000000782e0000 CR4: 00000000003526f0 [ 606.754218][ C1] Call Trace: [ 606.754228][ C1] [ 606.754240][ C1] ? inet6_cleanup_sock+0x197/0x230 [ 606.754276][ C1] ? __pfx_inet6_sock_destruct+0x10/0x10 [ 606.754308][ C1] __sk_destruct+0x89/0x660 [ 606.754338][ C1] ? __pfx___sk_destruct+0x10/0x10 [ 606.754365][ C1] ? rcu_core+0xc37/0x1770 [ 606.754396][ C1] rcu_core+0xca8/0x1770 [ 606.754423][ C1] ? __lock_acquire+0xab9/0xd20 [ 606.754473][ C1] ? __pfx_rcu_core+0x10/0x10 [ 606.754507][ C1] ? rcu_qs+0xc4/0x170 [ 606.754525][ C1] ? __pfx_rcu_qs+0x10/0x10 [ 606.754541][ C1] ? sched_clock_cpu+0x74/0x430 [ 606.754582][ C1] ? rcu_softirq_qs+0xf2/0x350 [ 606.754601][ C1] ? __pfx_rcu_softirq_qs+0x10/0x10 [ 606.754633][ C1] handle_softirqs+0x283/0x870 [ 606.754658][ C1] ? run_ksoftirqd+0x9b/0x100 [ 606.754687][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 606.754711][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 606.754735][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 606.754756][ C1] run_ksoftirqd+0x9b/0x100 [ 606.754777][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 606.754807][ C1] smpboot_thread_fn+0x53f/0xa60 [ 606.754830][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 606.754861][ C1] kthread+0x70e/0x8a0 [ 606.754892][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 606.754914][ C1] ? __pfx_kthread+0x10/0x10 [ 606.924841][T16958] nbd: must specify at least one socket [ 606.928792][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 606.951477][T16958] netlink: 324 bytes leftover after parsing attributes in process `syz.1.3670'. [ 606.952606][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 606.963523][T16958] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3670'. [ 606.968473][ C1] ? __pfx_kthread+0x10/0x10 [ 606.968519][ C1] ret_from_fork+0x3fc/0x770 [ 606.968553][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 606.968583][ C1] ? __switch_to_asm+0x39/0x70 [ 606.968610][ C1] ? __switch_to_asm+0x33/0x70 [ 606.968632][ C1] ? __pfx_kthread+0x10/0x10 [ 606.968658][ C1] ret_from_fork_asm+0x1a/0x30 [ 606.968702][ C1] [ 606.968714][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 606.968731][ C1] CPU: 1 UID: 0 PID: 23 Comm: ksoftirqd/1 Not tainted 6.16.0-syzkaller-12065-gbc4c0a48bdad #0 PREEMPT(full) [ 606.968755][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 606.968768][ C1] Call Trace: [ 606.968777][ C1] [ 606.968786][ C1] dump_stack_lvl+0x99/0x250 [ 606.968810][ C1] ? __asan_memcpy+0x40/0x70 [ 606.968834][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 606.968857][ C1] ? __pfx__printk+0x10/0x10 [ 606.968898][ C1] vpanic+0x281/0x750 [ 606.968923][ C1] ? __pfx__printk+0x10/0x10 [ 606.968946][ C1] ? __pfx_vpanic+0x10/0x10 [ 606.968967][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 606.969013][ C1] panic+0xb9/0xc0 [ 606.969033][ C1] ? __pfx_panic+0x10/0x10 [ 606.969069][ C1] __warn+0x31b/0x4b0 [ 606.969088][ C1] ? inet_sock_destruct+0x623/0x730 [ 606.969110][ C1] ? inet_sock_destruct+0x623/0x730 [ 606.969129][ C1] report_bug+0x2be/0x4f0 [ 606.969149][ C1] ? inet_sock_destruct+0x623/0x730 [ 606.969168][ C1] ? inet_sock_destruct+0x623/0x730 [ 606.969187][ C1] ? inet_sock_destruct+0x625/0x730 [ 606.969206][ C1] handle_bug+0x84/0x160 [ 606.969232][ C1] exc_invalid_op+0x1a/0x50 [ 606.969257][ C1] asm_exc_invalid_op+0x1a/0x20 [ 606.969275][ C1] RIP: 0010:inet_sock_destruct+0x623/0x730 [ 606.969295][ C1] Code: 0f 0b 90 e9 62 fe ff ff e8 6a 33 bd f7 90 0f 0b 90 e9 95 fe ff ff e8 5c 33 bd f7 90 0f 0b 90 e9 bb fe ff ff e8 4e 33 bd f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc [ 606.969313][ C1] RSP: 0018:ffffc900001d7868 EFLAGS: 00010246 [ 606.969333][ C1] RAX: ffffffff8a027862 RBX: dffffc0000000000 RCX: ffff88801d2fda00 [ 606.969348][ C1] RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 [ 606.969370][ C1] RBP: 0000000000000fff R08: ffff88807d6b461f R09: 1ffff1100fad68c3 [ 606.969384][ C1] R10: dffffc0000000000 R11: ffffed100fad68c4 R12: ffff88807d6b4380 [ 606.969399][ C1] R13: dffffc0000000000 R14: ffff88807d6b4604 R15: 1ffff1100fad6872 [ 606.969421][ C1] ? inet_sock_destruct+0x622/0x730 [ 606.969448][ C1] ? inet_sock_destruct+0x622/0x730 [ 606.969482][ C1] ? inet6_cleanup_sock+0x197/0x230 [ 606.969507][ C1] ? __pfx_inet6_sock_destruct+0x10/0x10 [ 606.969532][ C1] __sk_destruct+0x89/0x660 [ 606.969558][ C1] ? __pfx___sk_destruct+0x10/0x10 [ 606.969589][ C1] ? rcu_core+0xc37/0x1770 [ 606.969616][ C1] rcu_core+0xca8/0x1770 [ 606.969641][ C1] ? __lock_acquire+0xab9/0xd20 [ 606.969685][ C1] ? __pfx_rcu_core+0x10/0x10 [ 606.969715][ C1] ? rcu_qs+0xc4/0x170 [ 606.969732][ C1] ? __pfx_rcu_qs+0x10/0x10 [ 606.969747][ C1] ? sched_clock_cpu+0x74/0x430 [ 606.969784][ C1] ? rcu_softirq_qs+0xf2/0x350 [ 606.969801][ C1] ? __pfx_rcu_softirq_qs+0x10/0x10 [ 606.969830][ C1] handle_softirqs+0x283/0x870 [ 606.969854][ C1] ? run_ksoftirqd+0x9b/0x100 [ 606.969880][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 606.969902][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 606.969925][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 606.969942][ C1] run_ksoftirqd+0x9b/0x100 [ 606.969962][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 606.969999][ C1] smpboot_thread_fn+0x53f/0xa60 [ 606.970020][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 606.970047][ C1] kthread+0x70e/0x8a0 [ 606.970073][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 606.970091][ C1] ? __pfx_kthread+0x10/0x10 [ 606.970115][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 606.970136][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 606.970156][ C1] ? __pfx_kthread+0x10/0x10 [ 606.970179][ C1] ret_from_fork+0x3fc/0x770 [ 606.970201][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 606.970227][ C1] ? __switch_to_asm+0x39/0x70 [ 606.970249][ C1] ? __switch_to_asm+0x33/0x70 [ 606.970270][ C1] ? __pfx_kthread+0x10/0x10 [ 606.970293][ C1] ret_from_fork_asm+0x1a/0x30 [ 606.970331][ C1] [ 606.974636][ C1] Kernel Offset: disabled