last executing test programs: 3m55.825933859s ago: executing program 3 (id=3511): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000001080), r0) socket$inet6(0xa, 0x2, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000001ac0), 0x6) ioctl$sock_bt_hci(r1, 0x400448e6, &(0x7f0000000000)) socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000100)) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) bind$packet(r2, &(0x7f0000000080)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 3) 3m55.75384721s ago: executing program 3 (id=3512): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x94}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x80ff, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xfbc}, 0xe) 3m55.544204551s ago: executing program 3 (id=3515): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000004480)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "aaa938", 0x3c, 0x11, 0xff, @remote, @empty, {[@srh={0x4, 0x2, 0x4, 0x1, 0x4, 0x0, 0x8000, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}], {0x4e27, 0x4e23, 0x24, 0x0, @gue={{0x1, 0x1, 0x2, 0x0, 0x0, @void}, "1a8d573197df233e9958d0f14bef8274bab84698625a7f40"}}}}}}}, 0x0) accept4(r1, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="300000087aa3fb29b69149c3ac05b73c0db1736a5d13c5cb323b9cc6293c177108940cc555dddd85beda6d923ead5c8ff7403fcfa68241d4f1856b97263be983daa043f3c290db534e4564857a0230d99d094fbb75e660d9c4263832f5535db445f8fcf39890e20ef8ddd3af1dfb2a5f003ac095f22692896aa65cd2a23d77d19125f8ace8795308bf19d9ba2a86cc9e8bf18250ebe7fa8836cdbd4cc57ac5399c6c0ebc5c519891a2c52090884d6ef5f7aaca2949876428ead974d1a8bdb809748d5104bea4", @ANYRES16=r5, @ANYBLOB="cf0004000000ffdbdf251200000008000300", @ANYRES32, @ANYBLOB="08001400", @ANYRES32=0x0, @ANYBLOB="0a0006000802110000000000"], 0x30}, 0x1, 0x0, 0x0, 0x200488c1}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000740)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="2e68e8f815d64d18eae13a0d09d11a42f8f3dd3bd5bdf969ca36aecb5f7ec8a70b85a0f0ae3a2d19c178fd0bb17350ed328c59047bb2c12b2af05741545610dccc0dbe14ef6abb1e73a05e12a5340e4df49401d34ed87872e36d7210298dc1d151a8041f3cf945b227a2fd733870bd41def05acacb2e0a44befb647e10317f089e28ed78dc746887c9d1dcf83b853032d34c0be0f4740e3a1396f4c8cc0ae2e75f82c42799779d44caecaa9b247ff7b70a4b2285b99606097d00dad40d266d2d69f4a1", @ANYRES16=r5, @ANYBLOB="080025bd7000fcdbdf253100000008000300", @ANYRES32=r6, @ANYBLOB="0c009900a60c000055000000"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x40480d0) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) r7 = socket(0x2, 0x2, 0x0) r8 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="1200000080000000080000000200000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000009853d93", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r8}, &(0x7f0000000840), &(0x7f0000000180)=r7}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001d80)={r8, &(0x7f0000001d00), &(0x7f0000001d40)=@tcp=r7, 0x2}, 0x20) r9 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000040)=@mangle={'mangle\x00', 0x64, 0x6, 0x648, 0x0, 0x3d0, 0xd0, 0xd0, 0xd0, 0x578, 0x578, 0x578, 0x578, 0x578, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x3d0}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @mcast2}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0x160, 0x1a8, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private0, @local}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6a8) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000780)=ANY=[@ANYBLOB="1c0000ea0206050000009338fb33dcc52b7a0a367038e9001e00100000050000040501010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) 3m55.457095127s ago: executing program 3 (id=3517): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, r1, 0xf21, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x20000015}, 0x4000) 3m55.225419516s ago: executing program 3 (id=3518): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2], 0x4c}}, 0x4000804) getpid() r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000880)={{{@in6=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@private1}}, &(0x7f00000003c0)=0xe8) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x27}, 0x74) r7 = gettid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x80, '\x00', r5, 0xffffffffffffffff, 0x0, 0x3, 0x2}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000c40)={r9, 0x58, &(0x7f0000000bc0)}, 0x10) sendmmsg$unix(r6, &(0x7f0000000900)=[{{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000640)=[{&(0x7f0000000140)="8bf2a9895b0482298957225db6305cb494040519b2d1c06b91f53f132b1adc54702890f832f197310bd8f797c2666a0fd2025729daf53b1d6ce0e11283bc784c095cb6574b211740df3fff2d6e00f90b5e64aef681af87596fc7d442d452185775636c2110a39449b286b5c739674b4a8fc0fb6ea4c2f3d5f2b19dc0257570c17a6b1573cb49bcf7e0576e7ccb5ee2d51f1dca3141d09189d7d960744ddd15dfd34fe24bce07933c88ac02", 0xab}, {&(0x7f0000000340)="3dea65ab23b8cdfa4115994f5872fbbb34c986bbfb6b2ff4406233bde4fe5ae4a6bb25ae4e0280c16b976d1955816e0240d691a8cc6b300b5ef48d91f20fb1c9ca9155c2e0a8530dbe76ab7b7e946c71142b77ce14905f1054c70026dc360566a252fd5d1e3640e6c97cd1aacad8ab545be67d5b4540e81ee835ba22c7d85de5fbcfb371aa543162fd3355a4f932d2269d73cc47f1abde049ba3fe2fb6866d015982705bd1898ead1d0b1d16452408abd1c106de", 0xb4}, {&(0x7f0000000400)="931a382ac01224a1891e599588d5b25c256e71cfc7b3548c7a38fde905c8b79178867d55ed03440e1453ad75be4cf143618ed03c9519e2efca62fafe78d484", 0x3f}, {&(0x7f0000000200)="4aa6d0e1d22941dd34080ff43e61735c8b2cc854e7e316f9610d872edf0f61a388e96db2cae3e3877a6684721e75a751b40850eb83163711ebf574da09af3ec76173e5265a177592895e438cf1da9d0fe59ba0f8e1", 0x55}, {&(0x7f00000005c0)="b6bff468fdf50b74d64c709601cdc77272af1dbce95d84763065c1d9c93c5145c943b9cc5d2e30cb6295b478d137", 0x2e}], 0x5, &(0x7f0000000880)=[@cred={{0x1c, 0x1, 0x2, {r7, 0x0, r8}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x40, 0x4044005}}], 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, 0x4, 0x2, 0x0, 0x2, 0x0, 0x4}, 0x20) r10 = socket$inet6(0xa, 0x3, 0x75) setsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, &(0x7f0000000100)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2b}, {}, {0x0, 0xfef2}, 0x0, 0x1, 0x1}, {{@in6=@rand_addr=' \x01\x00', 0x0, 0x32}, 0x0, @in=@multicast1}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20, 0x73}, {0xfffffefffffffffd, 0xeca, 0x0, 0x0, 0x0, 0x0, 0x778a, 0xffff}}, {{@in6=@mcast2, 0x4d6, 0x3c}, 0x0, @in=@multicast1}}, 0xe8) close(r10) 3m55.109143108s ago: executing program 3 (id=3520): recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44010000080a000300000000000000000100000a08000b40000000010c0003400000000000000004140104801c0001800b0001006e756d67656e00000c00028008000340000000010c0001800800010064757000140001800c0001006e6f747261636b000400028018000180080001006f7366000c0002800800034000000001100001800b0001006f626a7265660000100001800a00010071756575650000002c000180090001007866726d000000001c000280080001400000000808000440000000050500030002000000600001800a000100696e6e657200000050000280140005800e000100696d6d6564696174650000000800024000000073080001400000000008000240000000070800014000000000080003400000000008000140000000000800034000000003100001800a00010072616e676500000008000a400000000320000000160a030000000000000000000000000a0900010073797a300000000024000000090a050000000000000000000000000108000a40008000020800034000000001140000001100010000000000000000000100000a"], 0x1b0}, 0x1, 0x0, 0x0, 0x20040000}, 0x4801) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448cb, 0x0) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x800000, 0x10008, 0x8}) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) 3m40.052578881s ago: executing program 32 (id=3520): recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44010000080a000300000000000000000100000a08000b40000000010c0003400000000000000004140104801c0001800b0001006e756d67656e00000c00028008000340000000010c0001800800010064757000140001800c0001006e6f747261636b000400028018000180080001006f7366000c0002800800034000000001100001800b0001006f626a7265660000100001800a00010071756575650000002c000180090001007866726d000000001c000280080001400000000808000440000000050500030002000000600001800a000100696e6e657200000050000280140005800e000100696d6d6564696174650000000800024000000073080001400000000008000240000000070800014000000000080003400000000008000140000000000800034000000003100001800a00010072616e676500000008000a400000000320000000160a030000000000000000000000000a0900010073797a300000000024000000090a050000000000000000000000000108000a40008000020800034000000001140000001100010000000000000000000100000a"], 0x1b0}, 0x1, 0x0, 0x0, 0x20040000}, 0x4801) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448cb, 0x0) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x800000, 0x10008, 0x8}) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) 2m26.821836673s ago: executing program 0 (id=4263): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x1003, 0x40, &(0x7f0000000940)=@mangle={'mangle\x00', 0x44, 0x6, 0x458, 0x1f0, 0x310, 0x0, 0x310, 0x98, 0x3c0, 0x3c0, 0x3c0, 0x3c0, 0x3c0, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98, 0x0, {0x0, 0x2000000}}, @inet=@DSCP={0x28}}, {{@ip={@multicast2, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x48}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x10, 0x80, 0x3}}}, {{@ip={@loopback, @local, 0x0, 0x0, 'geneve0\x00', 'veth1_to_team\x00', {}, {}, 0x84, 0x0, 0x3}, 0x0, 0xc0, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x6, 0x5, 0x2, 0x1, 0x0, 0x4], 0x4, 0x1}, {0x4, [0x1, 0x2, 0x7, 0x1, 0x3, 0x4], 0x2}}}}, {{@ip={@empty, @multicast2, 0xff, 0xffffff00, 'vlan1\x00', 'bridge_slave_0\x00', {0xff}, {}, 0x33, 0x2}, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x3, 0x8, @ipv4=@multicast1, 0x5e20}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4b8) 2m26.585782969s ago: executing program 0 (id=4265): r0 = socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r2, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @broadcast}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYBLOB], 0x40}}, 0x40) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x48}}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r7 = accept$alg(r6, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000007040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a030000000000000000000a00ecff0800010073797a300000000074000000160a010100000000000000000a00000008000740000000014000038008000140000000002c000380140001006e657464657673696d300000000000001400010076657468305f766c616e00000000000008000240000000070900010073797a3000000000090002"], 0xbc}}, 0xc0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) recvmmsg(r7, &(0x7f0000006100), 0x49f, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x1000, 0x4, 0x10000000, 0xc}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="2c0000001600156f00000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="1400060000008001ff7f000206230000d7000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x0) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'wrr\x00', 0x38, 0x84, 0x47}, 0x2c) r10 = socket(0x840000000002, 0x3, 0x100) connect$inet(r10, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) 2m26.073822141s ago: executing program 0 (id=4269): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000040)=[{{&(0x7f00000003c0)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000000)="7f", 0x1}], 0x1}}], 0x1, 0x0) listen(r0, 0xfff) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000000c0)={0x5c}, 0x8) accept(r0, 0xfffffffffffffffd, &(0x7f0000000680)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000200)='kmem_cache_free\x00', 0xffffffffffffffff, 0x0, 0x8}, 0x18) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000900)={0x38, r5, 0x601, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x5, 0x2}]}]}]}, 0x38}}, 0xc000) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000006c0)={0x2c, r5, 0x1, 0x80, 0x25dfdbfe, {0xf, 0x0, 0x2d}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6b32}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2805}, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r6, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x52, &(0x7f0000000b80)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00 \x00', 0x1c, 0x2b, 0x0, @remote, @local, {[@routing={0x0, 0x0, 0x2, 0x80}], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={0x6c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8}}, @IPSET_ATTR_CADT_FLAGS={0x8}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r6, 0x0, 0x48a, &(0x7f0000000000)={0x74, 0x7fffffff, 0x3}, 0xc) splice(r6, 0x0, r1, 0x0, 0xfea8, 0x8) shutdown(r6, 0x0) 2m25.098088608s ago: executing program 0 (id=4275): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e21, 0x10000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x101}}}, &(0x7f0000000080)=0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000280)={r3, @in={{0x2, 0x4e23, @multicast2}}, 0x8, 0x8}, 0x90) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80020001000001}, @IFLA_MACSEC_WINDOW={0x8, 0x5, 0x3}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x48890}, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)) (async) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) (async) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e21, 0x10000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x101}}}, &(0x7f0000000080)=0x84) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000280)={r3, @in={{0x2, 0x4e23, @multicast2}}, 0x8, 0x8}, 0x90) (async) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80020001000001}, @IFLA_MACSEC_WINDOW={0x8, 0x5, 0x3}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x48890}, 0x0) (async) 2m24.902262454s ago: executing program 0 (id=4278): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000000500)=[{{0x0, 0x300, &(0x7f0000002e40)=[{&(0x7f0000000340)=""/25, 0x19}, {&(0x7f0000000480)=""/91, 0x5b}, {&(0x7f0000000600)=""/4103, 0x1007}, {&(0x7f0000001a00)=""/126, 0x7e}, {&(0x7f0000000000)=""/206, 0xce}], 0x5}, 0xc}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x80000056}], 0x4, 0x120, 0x0) 2m24.324709719s ago: executing program 0 (id=4281): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="7a0a00ff00000000711081000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb702000008"], 0x0, 0x9, 0x0, 0x0, 0x0, 0xa}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) recvmmsg(r1, &(0x7f0000009280)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2001, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x9}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}]}}}]}, 0x54}}, 0x0) r3 = socket(0x10, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001080)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a320000000008004100"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x400c844) sendmsg$RDMA_NLDEV_CMD_DELLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000580)='kfree\x00', r5}, 0x18) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x2a, &(0x7f0000000100)=r9, 0x4) recvmsg$unix(r7, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) ioctl$int_in(r7, 0x5452, &(0x7f00000000c0)=0x400) sendmsg$inet(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x2404c140) unshare(0x64000600) r10 = socket$inet6(0x10, 0x5, 0x3) write(r10, &(0x7f0000000000)="fc0000001c000705ab092509b86813000aab080102000000b85b0e93210001c0f0060848050000010000000000039815fa2c53c28648000000b937799f377a00bc000c00f0036cdf0db400600033d44000040060b16a482c0a3c313012dafd5a32e273fc83ab82d710f74cec18444ef90d475ef8b2863ef3d92c94170e5bba2e177312e081f691bc5110556888100000463ae4f5df1b394cfd6239ec2a0f0d1bcae5f5502943283f4b9e611183b102b2b8f5566791cb19020191bd0733802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4794eedfca92c09d776e7a90ab79a6f00a1960548deac279c00"/252, 0xfc) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x2, 0x18, @mcast1, @mcast2={0xff, 0x3}, 0x8, 0x80, 0xfffffffe, 0x80}}) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00'}) 2m9.289074942s ago: executing program 33 (id=4281): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="7a0a00ff00000000711081000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb702000008"], 0x0, 0x9, 0x0, 0x0, 0x0, 0xa}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) recvmmsg(r1, &(0x7f0000009280)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2001, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x9}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}]}}}]}, 0x54}}, 0x0) r3 = socket(0x10, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001080)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a320000000008004100"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x400c844) sendmsg$RDMA_NLDEV_CMD_DELLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000580)='kfree\x00', r5}, 0x18) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x2a, &(0x7f0000000100)=r9, 0x4) recvmsg$unix(r7, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) ioctl$int_in(r7, 0x5452, &(0x7f00000000c0)=0x400) sendmsg$inet(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x2404c140) unshare(0x64000600) r10 = socket$inet6(0x10, 0x5, 0x3) write(r10, &(0x7f0000000000)="fc0000001c000705ab092509b86813000aab080102000000b85b0e93210001c0f0060848050000010000000000039815fa2c53c28648000000b937799f377a00bc000c00f0036cdf0db400600033d44000040060b16a482c0a3c313012dafd5a32e273fc83ab82d710f74cec18444ef90d475ef8b2863ef3d92c94170e5bba2e177312e081f691bc5110556888100000463ae4f5df1b394cfd6239ec2a0f0d1bcae5f5502943283f4b9e611183b102b2b8f5566791cb19020191bd0733802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4794eedfca92c09d776e7a90ab79a6f00a1960548deac279c00"/252, 0xfc) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x2, 0x18, @mcast1, @mcast2={0xff, 0x3}, 0x8, 0x80, 0xfffffffe, 0x80}}) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00'}) 1m44.010617215s ago: executing program 2 (id=4582): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ipvlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv6_newaddr={0x2c, 0x14, 0x1, 0x0, 0x0, {0xa, 0x0, 0xa1, 0x0, r2}, [@IFA_ADDRESS={0x14, 0x1, @mcast1={0xff, 0x5}}]}, 0x2c}}, 0x0) 1m43.794891004s ago: executing program 2 (id=4585): socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0x3, 0x300) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)={0x67, 0x5, '\x00', [@ra={0x5, 0x2, 0x5}, @pad1, @hao={0xc9, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}}, @hao={0xc9, 0x10, @mcast2}]}, 0x38) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000000400000008"], 0x48) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e20, @loopback}], 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x0, 0x0, @private0}, @in6={0xa, 0x4e22, 0x1, @mcast1, 0x1}], 0x38) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f00000006c0)=""/102, &(0x7f0000000540)=0x66) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x109140, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000d40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWSET={0x7c, 0x9, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x9}, @NFTA_SET_EXPR={0x1c, 0x11, 0x0, 0x1, @lookup={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_FLAGS={0x8}]}}}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELOBJ={0x1c, 0x14, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x108}, 0x1, 0x0, 0x0, 0x20014840}, 0xc010) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, &(0x7f0000000500)=""/64}, 0x20) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a1100000500420002"], 0x18}}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 1m43.617230669s ago: executing program 2 (id=4588): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000170000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000009b00000095"], &(0x7f0000000540)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r1 = socket$inet_smc(0x2b, 0x1, 0x0) pipe(&(0x7f00000000c0)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x8}, {0x0, [0x0, 0x5f, 0x0, 0x5f, 0x5f, 0x5f]}}, 0x0, 0x20, 0x0, 0x1}, 0x28) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000003840)={'filter\x00', 0x7, 0x4, 0x3f0, 0x110, 0x0, 0x220, 0x308, 0x308, 0x308, 0x4, 0x0, {[{{@arp={@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0xffffff00, 0x2, 0x8, {@mac=@random="a0423ecebbbc", {[0xff, 0xff, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@remote, {[0xff, 0x0, 0xff, 0xff]}}, 0x8, 0x800, 0x5, 0x4, 0x7, 0x10, 'erspan0\x00', 'batadv_slave_1\x00', {0xff}, {0xff}, 0x0, 0x70d}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x1, 0xffffffff}}}, {{@arp={@broadcast, @multicast1, 0xff000000, 0x0, 0x1, 0x0, {@mac, {[0x0, 0x0, 0x0, 0xff]}}, {}, 0x7, 0xfffb, 0x1, 0x3, 0x5, 0x6, 'pim6reg1\x00', 'ipvlan0\x00', {}, {0xff}, 0x0, 0x50}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="59a2f242dbf9", @mac=@random="6480059adaaa", @multicast1, @multicast2, 0xf}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xde4, 0xd, 0x2}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000), 0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f00000047c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="140000006a0001"], 0x14}], 0x1}, 0x0) readv(r4, &(0x7f0000000900)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), r6) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000012c0), r6) sendmsg$NLBL_MGMT_C_REMOVE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, r7, 0x1, 0x70bd2a, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x40000) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x80000000, 0x25dfdbfb, {0xa, 0x80, 0x80}, [@RTA_DST={0x8, 0x1, @local}, @RTA_IIF={0x8}]}, 0x2c}}, 0x20000050) r8 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r9 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000a40)={{0x14, 0x3eb}, [@NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x305, 0x0, 0x0, {0x5, 0x0, 0xa}}], {0x14, 0x3f5}}, 0x3c}, 0x1, 0x0, 0x0, 0x4c0d4}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) connect$802154_dgram(r8, &(0x7f0000000040), 0x14) 1m43.414084153s ago: executing program 2 (id=4590): bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="fcaec7ec02be364ce0050000000000b00000", @ANYRES8, @ANYBLOB="1f0000000000000000000000000000000000000099c9a0b15920db86c60d9606031069cf183ef18f85064567f96915201ff37726b657ae54665e6caac9ffe67643af28cce0282915c3db8e3d9a2f294395dac25c3b1e296de636a5db952bed20ded0a933be6ef9c61b05126c587fb4cf66f6ec979ab9f057b70d4d82df3d301d414f26d933091e79145bdcfabad7c470eca0d40707e4d40172786e742432c2be8474c82881c674c8708beb1837780b3d05bdf3bdc125fe55ebbbcbfc70fde598b82ddd3452b2bead9418c6c5df8293c064aa4a270631aa171e0fb59fdece42895bd781694709f6abcd6e4251443521acef19491b9b34ac3b2ad747c00ab15ab4633228edfd", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000100"/28], 0x50) socket$packet(0x11, 0xa, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r0, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b788061", 0x24, 0x0, &(0x7f0000000540)={0xc9, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmsg$NL80211_CMD_TDLS_OPER(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400", @ANYRES16=0x0, @ANYBLOB="008bd5528901ffdbc425c1e359000000"], 0x4b}, 0x1, 0x0, 0x0, 0x20040084}, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r1) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000000400000008"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x4001, 0x3, 0x4b8, 0x0, 0x0, 0x148, 0x158, 0x148, 0x420, 0x240, 0x240, 0x420, 0x240, 0x7fffffe, 0x0, {[{{@ip={@private=0xa010102, @multicast1, 0x0, 0x0, 'ip6gretap0\x00', 'nicvf0\x00', {}, {}, 0x16, 0x3, 0x10}, 0x0, 0xf8, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'wg1\x00', {0x0, 0x100000, 0x1ff, 0x100000, 0x0, 0xed, 0x7}, {0x4}}}, @common=@unspec=@connmark={{0x30}, {0xfffffff9, 0x7}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0x85d, 0xf, [0x10, 0x32, 0x1e, 0x32, 0x2b, 0x25, 0x3f, 0x17, 0x19, 0x22, 0x2c, 0x3d, 0x7, 0x3f, 0x1e, 0x31], 0x0, 0x2, 0x2}}}, {{@ip={@rand_addr=0x64010101, @local, 0xff, 0x0, 'wg0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0x2e, 0x2, 0x4}, 0x0, 0x260, 0x2c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x8, 0x9, 0x1, 0x1, 'syz1\x00', 0x2}}, @common=@inet=@recent0={{0xf8}, {0x9, 0x7fff, 0x5, 0x0, 'syz0\x00', 0x4}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0xfff, 0x4e, 0x1c, 'netbios-ns\x00', 'syz0\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x518) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x3f8, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x8}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x228, 0x258, 0x0, {}, [@common=@hl={{0x28}, {0x3, 0xdd}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1001, 0x6, 0x3, 0x0, 0x8}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x458) 1m42.515605386s ago: executing program 2 (id=4598): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xc, 0xb, &(0x7f0000000900)=ANY=[@ANYRES8=0x0, @ANYRES16], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000400)='kfree\x00', r0}, 0x18) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) socket$unix(0x1, 0x2, 0x0) (async) socket$unix(0x1, 0x5, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYRESOCT=r1], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r3, 0x0, 0xd}, 0x18) (async) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="180100002d0001000000000000000000050100800c0011002000000000000000140001000000100000000000000000000000000150bb2d6f67d29d6fabadb107d02edef49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e8823f9f3cb639cfb05bc48c26c0a26237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a31daf3697bd7b85b3a682167c43dbf1374875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd10000"], 0x118}], 0x1}, 0x0) (async) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r6, 0x0, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = socket(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) (async) r10 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r10) (async, rerun: 32) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (rerun: 32) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r11, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) (async) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001280)=@newtfilter={0x3c, 0x28, 0xd27, 0x1000001, 0x0, {0x0, 0x0, 0x0, r11, {0xd, 0x9}, {0x6}, {0x3, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_EMATCHES={0x8, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x3c}}, 0x4000) (async) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, 0x0, 0x4) (async, rerun: 32) r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (rerun: 32) ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000000340)={r6, r6, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) (async, rerun: 64) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0300000004000000040000000a", @ANYRESDEC=r4], 0x48) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x7, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1806000002000000f184ec57783fec7efbc98b504000000000000000186200000200000000000000100000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0xfffff7fc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) r13 = socket$inet_smc(0x2b, 0x1, 0x0) (async, rerun: 64) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000000, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xed011000) (rerun: 64) setsockopt$IP_VS_SO_SET_TIMEOUT(r13, 0x0, 0x48a, &(0x7f0000000040)={0x2, 0x4, 0x7fffffff}, 0xc) 1m42.158912017s ago: executing program 2 (id=4601): getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000), 0x10) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) unshare(0x64000600) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="05000000010000008e000000c9e7000001000000596d1ad978fa", @ANYRES32, @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYRES32], 0x48) 1m28.134007379s ago: executing program 6 (id=4679): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040), 0x0, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000000f2c0000000b0a01080000000000000000012300000900020073797a32000000080900010073797a30"], 0xc4}, 0x1, 0x0, 0x0, 0x24008000}, 0x24008004) 1m28.058490938s ago: executing program 6 (id=4681): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)={0x38, r1, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x18]}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x40810) 1m27.915386196s ago: executing program 6 (id=4682): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r2, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb58", 0x6}], 0x2, &(0x7f00000005c0)=[@ip_retopts={{0x1c, 0x0, 0x7, {[@ssrr={0x89, 0xb, 0x4, [@empty, @multicast1]}]}}}], 0x20}, 0x0) 1m27.820180768s ago: executing program 6 (id=4683): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000885000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xd80, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f00000001c0)=[{0x25, 0x0, 0x2, 0x80000009}, {0x1}, {0x0, 0x0, 0x4}, {0x6, 0x0, 0x0, 0x720}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x2, 0x56d, 0x2}, 0x48) socket$packet(0x11, 0xa, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r0, 0x0, 0x0, 0x13, 0x0, &(0x7f00000002c0)=""/19, 0x200, 0x0, 0x5b, 0x5a, &(0x7f0000000840)="b636d1a69328ef64275bf13f64c02360c71e221217904dcfe4365340c3d4dc217d0f0f8943903d208c32c3ce788b04a1396f6773161d23828bf8964c1d23d151c20ac0c8d10a432bbdd8b2b631dc127eb9a8a2494ac8ad6bd7ba60", &(0x7f0000000900)="1f40ee60f5027aaa65965584e07432355f3c607e40d0225335a51ad50fc099ec368756deaaf7a8d344c88123b326fce9d7d96c4a8cc2972678a7aa0452ceb85aaa76d1d9d30526e8847c9b0ec493798de53de058bce8f8199940", 0x5, 0x0, 0x4}, 0x50) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'syz_tun\x00'}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000000400000008"], 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x109140, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000d40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x9}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELOBJ={0x1c, 0x14, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xc8}, 0x1, 0x0, 0x0, 0x20014840}, 0xc010) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, &(0x7f0000000500)=""/64}, 0x20) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000540)='cpuset.effective_mems\x00', 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000a40)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0xfffffffffffffea9, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x4044804) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) 1m27.352973711s ago: executing program 6 (id=4684): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x4c001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a44, 0x1700) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010800007000fe"], 0x2c}, 0x1, 0x0, 0x0, 0x24008000}, 0x8810) 1m27.199380833s ago: executing program 6 (id=4685): unshare(0x68040200) unshare(0x800) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="040000"], 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f00000003c0), r0) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40400d4) unshare(0x20400) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000015c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)='1', 0x1}], 0x1, 0x0, 0x0, 0x4004c}}], 0x1, 0x4884) pipe(&(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x1c, r3, 0xf01, 0xfffffffc, 0x0, {0x5}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r4 = socket$kcm(0xa, 0x2, 0x73) setsockopt$sock_attach_bpf(r4, 0x29, 0x21, &(0x7f0000000200), 0x4) sendmsg$kcm(r4, &(0x7f0000000240)={&(0x7f0000000000)=@un=@file={0x0, './file0\x00'}, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x28}, 0x240400d4) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r5, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x48) sendmsg$kcm(r5, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x23}}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000100000051d833483cc75d51900000000000000004000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r7, 0x0, 0x41, &(0x7f0000000000)=ANY=[@ANYBLOB="73656375726974790000000000000000000000000000ddffffffffffffff000002"], 0x48) 1m27.108297166s ago: executing program 34 (id=4601): getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000), 0x10) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) unshare(0x64000600) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="05000000010000008e000000c9e7000001000000596d1ad978fa", @ANYRES32, @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYRES32], 0x48) 1m20.236160953s ago: executing program 1 (id=3424): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x1d, 0x0, 0x3, 0x80ffffff}, {}, {}, {}, {0x6}]}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000001bc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@iv={0x18}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x50}], 0x1, 0x4c880) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 1m18.577084093s ago: executing program 4 (id=4268): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x108, 0x108, 0x4, [@enum={0x9, 0xa, 0x0, 0x6, 0x4, [{0x7, 0x2}, {0x10, 0x5}, {0x1, 0x5}, {0x1, 0x3}, {0xb, 0x952}, {0xe, 0xffffff3f}, {0xe, 0x6a03}, {0x5, 0x1}, {0x4, 0x2b}, {0x7, 0xe}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x9}}, @const={0xa, 0x0, 0x0, 0xa, 0x2}, @enum={0x10, 0x2, 0x0, 0x6, 0x4, [{0x5}, {0x1, 0xffffaa14}]}, @struct={0xf, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x5, 0x2, 0x2}]}, @struct={0x10, 0x6, 0x0, 0x4, 0x1, 0x0, [{0xd, 0x1, 0x4}, {0x5, 0x5, 0x96e4}, {0x9, 0x5, 0xf3e8}, {0x7, 0x5, 0x1}, {0x0, 0x1, 0x80000001}, {0x1, 0x1, 0x586}]}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000000)=""/23, 0x124, 0x17, 0x1, 0x10, 0x10000}, 0x28) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x3, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000240), &(0x7f0000000280)=@tcp, 0x3}, 0x20) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r1, &(0x7f0000005a40)=[{{&(0x7f0000000340)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000680)=""/156, 0x9c}], 0x1, &(0x7f00000008c0)=""/210, 0xd2}, 0x4}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f00000009c0)=""/84, 0x54}, {&(0x7f0000000a40)=""/159, 0x9f}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/145, 0x91}, {&(0x7f0000000580)=""/62, 0x3e}], 0x6, &(0x7f0000002c40)=""/70, 0x46}, 0x4}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002cc0)=""/56, 0x38}, {&(0x7f0000002d00)=""/50, 0x32}, {&(0x7f0000002d40)=""/196, 0xc4}, {&(0x7f0000002e40)=""/168, 0xa8}, {&(0x7f0000002f00)=""/222, 0xde}], 0x5, &(0x7f0000003080)=""/225, 0xe1}, 0xff}, {{&(0x7f0000003180)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f0000003440)=[{&(0x7f0000003200)=""/43, 0x2b}, {&(0x7f0000003240)=""/61, 0x3d}, {&(0x7f0000003280)=""/129, 0x81}, {&(0x7f0000003340)=""/181, 0xb5}, {&(0x7f0000003400)}], 0x5}, 0x1}, {{&(0x7f00000034c0)=@hci, 0x80, &(0x7f0000003600)=[{&(0x7f0000003540)=""/69, 0x45}, {&(0x7f00000035c0)=""/18, 0x12}], 0x2, &(0x7f0000003640)=""/4096, 0x1000}, 0x400}, {{&(0x7f0000004640)=@ax25={{0x3, @netrom}, [@null, @bcast, @default, @remote, @default, @netrom, @null, @null]}, 0x80, &(0x7f00000056c0)=[{&(0x7f00000046c0)=""/4096, 0x1000}], 0x1, &(0x7f0000005700)=""/31, 0x1f}}, {{&(0x7f0000005740)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000005980)=[{&(0x7f00000057c0)=""/23, 0x17}, {&(0x7f0000005800)=""/106, 0x6a}, {&(0x7f0000005880)=""/162, 0xa2}, {&(0x7f0000005940)=""/27, 0x1b}], 0x4, &(0x7f00000059c0)=""/107, 0x6b}, 0xbb}], 0x7, 0x80, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1fb}, 0x94) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802", 0x15}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x24, 0x22, 0x9, 0x0, 0x0, {0x1}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0xb3bc}]}]}, 0x24}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f00000001c0)="24eff2594b2ee4d92febb676afb5fea7edf92db135519219f5275dda503fd7d269ee28331f8aab918ed05fddb9748702986689d231cf14cf461b5d3c060ef351d1", 0x41, 0x8805, &(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10) 1m12.159113917s ago: executing program 35 (id=4685): unshare(0x68040200) unshare(0x800) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="040000"], 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f00000003c0), r0) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40400d4) unshare(0x20400) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000015c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)='1', 0x1}], 0x1, 0x0, 0x0, 0x4004c}}], 0x1, 0x4884) pipe(&(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x1c, r3, 0xf01, 0xfffffffc, 0x0, {0x5}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r4 = socket$kcm(0xa, 0x2, 0x73) setsockopt$sock_attach_bpf(r4, 0x29, 0x21, &(0x7f0000000200), 0x4) sendmsg$kcm(r4, &(0x7f0000000240)={&(0x7f0000000000)=@un=@file={0x0, './file0\x00'}, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x28}, 0x240400d4) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r5, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x48) sendmsg$kcm(r5, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x23}}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000100000051d833483cc75d51900000000000000004000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r7, 0x0, 0x41, &(0x7f0000000000)=ANY=[@ANYBLOB="73656375726974790000000000000000000000000000ddffffffffffffff000002"], 0x48) 1m10.366213459s ago: executing program 5 (id=4753): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x300, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x4d, 0x0, @wg=@data}}}}}, 0x0) 1m6.699270813s ago: executing program 1 (id=3424): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x1d, 0x0, 0x3, 0x80ffffff}, {}, {}, {}, {0x6}]}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000001bc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@iv={0x18}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x50}], 0x1, 0x4c880) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 1m3.830722838s ago: executing program 4 (id=4268): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x108, 0x108, 0x4, [@enum={0x9, 0xa, 0x0, 0x6, 0x4, [{0x7, 0x2}, {0x10, 0x5}, {0x1, 0x5}, {0x1, 0x3}, {0xb, 0x952}, {0xe, 0xffffff3f}, {0xe, 0x6a03}, {0x5, 0x1}, {0x4, 0x2b}, {0x7, 0xe}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x9}}, @const={0xa, 0x0, 0x0, 0xa, 0x2}, @enum={0x10, 0x2, 0x0, 0x6, 0x4, [{0x5}, {0x1, 0xffffaa14}]}, @struct={0xf, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x5, 0x2, 0x2}]}, @struct={0x10, 0x6, 0x0, 0x4, 0x1, 0x0, [{0xd, 0x1, 0x4}, {0x5, 0x5, 0x96e4}, {0x9, 0x5, 0xf3e8}, {0x7, 0x5, 0x1}, {0x0, 0x1, 0x80000001}, {0x1, 0x1, 0x586}]}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000000)=""/23, 0x124, 0x17, 0x1, 0x10, 0x10000}, 0x28) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x3, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000240), &(0x7f0000000280)=@tcp, 0x3}, 0x20) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r1, &(0x7f0000005a40)=[{{&(0x7f0000000340)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000680)=""/156, 0x9c}], 0x1, &(0x7f00000008c0)=""/210, 0xd2}, 0x4}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f00000009c0)=""/84, 0x54}, {&(0x7f0000000a40)=""/159, 0x9f}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/145, 0x91}, {&(0x7f0000000580)=""/62, 0x3e}], 0x6, &(0x7f0000002c40)=""/70, 0x46}, 0x4}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002cc0)=""/56, 0x38}, {&(0x7f0000002d00)=""/50, 0x32}, {&(0x7f0000002d40)=""/196, 0xc4}, {&(0x7f0000002e40)=""/168, 0xa8}, {&(0x7f0000002f00)=""/222, 0xde}], 0x5, &(0x7f0000003080)=""/225, 0xe1}, 0xff}, {{&(0x7f0000003180)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f0000003440)=[{&(0x7f0000003200)=""/43, 0x2b}, {&(0x7f0000003240)=""/61, 0x3d}, {&(0x7f0000003280)=""/129, 0x81}, {&(0x7f0000003340)=""/181, 0xb5}, {&(0x7f0000003400)}], 0x5}, 0x1}, {{&(0x7f00000034c0)=@hci, 0x80, &(0x7f0000003600)=[{&(0x7f0000003540)=""/69, 0x45}, {&(0x7f00000035c0)=""/18, 0x12}], 0x2, &(0x7f0000003640)=""/4096, 0x1000}, 0x400}, {{&(0x7f0000004640)=@ax25={{0x3, @netrom}, [@null, @bcast, @default, @remote, @default, @netrom, @null, @null]}, 0x80, &(0x7f00000056c0)=[{&(0x7f00000046c0)=""/4096, 0x1000}], 0x1, &(0x7f0000005700)=""/31, 0x1f}}, {{&(0x7f0000005740)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000005980)=[{&(0x7f00000057c0)=""/23, 0x17}, {&(0x7f0000005800)=""/106, 0x6a}, {&(0x7f0000005880)=""/162, 0xa2}, {&(0x7f0000005940)=""/27, 0x1b}], 0x4, &(0x7f00000059c0)=""/107, 0x6b}, 0xbb}], 0x7, 0x80, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1fb}, 0x94) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802", 0x15}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x24, 0x22, 0x9, 0x0, 0x0, {0x1}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0xb3bc}]}]}, 0x24}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f00000001c0)="24eff2594b2ee4d92febb676afb5fea7edf92db135519219f5275dda503fd7d269ee28331f8aab918ed05fddb9748702986689d231cf14cf461b5d3c060ef351d1", 0x41, 0x8805, &(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10) 56.283987044s ago: executing program 5 (id=4753): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x300, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x4d, 0x0, @wg=@data}}}}}, 0x0) 52.422452367s ago: executing program 1 (id=3424): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x1d, 0x0, 0x3, 0x80ffffff}, {}, {}, {}, {0x6}]}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000001bc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@iv={0x18}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x50}], 0x1, 0x4c880) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 50.673509856s ago: executing program 4 (id=4268): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x108, 0x108, 0x4, [@enum={0x9, 0xa, 0x0, 0x6, 0x4, [{0x7, 0x2}, {0x10, 0x5}, {0x1, 0x5}, {0x1, 0x3}, {0xb, 0x952}, {0xe, 0xffffff3f}, {0xe, 0x6a03}, {0x5, 0x1}, {0x4, 0x2b}, {0x7, 0xe}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x9}}, @const={0xa, 0x0, 0x0, 0xa, 0x2}, @enum={0x10, 0x2, 0x0, 0x6, 0x4, [{0x5}, {0x1, 0xffffaa14}]}, @struct={0xf, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x5, 0x2, 0x2}]}, @struct={0x10, 0x6, 0x0, 0x4, 0x1, 0x0, [{0xd, 0x1, 0x4}, {0x5, 0x5, 0x96e4}, {0x9, 0x5, 0xf3e8}, {0x7, 0x5, 0x1}, {0x0, 0x1, 0x80000001}, {0x1, 0x1, 0x586}]}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000000)=""/23, 0x124, 0x17, 0x1, 0x10, 0x10000}, 0x28) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x3, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000240), &(0x7f0000000280)=@tcp, 0x3}, 0x20) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r1, &(0x7f0000005a40)=[{{&(0x7f0000000340)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000680)=""/156, 0x9c}], 0x1, &(0x7f00000008c0)=""/210, 0xd2}, 0x4}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f00000009c0)=""/84, 0x54}, {&(0x7f0000000a40)=""/159, 0x9f}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/145, 0x91}, {&(0x7f0000000580)=""/62, 0x3e}], 0x6, &(0x7f0000002c40)=""/70, 0x46}, 0x4}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002cc0)=""/56, 0x38}, {&(0x7f0000002d00)=""/50, 0x32}, {&(0x7f0000002d40)=""/196, 0xc4}, {&(0x7f0000002e40)=""/168, 0xa8}, {&(0x7f0000002f00)=""/222, 0xde}], 0x5, &(0x7f0000003080)=""/225, 0xe1}, 0xff}, {{&(0x7f0000003180)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f0000003440)=[{&(0x7f0000003200)=""/43, 0x2b}, {&(0x7f0000003240)=""/61, 0x3d}, {&(0x7f0000003280)=""/129, 0x81}, {&(0x7f0000003340)=""/181, 0xb5}, {&(0x7f0000003400)}], 0x5}, 0x1}, {{&(0x7f00000034c0)=@hci, 0x80, &(0x7f0000003600)=[{&(0x7f0000003540)=""/69, 0x45}, {&(0x7f00000035c0)=""/18, 0x12}], 0x2, &(0x7f0000003640)=""/4096, 0x1000}, 0x400}, {{&(0x7f0000004640)=@ax25={{0x3, @netrom}, [@null, @bcast, @default, @remote, @default, @netrom, @null, @null]}, 0x80, &(0x7f00000056c0)=[{&(0x7f00000046c0)=""/4096, 0x1000}], 0x1, &(0x7f0000005700)=""/31, 0x1f}}, {{&(0x7f0000005740)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000005980)=[{&(0x7f00000057c0)=""/23, 0x17}, {&(0x7f0000005800)=""/106, 0x6a}, {&(0x7f0000005880)=""/162, 0xa2}, {&(0x7f0000005940)=""/27, 0x1b}], 0x4, &(0x7f00000059c0)=""/107, 0x6b}, 0xbb}], 0x7, 0x80, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1fb}, 0x94) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802", 0x15}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x24, 0x22, 0x9, 0x0, 0x0, {0x1}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0xb3bc}]}]}, 0x24}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f00000001c0)="24eff2594b2ee4d92febb676afb5fea7edf92db135519219f5275dda503fd7d269ee28331f8aab918ed05fddb9748702986689d231cf14cf461b5d3c060ef351d1", 0x41, 0x8805, &(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10) 44.266660865s ago: executing program 5 (id=4753): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x300, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x4d, 0x0, @wg=@data}}}}}, 0x0) 37.176822782s ago: executing program 1 (id=3424): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x1d, 0x0, 0x3, 0x80ffffff}, {}, {}, {}, {0x6}]}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000001bc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@iv={0x18}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x50}], 0x1, 0x4c880) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 35.587443552s ago: executing program 4 (id=4268): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x108, 0x108, 0x4, [@enum={0x9, 0xa, 0x0, 0x6, 0x4, [{0x7, 0x2}, {0x10, 0x5}, {0x1, 0x5}, {0x1, 0x3}, {0xb, 0x952}, {0xe, 0xffffff3f}, {0xe, 0x6a03}, {0x5, 0x1}, {0x4, 0x2b}, {0x7, 0xe}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x9}}, @const={0xa, 0x0, 0x0, 0xa, 0x2}, @enum={0x10, 0x2, 0x0, 0x6, 0x4, [{0x5}, {0x1, 0xffffaa14}]}, @struct={0xf, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x5, 0x2, 0x2}]}, @struct={0x10, 0x6, 0x0, 0x4, 0x1, 0x0, [{0xd, 0x1, 0x4}, {0x5, 0x5, 0x96e4}, {0x9, 0x5, 0xf3e8}, {0x7, 0x5, 0x1}, {0x0, 0x1, 0x80000001}, {0x1, 0x1, 0x586}]}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000000)=""/23, 0x124, 0x17, 0x1, 0x10, 0x10000}, 0x28) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x3, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000240), &(0x7f0000000280)=@tcp, 0x3}, 0x20) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r1, &(0x7f0000005a40)=[{{&(0x7f0000000340)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000680)=""/156, 0x9c}], 0x1, &(0x7f00000008c0)=""/210, 0xd2}, 0x4}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f00000009c0)=""/84, 0x54}, {&(0x7f0000000a40)=""/159, 0x9f}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/145, 0x91}, {&(0x7f0000000580)=""/62, 0x3e}], 0x6, &(0x7f0000002c40)=""/70, 0x46}, 0x4}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002cc0)=""/56, 0x38}, {&(0x7f0000002d00)=""/50, 0x32}, {&(0x7f0000002d40)=""/196, 0xc4}, {&(0x7f0000002e40)=""/168, 0xa8}, {&(0x7f0000002f00)=""/222, 0xde}], 0x5, &(0x7f0000003080)=""/225, 0xe1}, 0xff}, {{&(0x7f0000003180)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f0000003440)=[{&(0x7f0000003200)=""/43, 0x2b}, {&(0x7f0000003240)=""/61, 0x3d}, {&(0x7f0000003280)=""/129, 0x81}, {&(0x7f0000003340)=""/181, 0xb5}, {&(0x7f0000003400)}], 0x5}, 0x1}, {{&(0x7f00000034c0)=@hci, 0x80, &(0x7f0000003600)=[{&(0x7f0000003540)=""/69, 0x45}, {&(0x7f00000035c0)=""/18, 0x12}], 0x2, &(0x7f0000003640)=""/4096, 0x1000}, 0x400}, {{&(0x7f0000004640)=@ax25={{0x3, @netrom}, [@null, @bcast, @default, @remote, @default, @netrom, @null, @null]}, 0x80, &(0x7f00000056c0)=[{&(0x7f00000046c0)=""/4096, 0x1000}], 0x1, &(0x7f0000005700)=""/31, 0x1f}}, {{&(0x7f0000005740)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000005980)=[{&(0x7f00000057c0)=""/23, 0x17}, {&(0x7f0000005800)=""/106, 0x6a}, {&(0x7f0000005880)=""/162, 0xa2}, {&(0x7f0000005940)=""/27, 0x1b}], 0x4, &(0x7f00000059c0)=""/107, 0x6b}, 0xbb}], 0x7, 0x80, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1fb}, 0x94) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802", 0x15}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x24, 0x22, 0x9, 0x0, 0x0, {0x1}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0xb3bc}]}]}, 0x24}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f00000001c0)="24eff2594b2ee4d92febb676afb5fea7edf92db135519219f5275dda503fd7d269ee28331f8aab918ed05fddb9748702986689d231cf14cf461b5d3c060ef351d1", 0x41, 0x8805, &(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10) 34.244035979s ago: executing program 5 (id=4753): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x300, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x4d, 0x0, @wg=@data}}}}}, 0x0) 23.168754159s ago: executing program 1 (id=3424): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x1d, 0x0, 0x3, 0x80ffffff}, {}, {}, {}, {0x6}]}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000001bc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@iv={0x18}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x50}], 0x1, 0x4c880) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 21.363370892s ago: executing program 4 (id=4268): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x108, 0x108, 0x4, [@enum={0x9, 0xa, 0x0, 0x6, 0x4, [{0x7, 0x2}, {0x10, 0x5}, {0x1, 0x5}, {0x1, 0x3}, {0xb, 0x952}, {0xe, 0xffffff3f}, {0xe, 0x6a03}, {0x5, 0x1}, {0x4, 0x2b}, {0x7, 0xe}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x9}}, @const={0xa, 0x0, 0x0, 0xa, 0x2}, @enum={0x10, 0x2, 0x0, 0x6, 0x4, [{0x5}, {0x1, 0xffffaa14}]}, @struct={0xf, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x5, 0x2, 0x2}]}, @struct={0x10, 0x6, 0x0, 0x4, 0x1, 0x0, [{0xd, 0x1, 0x4}, {0x5, 0x5, 0x96e4}, {0x9, 0x5, 0xf3e8}, {0x7, 0x5, 0x1}, {0x0, 0x1, 0x80000001}, {0x1, 0x1, 0x586}]}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000000)=""/23, 0x124, 0x17, 0x1, 0x10, 0x10000}, 0x28) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x3, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000240), &(0x7f0000000280)=@tcp, 0x3}, 0x20) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r1, &(0x7f0000005a40)=[{{&(0x7f0000000340)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000680)=""/156, 0x9c}], 0x1, &(0x7f00000008c0)=""/210, 0xd2}, 0x4}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f00000009c0)=""/84, 0x54}, {&(0x7f0000000a40)=""/159, 0x9f}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/145, 0x91}, {&(0x7f0000000580)=""/62, 0x3e}], 0x6, &(0x7f0000002c40)=""/70, 0x46}, 0x4}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002cc0)=""/56, 0x38}, {&(0x7f0000002d00)=""/50, 0x32}, {&(0x7f0000002d40)=""/196, 0xc4}, {&(0x7f0000002e40)=""/168, 0xa8}, {&(0x7f0000002f00)=""/222, 0xde}], 0x5, &(0x7f0000003080)=""/225, 0xe1}, 0xff}, {{&(0x7f0000003180)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f0000003440)=[{&(0x7f0000003200)=""/43, 0x2b}, {&(0x7f0000003240)=""/61, 0x3d}, {&(0x7f0000003280)=""/129, 0x81}, {&(0x7f0000003340)=""/181, 0xb5}, {&(0x7f0000003400)}], 0x5}, 0x1}, {{&(0x7f00000034c0)=@hci, 0x80, &(0x7f0000003600)=[{&(0x7f0000003540)=""/69, 0x45}, {&(0x7f00000035c0)=""/18, 0x12}], 0x2, &(0x7f0000003640)=""/4096, 0x1000}, 0x400}, {{&(0x7f0000004640)=@ax25={{0x3, @netrom}, [@null, @bcast, @default, @remote, @default, @netrom, @null, @null]}, 0x80, &(0x7f00000056c0)=[{&(0x7f00000046c0)=""/4096, 0x1000}], 0x1, &(0x7f0000005700)=""/31, 0x1f}}, {{&(0x7f0000005740)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000005980)=[{&(0x7f00000057c0)=""/23, 0x17}, {&(0x7f0000005800)=""/106, 0x6a}, {&(0x7f0000005880)=""/162, 0xa2}, {&(0x7f0000005940)=""/27, 0x1b}], 0x4, &(0x7f00000059c0)=""/107, 0x6b}, 0xbb}], 0x7, 0x80, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1fb}, 0x94) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802", 0x15}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x24, 0x22, 0x9, 0x0, 0x0, {0x1}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0xb3bc}]}]}, 0x24}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f00000001c0)="24eff2594b2ee4d92febb676afb5fea7edf92db135519219f5275dda503fd7d269ee28331f8aab918ed05fddb9748702986689d231cf14cf461b5d3c060ef351d1", 0x41, 0x8805, &(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10) 20.427459455s ago: executing program 5 (id=4753): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x300, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x4d, 0x0, @wg=@data}}}}}, 0x0) 10.098372161s ago: executing program 1 (id=3424): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x1d, 0x0, 0x3, 0x80ffffff}, {}, {}, {}, {0x6}]}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000001bc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@iv={0x18}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x50}], 0x1, 0x4c880) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 7.966081042s ago: executing program 5 (id=4753): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x300, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x4d, 0x0, @wg=@data}}}}}, 0x0) 7.178162641s ago: executing program 4 (id=4268): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x108, 0x108, 0x4, [@enum={0x9, 0xa, 0x0, 0x6, 0x4, [{0x7, 0x2}, {0x10, 0x5}, {0x1, 0x5}, {0x1, 0x3}, {0xb, 0x952}, {0xe, 0xffffff3f}, {0xe, 0x6a03}, {0x5, 0x1}, {0x4, 0x2b}, {0x7, 0xe}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x9}}, @const={0xa, 0x0, 0x0, 0xa, 0x2}, @enum={0x10, 0x2, 0x0, 0x6, 0x4, [{0x5}, {0x1, 0xffffaa14}]}, @struct={0xf, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x5, 0x2, 0x2}]}, @struct={0x10, 0x6, 0x0, 0x4, 0x1, 0x0, [{0xd, 0x1, 0x4}, {0x5, 0x5, 0x96e4}, {0x9, 0x5, 0xf3e8}, {0x7, 0x5, 0x1}, {0x0, 0x1, 0x80000001}, {0x1, 0x1, 0x586}]}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000000)=""/23, 0x124, 0x17, 0x1, 0x10, 0x10000}, 0x28) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0x3, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000240), &(0x7f0000000280)=@tcp, 0x3}, 0x20) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r1, &(0x7f0000005a40)=[{{&(0x7f0000000340)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000680)=""/156, 0x9c}], 0x1, &(0x7f00000008c0)=""/210, 0xd2}, 0x4}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f00000009c0)=""/84, 0x54}, {&(0x7f0000000a40)=""/159, 0x9f}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/145, 0x91}, {&(0x7f0000000580)=""/62, 0x3e}], 0x6, &(0x7f0000002c40)=""/70, 0x46}, 0x4}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002cc0)=""/56, 0x38}, {&(0x7f0000002d00)=""/50, 0x32}, {&(0x7f0000002d40)=""/196, 0xc4}, {&(0x7f0000002e40)=""/168, 0xa8}, {&(0x7f0000002f00)=""/222, 0xde}], 0x5, &(0x7f0000003080)=""/225, 0xe1}, 0xff}, {{&(0x7f0000003180)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f0000003440)=[{&(0x7f0000003200)=""/43, 0x2b}, {&(0x7f0000003240)=""/61, 0x3d}, {&(0x7f0000003280)=""/129, 0x81}, {&(0x7f0000003340)=""/181, 0xb5}, {&(0x7f0000003400)}], 0x5}, 0x1}, {{&(0x7f00000034c0)=@hci, 0x80, &(0x7f0000003600)=[{&(0x7f0000003540)=""/69, 0x45}, {&(0x7f00000035c0)=""/18, 0x12}], 0x2, &(0x7f0000003640)=""/4096, 0x1000}, 0x400}, {{&(0x7f0000004640)=@ax25={{0x3, @netrom}, [@null, @bcast, @default, @remote, @default, @netrom, @null, @null]}, 0x80, &(0x7f00000056c0)=[{&(0x7f00000046c0)=""/4096, 0x1000}], 0x1, &(0x7f0000005700)=""/31, 0x1f}}, {{&(0x7f0000005740)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000005980)=[{&(0x7f00000057c0)=""/23, 0x17}, {&(0x7f0000005800)=""/106, 0x6a}, {&(0x7f0000005880)=""/162, 0xa2}, {&(0x7f0000005940)=""/27, 0x1b}], 0x4, &(0x7f00000059c0)=""/107, 0x6b}, 0xbb}], 0x7, 0x80, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1fb}, 0x94) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802", 0x15}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x24, 0x22, 0x9, 0x0, 0x0, {0x1}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0xb3bc}]}]}, 0x24}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f00000001c0)="24eff2594b2ee4d92febb676afb5fea7edf92db135519219f5275dda503fd7d269ee28331f8aab918ed05fddb9748702986689d231cf14cf461b5d3c060ef351d1", 0x41, 0x8805, &(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10) 3.847213843s ago: executing program 7 (id=5040): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(r2, &(0x7f00000012c0)=""/4096, 0x1000, 0x20, &(0x7f00000000c0)={0xa, 0x4e21, 0x4, @private2, 0x8}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x40004091) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, 0x0, 0x40408b0) r4 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x4, 0xd, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x6, 0xd, 0xb, 0x2, 0x5}]}, &(0x7f0000000300)='GPL\x00', 0x7, 0xb0, &(0x7f0000000540)=""/176, 0x41100, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0x5, 0x2}, 0x8, 0x10, &(0x7f00000006c0)={0x1, 0xe, 0x1, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000780)=[{0x5, 0x5, 0x2, 0x9}], 0x10, 0x5}, 0x94) sendto$inet6(r4, &(0x7f0000000000)="7800000018002507b9409b14ffff00000204be04020506050e0204094300080004000000040010000d0068d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f25232500000", 0x78, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5c300000000fb04003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52e"], 0x448}}, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r5, 0x0, 0x0, 0x0) setsockopt(r5, 0x84, 0x82, &(0x7f00000002c0)="1af3050000f20800", 0x8) nanosleep(0x0, &(0x7f0000000380)) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB='p\rK'], 0x14}}, 0x40006) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r6, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f00000010c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010300000020000000ee15660000080006000200000018000180140002007665746830"], 0x34}}, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x88}}, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) socket(0x10, 0x80002, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="340000003c0007010000000000000000010000000400fc800c00018008000600ffff0000080002800400728008000900", @ANYRES32], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 2.884517151s ago: executing program 7 (id=5044): bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0xa, [@struct]}, {0x0, [0x61, 0x2e, 0x0, 0x6f, 0x61, 0x71, 0x5f, 0x2e]}}, 0x0, 0x2e}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x300, 0xed}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @tracing, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0x0, 0xed}, 0x92f5e}, 0x6d) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0207e80702"], 0x10}}, 0x40044) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@empty, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x57, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x82000000}, {0x7d, 0x0, 0x4}, 0x1, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x33}, 0x2, @in=@broadcast, 0x3507, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0xffffffff, @private0, 0x81}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="38000000180001bd000000000000000002000000fc00bd0900000000060015000200000014001680100008800c00028008"], 0x38}, 0x1, 0x0, 0x0, 0x22004044}, 0x4048080) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 1.943312874s ago: executing program 7 (id=5047): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000004480)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "aaa938", 0x3c, 0x11, 0xff, @remote, @empty, {[@srh={0x4, 0x2, 0x4, 0x1, 0x4, 0x0, 0x8000, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}], {0x4e27, 0x4e23, 0x24, 0x0, @gue={{0x1, 0x1, 0x2, 0x0, 0x0, @void}, "1a8d573197df233e9958d0f14bef8274bab84698625a7f40"}}}}}}}, 0x0) accept4(r1, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="300000087aa3fb29b69149c3ac05b73c0db1736a5d13c5cb323b9cc6293c177108940cc555dddd85beda6d923ead5c8ff7403fcfa68241d4f1856b97263be983daa043f3c290db534e4564857a0230d99d094fbb75e660d9c4263832f5535db445f8fcf39890e20ef8ddd3af1dfb2a5f003ac095f22692896aa65cd2a23d77d19125f8ace8795308bf19d9ba2a86cc9e8bf18250ebe7fa8836cdbd4cc57ac5399c6c0ebc5c519891a2c52090884d6ef5f7aaca2949876428ead974d1a8bdb809748d5104bea4", @ANYRES16=r5, @ANYBLOB="cf0004000000ffdbdf251200000008000300", @ANYRES32, @ANYBLOB="08001400", @ANYRES32=0x0, @ANYBLOB="0a0006000802110000000000"], 0x30}, 0x1, 0x0, 0x0, 0x200488c1}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000740)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="2e68e8f815d64d18eae13a0d09d11a42f8f3dd3bd5bdf969ca36aecb5f7ec8a70b85a0f0ae3a2d19c178fd0bb17350ed328c59047bb2c12b2af05741545610dccc0dbe14ef6abb1e73a05e12a5340e4df49401d34ed87872e36d7210298dc1d151a8041f3cf945b227a2fd733870bd41def05acacb2e0a44befb647e10317f089e28ed78dc746887c9d1dcf83b853032d34c0be0f4740e3a1396f4c8cc0ae2e75f82c42799779d44caecaa9b247ff7b70a4b2285b99606097d00dad40d266d2d69f4a12402d9cf00eabe516533ce19", @ANYRES16=r5, @ANYBLOB="080025bd7000fcdbdf253100000008000300", @ANYRES32=r6, @ANYBLOB="0c009900a60c000055000000"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x40480d0) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x28, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) r7 = socket(0x2, 0x2, 0x0) r8 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="12000000800000000800000002000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000009853d93", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r8}, &(0x7f0000000840), &(0x7f0000000180)=r7}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001d80)={r8, &(0x7f0000001d00), &(0x7f0000001d40)=@tcp=r7, 0x2}, 0x20) r9 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000040)=@mangle={'mangle\x00', 0x64, 0x6, 0x648, 0x0, 0x3d0, 0xd0, 0xd0, 0xd0, 0x578, 0x578, 0x578, 0x578, 0x578, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x3d0}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @mcast2}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0x160, 0x1a8, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private0, @local}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6a8) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000780)=ANY=[@ANYBLOB="1c0000ea0206050000009338fb33dcc52b7a0a3670"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) 1.886552483s ago: executing program 7 (id=5048): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYRES32=r2, @ANYRES16=r2, @ANYBLOB="010326bd6000000000002d"], 0x20}, 0x1, 0x0, 0x0, 0x40954}, 0x20040814) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000180)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x6, 0x8, 0x800, 0x4, 0x131f]}, &(0x7f00000003c0)=0x78) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[], 0xffdd) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x400000000000235, 0x0) 1.381796908s ago: executing program 8 (id=5051): setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea454"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r2, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8983, &(0x7f0000000140)={0x6, 'veth1_to_batadv\x00', {0x81}, 0x5}) 1.333555472s ago: executing program 7 (id=5052): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r3) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xfffffffd, 0x6}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xc, 0x400}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.142990157s ago: executing program 8 (id=5053): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x2c) socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1, 0x4, 0x8, 0xb}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r3 = socket$kcm(0x10, 0x2, 0x0) socket(0x2b, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@remote, 0x8000000, 0x0, 0x1, 0x1}, 0x20) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000140)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac004000202080002000300070004000300eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x300) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000780)={&(0x7f0000000600)='writeback_bdi_register\x00', 0xffffffffffffffff, 0x0, 0x5}, 0x18) 788.1946ms ago: executing program 8 (id=5054): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}}, {{@in=@multicast1}, 0x0, @in=@local}}, 0x9db) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb00000800030003"], 0x68}}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r2, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x1}]}, 0x1c}}, 0x4000084) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7050000080000003c24ff800000000045040400010000001704000001000a00b7040000000100006a0af2fe000000008500000044000000b70000000000000095000000000000009e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8877a6db61d69f2ffcaa10350e11cb97ce8df1bc9a0c4eeceb9171e43405d621ffbc9b0d8ca56b50f0c010d631f6dbc8486bc5d5bf2ca8285056892db03cf1c62dd7c08a90b189d190c341035de53a9a53608c10556e5734eb84049761451ce540c772e069f80cb201b2de17dfdb4b60939d5d6aed4062049b87e03e2cd18568136207304e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d74800000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b59b0fc46d6cec3c080a882add4e1179bd4a44f231a2d73148be428ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286ccca37db965d9dd366598f5ec993cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100d33128954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e117e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6fc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3feec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e01506471e897bced7798509e64df360d95f9a4099f864b0ba45efbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb4e08afbac5397b64aa369922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570c7c00d647daf8af334050b61e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c710bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b3a4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03444471c1dd660c73acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90104c48e41d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f86f276afb2b81da301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3040000002e334319c8979c322e92fbc2c400009f2404b941553843de114fdb03c19d606bd760c40f7f28360820b82d548198041562bcbd9edce223b54cf3c35823f3c446f0a20160ac181c96606dbc967673aca98d6f3837b20fd2809a29ea5e40139a19415f7fc5d852209bdfed74008651752b5e052412d3e00a44417b7caf91a173925a66ee6e30723e73f3b7d66d2a5d09ff40c0bc6e7a5cfef7f327018578892a23014c3629f2e41af619f0d9f0ec8d551415051ff94391c03f3501c928ed7818af61729278f84d4730ef28af4c202e0f175e2a5cbddc8b973e2701b33f1b963025220c04817010b6fb70", @ANYRESHEX], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x32) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b04000000000000000002000000400004803c0001800b00010065787468647200002c0002800800034000000000080001404000000d0500020094000000080006400000000408000440000000170900010073797a30000000000900020073797a32"], 0x94}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) sendmsg$nl_route(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0xa, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x200, 0x80, 0x20000, 0x0, 0x0, 0x8}, 0x45) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r5, 0x0) socket$igmp6(0xa, 0x3, 0x2) r6 = socket$inet_sctp(0x2, 0x1, 0x84) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r7, 0x11, 0x68, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet_udp_encap(r7, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) setsockopt$inet_udp_encap(r7, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000040)={0x84, @remote, 0x15, 0x3, 'wrr\x00', 0x0, 0x4, 0x75}, 0x2c) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r8, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e24, 0x3, 'lc\x00', 0xb, 0x323b, 0x3a}, {@rand_addr=0x64010102, 0x4e23, 0x0, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) socket$inet6_udp(0xa, 0x2, 0x0) 578.103276ms ago: executing program 7 (id=5055): sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000140)=[@in={0x2, 0x0, @private=0xa018101}]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8001}, 0x8) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f0000000080)='v', 0x1}], 0x1) getsockopt$bt_hci(r0, 0x84, 0x7f, &(0x7f0000000080)=""/4057, 0x0) 373.622019ms ago: executing program 8 (id=5056): setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000280)=0x2, 0x4) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x16c}}, 0x24) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="110000000400000004000000"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000157b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r1, 0xffffffffffffffff, 0x500}, 0x57) 122.109052ms ago: executing program 8 (id=5057): unshare(0x2c060000) unshare(0x2c020400) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYRESOCT=r0, @ANYBLOB="41bf0359dedeb1c9a2af5381a5e01b0749a78b97f0047d6f64b166f1c4bdd43a558ca6ce35d71616429ddc0de0190ec6fa84fffe5aff637d197bfbc63394a4dc076cb4b826235b5953a530060efd532bd1f87fde32bd", @ANYRESHEX, @ANYRESHEX=r0, @ANYRESOCT=r0], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x8010, 0xffffffffffffffff, 0x952de000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="070000000000000000000000000000000000000073c4820caad82edcea9d36ae44f2e28787885c90827607bf54fc047feae40e8b2c70aadffe97a3c794a7d0ec36d4de310720318192fd5f69fc9fea9c3ce01ae901be9dbd9e32ff905b283b9834fbf32a3b0db2e7bdec21421d8de0d8a3e0", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000050000000400"/28], 0x50) 0s ago: executing program 8 (id=5058): bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0xa, [@struct]}, {0x0, [0x61, 0x2e, 0x0, 0x6f, 0x61, 0x71, 0x5f, 0x2e]}}, 0x0, 0x2e}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x300, 0xed}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @tracing, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0x0, 0xed}, 0x92f5e}, 0x6d) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0207e80702"], 0x10}}, 0x40044) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@empty, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x57, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x82000000}, {0x7d, 0x0, 0x4}, 0x1, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x33}, 0x2, @in=@broadcast, 0x3507, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0xffffffff, @private0, 0x81}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="38000000180001bd000000000000000002000000fc00bd0900000000060015000200000014001680100008800c00028008"], 0x38}, 0x1, 0x0, 0x0, 0x22004044}, 0x4048080) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) kernel console output (not intermixed with test programs): arent 'hsr' already present! [ 495.797089][T19493] Cannot create hsr debugfs directory [ 495.841684][T19428] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.966306][T19413] 8021q: adding VLAN 0 to HW filter on device bond0 [ 496.051085][T19413] 8021q: adding VLAN 0 to HW filter on device team0 [ 496.199726][T16438] bridge0: port 1(bridge_slave_0) entered blocking state [ 496.206897][T16438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 496.292413][T19428] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 496.323548][T19428] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 496.343130][T16438] bridge0: port 2(bridge_slave_1) entered blocking state [ 496.350297][T16438] bridge0: port 2(bridge_slave_1) entered forwarding state [ 496.372012][T19428] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 496.384463][T19428] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 496.576335][ T5858] Bluetooth: hci4: command tx timeout [ 496.615498][T19493] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 496.661674][T19493] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 496.700879][T19493] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 496.721543][T19571] netlink: 'syz.5.4704': attribute type 10 has an invalid length. [ 496.781004][T19574] netlink: 'syz.5.4704': attribute type 10 has an invalid length. [ 496.800383][T19571] bond0: (slave 0!): Releasing backup interface [ 496.815691][T19571] team0: Port device 0! added [ 496.844732][T19493] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 496.888066][T19574] team0: Port device 0! removed [ 496.901864][ T5858] Bluetooth: hci6: command tx timeout [ 496.920679][T19574] bond0: (slave 0!): Enslaving as an active interface with an up link [ 497.108205][T19428] 8021q: adding VLAN 0 to HW filter on device bond0 [ 497.144980][T19413] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 497.214605][T19428] 8021q: adding VLAN 0 to HW filter on device team0 [ 497.249175][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.256314][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 497.317124][ T79] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.324277][ T79] bridge0: port 2(bridge_slave_1) entered forwarding state [ 497.450858][T19493] 8021q: adding VLAN 0 to HW filter on device bond0 [ 497.463498][T19413] veth0_vlan: entered promiscuous mode [ 497.471934][T19594] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4705'. [ 497.563695][T19493] 8021q: adding VLAN 0 to HW filter on device team0 [ 497.582960][T19413] veth1_vlan: entered promiscuous mode [ 497.607105][T16422] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.614239][T16422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 497.698475][T16422] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.705655][T16422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 497.782606][T19413] veth0_macvtap: entered promiscuous mode [ 497.834066][T19413] veth1_macvtap: entered promiscuous mode [ 497.849832][ T5858] Bluetooth: hci0: command tx timeout [ 497.926661][T19413] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 497.954827][T19413] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 498.026972][T16438] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.046490][T16438] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.094426][T16438] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.138130][T16438] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.342889][T16426] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 498.354076][T16426] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 498.366429][T19428] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 498.406358][T19615] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4710'. [ 498.554224][T16435] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 498.583435][T16435] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 498.594994][T19493] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 498.650411][ T5858] Bluetooth: hci4: command tx timeout [ 498.951555][T19428] veth0_vlan: entered promiscuous mode [ 498.969812][ T5858] Bluetooth: hci6: command tx timeout [ 499.001250][T19428] veth1_vlan: entered promiscuous mode [ 499.094030][T19428] veth0_macvtap: entered promiscuous mode [ 499.127855][T19428] veth1_macvtap: entered promiscuous mode [ 499.186619][T19428] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 499.236088][T19428] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 499.260152][T16426] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.277391][T16426] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.315873][T16426] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.346019][T16426] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.379743][T19493] veth0_vlan: entered promiscuous mode [ 499.464819][T19493] veth1_vlan: entered promiscuous mode [ 499.482179][T16435] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 499.490839][T16435] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 499.557878][T19493] veth0_macvtap: entered promiscuous mode [ 499.577350][T19493] veth1_macvtap: entered promiscuous mode [ 499.598300][T16438] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 499.608364][T16438] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 499.610695][T19493] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 499.652177][T19493] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 499.674911][T16435] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.696766][T16435] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.717601][T16435] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.741642][T16435] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.857837][T16438] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 499.879291][T16438] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 499.909251][ T79] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 499.917086][ T79] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 501.048977][ T5858] Bluetooth: hci6: command tx timeout [ 501.162155][T10626] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 501.171256][T10626] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 501.182518][T10626] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 501.191139][T10626] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 501.199363][T10626] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 501.296763][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.967895][T10626] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 501.981213][T10626] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 501.998822][T10626] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 502.007088][T10626] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 502.015104][T10626] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 502.134881][T19635] chnl_net:caif_netlink_parms(): no params data found [ 502.471973][T19635] bridge0: port 1(bridge_slave_0) entered blocking state [ 502.490554][T19635] bridge0: port 1(bridge_slave_0) entered disabled state [ 502.497812][T19635] bridge_slave_0: entered allmulticast mode [ 502.530863][T19635] bridge_slave_0: entered promiscuous mode [ 502.548456][T19662] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4715'. [ 502.559554][T19635] bridge0: port 2(bridge_slave_1) entered blocking state [ 502.566699][T19635] bridge0: port 2(bridge_slave_1) entered disabled state [ 502.602470][T19635] bridge_slave_1: entered allmulticast mode [ 502.616328][T19635] bridge_slave_1: entered promiscuous mode [ 502.835967][T19635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 502.882150][T19635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 503.071443][T19635] team0: Port device team_slave_0 added [ 503.121694][T19635] team0: Port device team_slave_1 added [ 503.286459][T19635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 503.293557][T10626] Bluetooth: hci0: command tx timeout [ 503.318633][T19635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 503.368462][T19635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 503.382303][T19635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 503.398566][T19635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 503.433251][T19635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 503.591434][T19635] hsr_slave_0: entered promiscuous mode [ 503.621229][T19635] hsr_slave_1: entered promiscuous mode [ 503.627677][T19635] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 503.671335][T19635] Cannot create hsr debugfs directory [ 504.054178][T19688] netlink: 'syz.7.4720': attribute type 10 has an invalid length. [ 504.088873][T10626] Bluetooth: hci4: command tx timeout [ 504.106653][T19654] chnl_net:caif_netlink_parms(): no params data found [ 504.119632][T19691] netlink: 'syz.7.4720': attribute type 10 has an invalid length. [ 504.161889][T19688] team0: Port device dummy0 added [ 504.218759][T19691] team0: Port device dummy0 removed [ 504.234267][T19691] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 504.267278][T19694] Bluetooth: MGMT ver 1.23 [ 504.365641][T19635] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 504.526547][T19635] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 504.672154][T19635] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 504.891600][T19635] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 504.925315][T19654] bridge0: port 1(bridge_slave_0) entered blocking state [ 504.933544][T19654] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.942191][T19654] bridge_slave_0: entered allmulticast mode [ 504.950019][T19654] bridge_slave_0: entered promiscuous mode [ 504.972167][T19654] bridge0: port 2(bridge_slave_1) entered blocking state [ 504.984133][T19654] bridge0: port 2(bridge_slave_1) entered disabled state [ 504.991488][T19654] bridge_slave_1: entered allmulticast mode [ 504.999573][T19654] bridge_slave_1: entered promiscuous mode [ 505.155525][T19654] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 505.192486][T19654] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 505.371344][T10626] Bluetooth: hci0: command tx timeout [ 505.411348][T19654] team0: Port device team_slave_0 added [ 505.419645][T19734] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4734'. [ 505.430166][T19654] team0: Port device team_slave_1 added [ 505.468760][T19734] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4734'. [ 505.591126][T19635] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 505.615162][T19654] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 505.639905][T19654] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 505.697181][T19654] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 505.722749][T19635] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 505.933711][T19635] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 505.956782][T19654] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 505.971877][T19654] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 506.037686][T19654] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 506.077212][T19635] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 506.179945][T10626] Bluetooth: hci4: command tx timeout [ 506.593946][T19654] hsr_slave_0: entered promiscuous mode [ 506.601741][T19654] hsr_slave_1: entered promiscuous mode [ 506.611921][T19654] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 506.638482][T19654] Cannot create hsr debugfs directory [ 506.733160][T19745] ipvlan2: entered promiscuous mode [ 506.739783][T19745] bridge0: port 3(ipvlan2) entered blocking state [ 506.746440][T19745] bridge0: port 3(ipvlan2) entered disabled state [ 506.754155][T19745] ipvlan2: entered allmulticast mode [ 506.760512][T19745] bridge0: entered allmulticast mode [ 506.767472][T19745] ipvlan2: left allmulticast mode [ 506.772808][T19745] bridge0: left allmulticast mode [ 507.250026][T19654] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.332578][T19635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 507.449924][T19766] netlink: 'syz.7.4741': attribute type 10 has an invalid length. [ 507.457825][T10626] Bluetooth: hci0: command tx timeout [ 507.513755][T19654] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.537690][T19768] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.4744'. [ 507.589899][T19635] 8021q: adding VLAN 0 to HW filter on device team0 [ 507.637975][T16435] bridge0: port 1(bridge_slave_0) entered blocking state [ 507.645150][T16435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 507.788313][T19654] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.816611][ T5861] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 507.825816][ T5861] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 507.837027][ T5861] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 507.845626][ T5861] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 507.853641][ T5861] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 507.885289][T19781] sctp: [Deprecated]: syz.5.4746 (pid 19781) Use of int in max_burst socket option. [ 507.885289][T19781] Use struct sctp_assoc_value instead [ 507.920934][T16435] bridge0: port 2(bridge_slave_1) entered blocking state [ 507.928147][T16435] bridge0: port 2(bridge_slave_1) entered forwarding state [ 508.030001][T19654] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 508.250444][ T5861] Bluetooth: hci4: command tx timeout [ 508.360844][T19635] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 508.711181][T19654] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 508.744429][T19654] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 508.792580][T19654] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 508.839378][T19654] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 509.049144][T19635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 509.413953][T19635] veth0_vlan: entered promiscuous mode [ 509.455100][T19635] veth1_vlan: entered promiscuous mode [ 509.488136][T19654] 8021q: adding VLAN 0 to HW filter on device bond0 [ 509.512249][T10626] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 509.521364][T10626] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 509.529039][ T5853] Bluetooth: hci0: command tx timeout [ 509.534776][ T5853] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 509.547296][ T5853] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 509.556453][ T5853] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 509.590681][T19778] chnl_net:caif_netlink_parms(): no params data found [ 509.750533][T19654] 8021q: adding VLAN 0 to HW filter on device team0 [ 509.768101][T19635] veth0_macvtap: entered promiscuous mode [ 509.838061][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.845245][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 509.858237][T19635] veth1_macvtap: entered promiscuous mode [ 509.926179][T16422] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.933305][T16422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 509.940845][ T5853] Bluetooth: hci7: command tx timeout [ 509.988123][T19778] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.995569][T19778] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.003242][T19778] bridge_slave_0: entered allmulticast mode [ 510.011549][T19778] bridge_slave_0: entered promiscuous mode [ 510.044616][T19635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 510.079458][T19778] bridge0: port 2(bridge_slave_1) entered blocking state [ 510.090379][T19778] bridge0: port 2(bridge_slave_1) entered disabled state [ 510.097627][T19778] bridge_slave_1: entered allmulticast mode [ 510.121023][T19778] bridge_slave_1: entered promiscuous mode [ 510.213049][T19635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 510.286827][T19778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 510.327558][T19778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 510.339367][ T5853] Bluetooth: hci4: command tx timeout [ 510.413986][T19833] netlink: 'syz.7.4758': attribute type 10 has an invalid length. [ 510.461865][T16422] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.487228][T16422] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.528336][T19833] bond0: (slave dummy0): Releasing backup interface [ 510.543728][T19833] team0: Port device dummy0 added [ 510.554450][T19778] team0: Port device team_slave_0 added [ 510.571929][T19778] team0: Port device team_slave_1 added [ 510.613575][T16422] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.629663][T16422] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.849758][T19778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 510.864172][T19778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 510.911902][T19778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 510.951999][T19778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 510.978281][T19778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 511.099723][T19778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 511.221982][T19852] netlink: 176 bytes leftover after parsing attributes in process `syz.7.4759'. [ 511.258128][T19778] hsr_slave_0: entered promiscuous mode [ 511.265361][T19778] hsr_slave_1: entered promiscuous mode [ 511.271997][T19778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 511.280450][T19778] Cannot create hsr debugfs directory [ 511.403923][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 511.420990][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 511.432209][T19654] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 511.608995][ T5853] Bluetooth: hci5: command tx timeout [ 511.641219][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 511.670696][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 512.012353][ T5853] Bluetooth: hci7: command tx timeout [ 512.155076][T19818] chnl_net:caif_netlink_parms(): no params data found [ 512.503558][T19778] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 512.582533][T19654] veth0_vlan: entered promiscuous mode [ 512.604752][T19654] veth1_vlan: entered promiscuous mode [ 512.624160][T19778] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 512.639978][T19778] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 512.720231][T19818] bridge0: port 1(bridge_slave_0) entered blocking state [ 512.737537][T19818] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.759378][T19818] bridge_slave_0: entered allmulticast mode [ 512.778711][T19818] bridge_slave_0: entered promiscuous mode [ 512.791952][T19818] bridge0: port 2(bridge_slave_1) entered blocking state [ 512.813797][T19818] bridge0: port 2(bridge_slave_1) entered disabled state [ 512.824005][T19818] bridge_slave_1: entered allmulticast mode [ 512.840651][T19818] bridge_slave_1: entered promiscuous mode [ 512.869373][T19778] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 513.001781][T19818] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 513.071449][T19818] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 513.188465][T19818] team0: Port device team_slave_0 added [ 513.209900][T19818] team0: Port device team_slave_1 added [ 513.324064][T19654] veth0_macvtap: entered promiscuous mode [ 513.351937][T19654] veth1_macvtap: entered promiscuous mode [ 513.373029][T19818] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 513.388908][T19818] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 513.438812][T19818] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 513.492096][T19818] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 513.508660][T19818] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 513.557966][T19818] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 513.689643][ T5853] Bluetooth: hci5: command tx timeout [ 513.731474][T19818] hsr_slave_0: entered promiscuous mode [ 513.738194][T19818] hsr_slave_1: entered promiscuous mode [ 513.745946][T19818] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 513.754568][T19818] Cannot create hsr debugfs directory [ 513.804244][T19654] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 513.889544][T19654] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 513.956551][T16438] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.982246][T16428] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.034012][T16428] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.059154][T16428] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.094637][ T5853] Bluetooth: hci7: command tx timeout [ 514.330208][T19778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 514.482826][T19778] 8021q: adding VLAN 0 to HW filter on device team0 [ 514.541328][T16433] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.558786][T16433] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.617701][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 514.624994][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 514.762300][T16433] bridge0: port 2(bridge_slave_1) entered blocking state [ 514.769474][T16433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 514.834871][T16428] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.858904][T16428] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.927977][T19778] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 514.962664][T19778] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 515.096786][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 515.117805][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 515.126145][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 515.135703][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 515.145295][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 515.260164][T19818] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 515.330621][T19818] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 515.381389][T19818] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 515.389425][T19879] FAULT_INJECTION: forcing a failure. [ 515.389425][T19879] name failslab, interval 1, probability 0, space 0, times 0 [ 515.425821][T19879] CPU: 0 UID: 0 PID: 19879 Comm: syz.7.4760 Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 515.425847][T19879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 515.425860][T19879] Call Trace: [ 515.425868][T19879] [ 515.425877][T19879] dump_stack_lvl+0x189/0x250 [ 515.425905][T19879] ? __pfx____ratelimit+0x10/0x10 [ 515.425932][T19879] ? __pfx_dump_stack_lvl+0x10/0x10 [ 515.425956][T19879] ? __pfx__printk+0x10/0x10 [ 515.425989][T19879] ? __pfx___might_resched+0x10/0x10 [ 515.426012][T19879] ? fs_reclaim_acquire+0x7d/0x100 [ 515.426045][T19879] should_fail_ex+0x414/0x560 [ 515.426078][T19879] ? nf_hook_entries_grow+0x27c/0x710 [ 515.426102][T19879] should_failslab+0xa8/0x100 [ 515.426130][T19879] __kvmalloc_node_noprof+0x161/0x5f0 [ 515.426156][T19879] ? nf_hook_entries_grow+0x27c/0x710 [ 515.426186][T19879] nf_hook_entries_grow+0x27c/0x710 [ 515.426227][T19879] __nf_register_net_hook+0x2c9/0x930 [ 515.426264][T19879] nf_register_net_hook+0xb2/0x190 [ 515.426293][T19879] nf_register_net_hooks+0x44/0x1b0 [ 515.426328][T19879] nf_ct_netns_do_get+0x3bf/0x5a0 [ 515.426355][T19879] ? nf_ct_iterate_cleanup_net+0x9f/0xd0 [ 515.426393][T19879] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 515.426418][T19879] ? nf_ct_netns_do_get+0x4da/0x5a0 [ 515.426456][T19879] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 515.426495][T19879] nf_ct_netns_inet_get+0x1f/0x150 [ 515.426527][T19879] nf_ct_netns_get+0x5b/0xb0 [ 515.426554][T19879] nft_connlimit_do_init+0x1de/0x2e0 [ 515.426588][T19879] nft_set_elem_expr_alloc+0x1db/0x590 [ 515.426627][T19879] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 515.426665][T19879] ? nft_rhash_init+0x2d1/0x3a0 [ 515.426693][T19879] ? __pfx_nft_rhash_init+0x10/0x10 [ 515.426719][T19879] ? __pfx_nft_rhash_key+0x10/0x10 [ 515.426743][T19879] ? __pfx_nft_rhash_obj+0x10/0x10 [ 515.426767][T19879] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 515.426797][T19879] nft_set_expr_alloc+0x397/0x760 [ 515.426828][T19879] nf_tables_newset+0x1c47/0x2530 [ 515.426872][T19879] ? __pfx_nf_tables_newset+0x10/0x10 [ 515.426925][T19879] ? __nla_parse+0x40/0x60 [ 515.426950][T19879] nfnetlink_rcv+0x112f/0x2520 [ 515.427005][T19879] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 515.427043][T19879] ? ref_tracker_free+0x63a/0x7d0 [ 515.427093][T19879] ? __netlink_deliver_tap+0x807/0x850 [ 515.427130][T19879] ? netlink_deliver_tap+0x2e/0x1b0 [ 515.427155][T19879] ? netlink_deliver_tap+0x2e/0x1b0 [ 515.427188][T19879] netlink_unicast+0x758/0x8d0 [ 515.427223][T19879] netlink_sendmsg+0x805/0xb30 [ 515.427260][T19879] ? __pfx_netlink_sendmsg+0x10/0x10 [ 515.427291][T19879] ? aa_sock_msg_perm+0x94/0x160 [ 515.427322][T19879] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 515.427384][T19879] ? __pfx_netlink_sendmsg+0x10/0x10 [ 515.427536][T19879] __sock_sendmsg+0x219/0x270 [ 515.427568][T19879] ____sys_sendmsg+0x505/0x830 [ 515.427611][T19879] ? __pfx_____sys_sendmsg+0x10/0x10 [ 515.427659][T19879] ? import_iovec+0x74/0xa0 [ 515.427692][T19879] ___sys_sendmsg+0x21f/0x2a0 [ 515.427717][T19879] ? __pfx____sys_sendmsg+0x10/0x10 [ 515.427786][T19879] ? __fget_files+0x2a/0x420 [ 515.427816][T19879] ? __fget_files+0x3a0/0x420 [ 515.427860][T19879] __x64_sys_sendmsg+0x19b/0x260 [ 515.427887][T19879] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 515.427921][T19879] ? __pfx_ksys_write+0x10/0x10 [ 515.427946][T19879] ? rcu_is_watching+0x15/0xb0 [ 515.427979][T19879] ? do_syscall_64+0xbe/0x3b0 [ 515.428016][T19879] do_syscall_64+0xfa/0x3b0 [ 515.428045][T19879] ? lockdep_hardirqs_on+0x9c/0x150 [ 515.428074][T19879] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.428097][T19879] ? clear_bhb_loop+0x60/0xb0 [ 515.428125][T19879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.428148][T19879] RIP: 0033:0x7fa1feb8e929 [ 515.428168][T19879] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 515.428188][T19879] RSP: 002b:00007fa1ff9a7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 515.428212][T19879] RAX: ffffffffffffffda RBX: 00007fa1fedb5fa0 RCX: 00007fa1feb8e929 [ 515.428229][T19879] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 515.428244][T19879] RBP: 00007fa1ff9a7090 R08: 0000000000000000 R09: 0000000000000000 [ 515.428258][T19879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 515.428272][T19879] R13: 0000000000000000 R14: 00007fa1fedb5fa0 R15: 00007ffeeeafa2d8 [ 515.428309][T19879] [ 515.439886][T19818] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 515.833774][ T5853] Bluetooth: hci5: command tx timeout [ 516.169195][ T5853] Bluetooth: hci7: command tx timeout [ 516.184084][T19778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 516.315881][T19818] 8021q: adding VLAN 0 to HW filter on device bond0 [ 516.365880][T19818] 8021q: adding VLAN 0 to HW filter on device team0 [ 516.467948][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 516.475120][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 516.491820][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 516.498972][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 516.703697][T19874] chnl_net:caif_netlink_parms(): no params data found [ 516.905872][T19778] veth0_vlan: entered promiscuous mode [ 516.968466][T19778] veth1_vlan: entered promiscuous mode [ 517.180288][T19874] bridge0: port 1(bridge_slave_0) entered blocking state [ 517.208436][T19874] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.211562][ T5853] Bluetooth: hci0: command tx timeout [ 517.238826][T19874] bridge_slave_0: entered allmulticast mode [ 517.246586][T19874] bridge_slave_0: entered promiscuous mode [ 517.281084][T19874] bridge0: port 2(bridge_slave_1) entered blocking state [ 517.327351][T19874] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.349499][T19874] bridge_slave_1: entered allmulticast mode [ 517.391933][T19874] bridge_slave_1: entered promiscuous mode [ 517.526545][T19906] tipc: Enabling of bearer rejected, failed to enable media [ 517.597877][T19818] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 517.685933][T19874] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 517.747312][T19874] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 517.811755][ T5861] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 517.824878][ T5861] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 517.833988][ T5861] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 517.843188][ T5861] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 517.853878][ T5861] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 517.933341][ T5861] Bluetooth: hci5: command tx timeout [ 517.953734][T19874] team0: Port device team_slave_0 added [ 517.989479][T19874] team0: Port device team_slave_1 added [ 518.001252][T19778] veth0_macvtap: entered promiscuous mode [ 518.085365][T19778] veth1_macvtap: entered promiscuous mode [ 518.110350][T19874] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 518.117321][T19874] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 518.145122][T19874] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 518.161890][T19874] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 518.169490][T19874] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 518.202941][T19874] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 518.228497][T19778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 518.387888][T19874] hsr_slave_0: entered promiscuous mode [ 518.394884][T19874] hsr_slave_1: entered promiscuous mode [ 518.401681][T19874] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 518.410213][T19874] Cannot create hsr debugfs directory [ 518.433097][T19778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 518.644085][T16433] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.747968][T16433] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.767132][T16433] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.813472][T16433] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.847691][T19818] veth0_vlan: entered promiscuous mode [ 518.976714][T19939] netlink: 44 bytes leftover after parsing attributes in process `syz.7.4767'. [ 518.989718][T19939] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4767'. [ 519.003949][T19939] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4767'. [ 519.043356][T19818] veth1_vlan: entered promiscuous mode [ 519.267563][ T30] audit: type=1107 audit(1752045895.121:9): pid=19943 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='g¤'ÿî²"wÈÅÁ`úi‹·Þ™’jÃlŸeÒåd‹t|z˜NâLøŠ>Ñ>/V§ ŠU'”ÉÎ äöp½ [ 519.267563][ T30] š“(ÝÒèüÀ Ìyõ³q¹')KQQ8Í¡+aë{¥+àí90-Ú“½ÃdŠSÆ¥î%äÊÎwÉC§w÷4$á½ðGzÌ﹞Æ#f·4!×2 HyãB¨•ˆð11øKÄ«s>ÒÊÏÅã¦$ÓºÛ™á¶hM56 3³¸åïÅD‰„ª6гá.ù¶Ù@’—\žâJ-m¸!•Wf?€Ö’KËS¶%8-P²‰@{léxP…qâh'^ä#A2#NÉ8PÐ(À,)Ÿjð [ 519.267563][ T30] ùkS¨Â¢j:Í ‚·ºnþ%w¦ž.‡À˜ŽÄ š1Õ…”U¥bbV’‘#ég ¼yj'ì~þã{ñÿ“Vÿ\ˈc{OºÆ¬‚,$v0É iO\/ùO|Ý;ÑÔAŒ›3«Þf‚t£N«zYÝ^èq©CEóûØkº­E€ Õ½©â5“]½éìÇëÞ@£©çJ ¤¬Pï¼MÚ°ŒPÙ€š"çÉ-Õlæ656iV[ïV¯?\ mFñ¡âs8Œs™È-ÇÔª™' [ 519.334557][T19874] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.347088][ T5861] Bluetooth: hci0: command tx timeout [ 519.379253][T16428] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 519.387076][T16428] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 519.469858][T19874] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.584160][T19874] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.606258][T16428] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 519.620371][T16428] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 519.753823][T19874] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.767354][T19951] netlink: 308 bytes leftover after parsing attributes in process `syz.7.4771'. [ 519.869797][T19818] veth0_macvtap: entered promiscuous mode [ 519.877107][T19919] chnl_net:caif_netlink_parms(): no params data found [ 519.931269][ T5861] Bluetooth: hci4: command tx timeout [ 519.977152][T19818] veth1_macvtap: entered promiscuous mode [ 520.244880][T19919] bridge0: port 1(bridge_slave_0) entered blocking state [ 520.253475][T19919] bridge0: port 1(bridge_slave_0) entered disabled state [ 520.261883][T19919] bridge_slave_0: entered allmulticast mode [ 520.270159][T19919] bridge_slave_0: entered promiscuous mode [ 520.280926][T19919] bridge0: port 2(bridge_slave_1) entered blocking state [ 520.288189][T19919] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.308479][T19919] bridge_slave_1: entered allmulticast mode [ 520.320450][T19919] bridge_slave_1: entered promiscuous mode [ 520.423663][T19961] netlink: 'syz.7.4773': attribute type 10 has an invalid length. [ 520.445150][T19818] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 520.474326][T19919] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 520.493651][T19874] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 520.514442][T19961] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.522586][T19961] bridge_slave_1: left allmulticast mode [ 520.528301][T19961] bridge_slave_1: left promiscuous mode [ 520.538891][T19961] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.555353][T19961] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 520.574944][T19919] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 520.630271][T19874] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 520.652688][T19874] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 520.731229][T19874] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 520.751637][T19818] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 520.806561][T19919] team0: Port device team_slave_0 added [ 520.833838][T16433] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.859776][T16433] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.885799][T19975] netlink: 60 bytes leftover after parsing attributes in process `syz.8.4775'. [ 520.886101][T19919] team0: Port device team_slave_1 added [ 521.086104][T16433] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.095282][T16433] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.151894][T19919] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 521.159072][T19919] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 521.215567][T19919] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 521.228718][T19919] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 521.235700][T19919] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 521.270936][T19919] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 521.354987][T19977] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4776'. [ 521.369197][ T5861] Bluetooth: hci0: command tx timeout [ 521.519549][T19919] hsr_slave_0: entered promiscuous mode [ 521.526366][T19919] hsr_slave_1: entered promiscuous mode [ 521.535123][T19919] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 521.543402][T19919] Cannot create hsr debugfs directory [ 521.551486][T19978] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4776'. [ 521.913628][T16433] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.938823][T16433] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.959111][T14351] IPVS: starting estimator thread 0... [ 522.008725][ T5861] Bluetooth: hci4: command tx timeout [ 522.078994][T19993] IPVS: using max 29 ests per chain, 69600 per kthread [ 522.186621][T16433] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 522.213343][T16433] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 522.215285][T19998] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4781'. [ 522.221434][T14351] IPVS: starting estimator thread 0... [ 522.318252][T19919] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.339811][T19999] IPVS: using max 29 ests per chain, 69600 per kthread [ 522.429617][T19874] 8021q: adding VLAN 0 to HW filter on device bond0 [ 522.526766][T19919] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.645625][T19919] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.673756][ T30] audit: type=1800 audit(1752045898.531:10): pid=20009 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.4786" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=216 res=0 errno=0 [ 522.731560][ T30] audit: type=1804 audit(1752045898.561:11): pid=20009 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.4786" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=216 res=1 errno=0 [ 522.734747][T19874] 8021q: adding VLAN 0 to HW filter on device team0 [ 522.803381][T16428] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.810564][T16428] bridge0: port 1(bridge_slave_0) entered forwarding state [ 522.850736][T19919] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.915114][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 522.922289][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 522.962730][T20013] bridge0: port 3(erspan0) entered blocking state [ 522.997236][T20013] bridge0: port 3(erspan0) entered disabled state [ 523.029526][T20013] erspan0: entered allmulticast mode [ 523.036368][T20013] erspan0: entered promiscuous mode [ 523.062511][T20013] bridge0: port 3(erspan0) entered blocking state [ 523.069258][T20013] bridge0: port 3(erspan0) entered forwarding state [ 523.104694][T20014] erspan0: left allmulticast mode [ 523.118777][T20014] erspan0: left promiscuous mode [ 523.124569][T20014] bridge0: port 3(erspan0) entered disabled state [ 523.157007][T20018] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4789'. [ 523.449738][ T5861] Bluetooth: hci0: command tx timeout [ 523.471086][T19919] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 523.491592][T20025] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4790'. [ 523.492897][T19919] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 523.543271][T19919] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 523.564116][T19919] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 523.894629][T19919] 8021q: adding VLAN 0 to HW filter on device bond0 [ 523.947128][T19919] 8021q: adding VLAN 0 to HW filter on device team0 [ 523.982551][T16422] bridge0: port 1(bridge_slave_0) entered blocking state [ 523.989724][T16422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 524.041167][T16433] bridge0: port 2(bridge_slave_1) entered blocking state [ 524.048270][T16433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 524.090052][ T5861] Bluetooth: hci4: command tx timeout [ 524.150813][T19874] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 524.238277][ T5853] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 524.262493][ T5853] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 524.270279][ T5853] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 524.284263][ T5853] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 524.292933][ T5853] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 524.388711][T19874] veth0_vlan: entered promiscuous mode [ 524.404962][T20048] netlink: 'syz.7.4795': attribute type 72 has an invalid length. [ 524.462773][T19874] veth1_vlan: entered promiscuous mode [ 524.610953][T19874] veth0_macvtap: entered promiscuous mode [ 524.655160][T19874] veth1_macvtap: entered promiscuous mode [ 524.705492][T19919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 524.787361][T19874] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 524.873734][T19874] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 525.000241][T16433] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.021215][T16433] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.067929][T20063] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4800'. [ 525.100437][ T79] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.130578][ T79] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.215023][T20065] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4800'. [ 525.583645][T20075] netlink: 'syz.8.4801': attribute type 10 has an invalid length. [ 525.657903][T20075] team0: Port device dummy0 added [ 525.689113][T20083] netlink: 'syz.8.4801': attribute type 10 has an invalid length. [ 525.767373][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 525.777043][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 525.889547][T20083] team0: Port device dummy0 removed [ 525.909428][T20083] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 526.051706][T16426] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 526.075182][T16426] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 526.120653][T20044] chnl_net:caif_netlink_parms(): no params data found [ 526.168881][ T5853] Bluetooth: hci4: command tx timeout [ 526.255875][T19919] veth0_vlan: entered promiscuous mode [ 526.328838][ T5853] Bluetooth: hci5: command tx timeout [ 526.571086][T19919] veth1_vlan: entered promiscuous mode [ 526.792401][T20044] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.819071][T20044] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.826594][T20044] bridge_slave_0: entered allmulticast mode [ 526.860753][T20044] bridge_slave_0: entered promiscuous mode [ 526.908755][T20044] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.915887][T20044] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.944364][T20044] bridge_slave_1: entered allmulticast mode [ 526.953332][T20044] bridge_slave_1: entered promiscuous mode [ 527.034883][T20044] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 527.068367][T19919] veth0_macvtap: entered promiscuous mode [ 527.090132][T20044] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 527.123170][T19919] veth1_macvtap: entered promiscuous mode [ 527.155253][T20044] team0: Port device team_slave_0 added [ 527.169337][T20044] team0: Port device team_slave_1 added [ 527.222128][T20044] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 527.230096][T20044] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 527.256546][T20044] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 527.274133][T19919] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 527.283578][T20044] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 527.296074][T20044] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 527.322361][T20044] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 527.347282][T19919] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 527.411625][T16422] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.421803][T16422] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.441586][T20044] hsr_slave_0: entered promiscuous mode [ 527.448296][T20044] hsr_slave_1: entered promiscuous mode [ 527.455853][T20044] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 527.463981][T20044] Cannot create hsr debugfs directory [ 527.485871][T16422] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.501278][T16422] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.708157][T16422] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.718844][T16422] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.795304][T20044] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.838995][T16438] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.846830][T16438] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.901654][T20044] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.987213][T20044] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.076140][T20044] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.281191][T20044] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 528.317207][T20044] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 528.342094][T20044] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 528.364392][T20044] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 528.410583][ T5853] Bluetooth: hci5: command tx timeout [ 528.526588][ T30] audit: type=1800 audit(1752045904.381:12): pid=20119 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.4808" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=274 res=0 errno=0 [ 528.605978][ T30] audit: type=1804 audit(1752045904.391:13): pid=20119 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.4808" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=274 res=1 errno=0 [ 528.646910][T20121] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.4807'. [ 528.692467][T20044] 8021q: adding VLAN 0 to HW filter on device bond0 [ 528.756953][T20044] 8021q: adding VLAN 0 to HW filter on device team0 [ 528.789912][T16433] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.797047][T16433] bridge0: port 1(bridge_slave_0) entered forwarding state [ 528.860783][T16433] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.867893][T16433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 529.064462][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 529.079005][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 529.087166][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 529.096595][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 529.104692][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 529.269199][T20044] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 530.045642][T20125] chnl_net:caif_netlink_parms(): no params data found [ 530.135021][T20147] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4812'. [ 530.150790][T20147] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4812'. [ 530.151191][ T5861] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 530.165524][T20147] netlink: 'syz.8.4812': attribute type 5 has an invalid length. [ 530.184589][ T5861] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 530.195809][ T5861] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 530.204306][ T5861] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 530.212390][ T5861] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 530.234164][ T79] netdevsim netdevsim8 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.246455][ T79] netdevsim netdevsim8 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.256082][ T79] netdevsim netdevsim8 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.273635][T20152] netlink: 132 bytes leftover after parsing attributes in process `syz.8.4812'. [ 530.339465][ T79] netdevsim netdevsim8 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 530.411255][T20044] veth0_vlan: entered promiscuous mode [ 530.491867][ T5853] Bluetooth: hci5: command tx timeout [ 530.521572][T20160] netlink: 44 bytes leftover after parsing attributes in process `syz.8.4815'. [ 530.536921][T20044] veth1_vlan: entered promiscuous mode [ 530.628953][T20125] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.653419][T20125] bridge0: port 1(bridge_slave_0) entered disabled state [ 530.666547][T20125] bridge_slave_0: entered allmulticast mode [ 530.692185][T20125] bridge_slave_0: entered promiscuous mode [ 530.709966][T20125] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.720266][T20125] bridge0: port 2(bridge_slave_1) entered disabled state [ 530.735673][T20125] bridge_slave_1: entered allmulticast mode [ 530.750019][T20125] bridge_slave_1: entered promiscuous mode [ 530.960828][T20125] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 531.012367][T20125] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 531.129376][ T5853] Bluetooth: hci0: command tx timeout [ 531.165588][T20125] team0: Port device team_slave_0 added [ 531.203738][T20125] team0: Port device team_slave_1 added [ 531.216698][T20171] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.4819'. [ 531.318159][T20044] veth0_macvtap: entered promiscuous mode [ 531.351220][T20169] netlink: 'syz.7.4818': attribute type 10 has an invalid length. [ 531.392593][T20125] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 531.419041][T20177] netlink: 'syz.7.4818': attribute type 10 has an invalid length. [ 531.426917][T20125] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 531.470098][ T30] audit: type=1800 audit(1752045907.321:14): pid=20179 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.4820" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=160 res=0 errno=0 [ 531.509205][T20125] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 531.533425][T20125] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 531.545974][ T30] audit: type=1804 audit(1752045907.321:15): pid=20179 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.4820" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=160 res=1 errno=0 [ 531.578851][T20125] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 531.620759][T20125] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 531.659426][T20177] team0: Port device dummy0 removed [ 531.685340][T20177] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 531.722109][T20044] veth1_macvtap: entered promiscuous mode [ 531.971208][T20125] hsr_slave_0: entered promiscuous mode [ 532.016845][T20125] hsr_slave_1: entered promiscuous mode [ 532.057378][T20125] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 532.098587][T20125] Cannot create hsr debugfs directory [ 532.192547][T20044] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 532.249507][ T5853] Bluetooth: hci4: command tx timeout [ 532.287667][T20044] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 532.343593][T20202] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4826'. [ 532.494083][T20207] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4827'. [ 532.508749][ T36] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.550129][ T67] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.570965][ T5853] Bluetooth: hci5: command tx timeout [ 532.605138][T20149] chnl_net:caif_netlink_parms(): no params data found [ 532.672463][ T67] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.692020][ T67] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.979379][T20216] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.4830'. [ 533.021585][T20125] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.155212][T20125] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.209183][ T5853] Bluetooth: hci0: command tx timeout [ 533.328380][T20125] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.355853][T20149] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.375867][T20149] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.389175][T20149] bridge_slave_0: entered allmulticast mode [ 533.407061][T20149] bridge_slave_0: entered promiscuous mode [ 533.439480][T20149] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.446597][T20149] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.469098][T20149] bridge_slave_1: entered allmulticast mode [ 533.476824][T20149] bridge_slave_1: entered promiscuous mode [ 533.502273][T20125] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.600486][T16433] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 533.608359][T16433] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.712522][T20149] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 533.748231][T20149] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 533.826492][T20238] netlink: 'syz.7.4837': attribute type 10 has an invalid length. [ 533.884830][T20241] netlink: 'syz.7.4837': attribute type 10 has an invalid length. [ 533.936542][T20238] bond0: (slave dummy0): Releasing backup interface [ 533.989575][T20238] team0: Port device dummy0 added [ 534.012841][T20241] team0: Port device dummy0 removed [ 534.036961][T20241] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 534.072731][T20149] team0: Port device team_slave_0 added [ 534.084570][T20149] team0: Port device team_slave_1 added [ 534.091598][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 534.100713][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 534.242104][T20149] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 534.288971][T20149] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 534.340774][ T5853] Bluetooth: hci4: command tx timeout [ 534.373214][T20149] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 534.412010][T20149] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 534.424393][T20149] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 534.461160][T20149] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 534.655184][ T30] audit: type=1800 audit(1752045910.511:16): pid=20261 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.4841" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=337 res=0 errno=0 [ 534.712933][ T30] audit: type=1804 audit(1752045910.511:17): pid=20261 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.4841" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=337 res=1 errno=0 [ 534.899725][T20267] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4844'. [ 534.917885][T20149] hsr_slave_0: entered promiscuous mode [ 534.940345][T20149] hsr_slave_1: entered promiscuous mode [ 534.952718][T20149] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 535.000703][T20149] Cannot create hsr debugfs directory [ 535.013829][T20125] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 535.059554][T20125] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 535.077988][T20125] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 535.152251][T20125] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 535.289640][ T5853] Bluetooth: hci0: command tx timeout [ 535.683028][T20149] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.819976][T20149] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.837697][ T5861] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 535.848324][ T5861] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 535.884072][ T5861] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 535.916246][ T5861] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 535.930474][ T5861] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 535.975042][T20149] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.054604][T20125] 8021q: adding VLAN 0 to HW filter on device bond0 [ 536.190321][T20149] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.331336][ T30] audit: type=1800 audit(1752045912.171:18): pid=20300 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.4854" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=379 res=0 errno=0 [ 536.356874][T20125] 8021q: adding VLAN 0 to HW filter on device team0 [ 536.385359][T16438] bridge0: port 1(bridge_slave_0) entered blocking state [ 536.392507][T16438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 536.398924][ T30] audit: type=1804 audit(1752045912.171:19): pid=20300 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.4854" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=379 res=1 errno=0 [ 536.422724][ T5853] Bluetooth: hci4: command tx timeout [ 536.596454][T16433] bridge0: port 2(bridge_slave_1) entered blocking state [ 536.603656][T16433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 536.705483][T20125] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 536.728978][T20125] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 536.854761][T20306] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4857'. [ 536.938416][T20313] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4859'. [ 536.951031][T20149] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 536.975776][T20149] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 537.032820][T20149] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 537.069710][T20311] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4857'. [ 537.084818][T20149] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 537.369654][ T5853] Bluetooth: hci0: command tx timeout [ 537.457611][T20125] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 537.481901][T20333] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4863'. [ 537.499209][T20333] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4863'. [ 537.508418][T20333] netlink: 'syz.8.4863': attribute type 5 has an invalid length. [ 537.566877][T20333] netlink: 132 bytes leftover after parsing attributes in process `syz.8.4863'. [ 537.654511][T20288] chnl_net:caif_netlink_parms(): no params data found [ 537.756127][T20149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 537.893780][T20125] veth0_vlan: entered promiscuous mode [ 538.009429][ T5853] Bluetooth: hci5: command tx timeout [ 538.022212][T20125] veth1_vlan: entered promiscuous mode [ 538.056791][T20149] 8021q: adding VLAN 0 to HW filter on device team0 [ 538.102617][T20288] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.120390][T20288] bridge0: port 1(bridge_slave_0) entered disabled state [ 538.127796][T20288] bridge_slave_0: entered allmulticast mode [ 538.153794][T20288] bridge_slave_0: entered promiscuous mode [ 538.168097][T20288] bridge0: port 2(bridge_slave_1) entered blocking state [ 538.176459][T20288] bridge0: port 2(bridge_slave_1) entered disabled state [ 538.185189][T20288] bridge_slave_1: entered allmulticast mode [ 538.194453][T20288] bridge_slave_1: entered promiscuous mode [ 538.294756][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.301994][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 538.362817][T20288] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 538.415983][T16422] bridge0: port 2(bridge_slave_1) entered blocking state [ 538.423207][T16422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 538.443049][T20361] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4871'. [ 538.484112][T20355] netlink: 'syz.8.4870': attribute type 10 has an invalid length. [ 538.486331][T20288] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 538.504194][ T5853] Bluetooth: hci4: command tx timeout [ 538.534675][T20362] netlink: 'syz.8.4870': attribute type 10 has an invalid length. [ 538.582232][T20355] bond0: (slave dummy0): Releasing backup interface [ 538.630208][T20355] team0: Port device dummy0 added [ 538.689744][T20362] team0: Port device dummy0 removed [ 538.712821][T20362] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 538.798476][T20288] team0: Port device team_slave_0 added [ 538.822206][T20125] veth0_macvtap: entered promiscuous mode [ 538.854269][T20288] team0: Port device team_slave_1 added [ 538.925938][T20370] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4872'. [ 538.953596][T20125] veth1_macvtap: entered promiscuous mode [ 539.004279][T20288] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 539.026110][T20288] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 539.098891][T20288] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 539.151828][T20372] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4872'. [ 539.179417][T20288] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 539.186392][T20288] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 539.318995][T20288] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 539.511511][T20288] hsr_slave_0: entered promiscuous mode [ 539.529240][T20288] hsr_slave_1: entered promiscuous mode [ 539.541109][T20288] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 539.568705][T20288] Cannot create hsr debugfs directory [ 539.635544][T20125] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 539.709499][T20125] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 539.944766][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.974362][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.042208][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.058899][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.098732][ T5853] Bluetooth: hci5: command tx timeout [ 540.457277][T20288] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.514569][T20415] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4883'. [ 540.663226][T20288] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.708778][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 540.716656][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 540.734017][T20149] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 540.798280][T20424] netlink: 'syz.8.4884': attribute type 10 has an invalid length. [ 540.855310][T20427] netlink: 'syz.8.4884': attribute type 10 has an invalid length. [ 540.968206][T20288] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.051963][T20424] bond0: (slave dummy0): Releasing backup interface [ 541.069582][T20424] team0: Port device dummy0 added [ 541.100315][T20427] team0: Port device dummy0 removed [ 541.110702][T20427] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 541.233042][T20288] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.306754][T16426] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 541.335283][T16426] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 541.703919][T20288] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 541.861925][ T30] audit: type=1800 audit(1752045917.721:20): pid=20454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.4888" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=334 res=0 errno=0 [ 541.886520][ T30] audit: type=1804 audit(1752045917.721:21): pid=20454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.4888" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=334 res=1 errno=0 [ 541.930444][T20288] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 541.982941][T20288] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 542.022195][T20288] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 542.170508][ T5853] Bluetooth: hci5: command tx timeout [ 542.191539][T20149] veth0_vlan: entered promiscuous mode [ 542.234059][T20149] veth1_vlan: entered promiscuous mode [ 542.381915][T20288] 8021q: adding VLAN 0 to HW filter on device bond0 [ 542.411458][T20149] veth0_macvtap: entered promiscuous mode [ 542.422378][T20288] 8021q: adding VLAN 0 to HW filter on device team0 [ 542.433165][T20149] veth1_macvtap: entered promiscuous mode [ 542.457925][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 542.465072][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 542.491438][T16422] bridge0: port 2(bridge_slave_1) entered blocking state [ 542.498589][T16422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 542.511470][T20149] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 542.536237][T20149] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 542.588419][T16422] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.599233][T16422] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.607958][T16422] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.626701][T16422] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.772351][T16433] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 542.809453][T16433] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 542.879812][T16433] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 542.887655][T16433] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 542.977672][T20288] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 543.346400][T20288] veth0_vlan: entered promiscuous mode [ 543.391117][T20288] veth1_vlan: entered promiscuous mode [ 543.447548][T20288] veth0_macvtap: entered promiscuous mode [ 543.466253][T20288] veth1_macvtap: entered promiscuous mode [ 543.521704][T20288] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 543.559918][T20288] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 543.611991][T16422] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.643506][T16422] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.670028][ T3591] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.719036][T20477] __nla_validate_parse: 2 callbacks suppressed [ 543.719053][T20477] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4892'. [ 543.748723][T20477] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4892'. [ 543.751051][ T3591] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.805104][T20477] netlink: 'syz.7.4892': attribute type 5 has an invalid length. [ 543.852168][T20481] netlink: 132 bytes leftover after parsing attributes in process `syz.7.4892'. [ 543.964561][ T67] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.019975][ T67] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.040364][ T67] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.062843][ T67] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.098970][T16422] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 544.106879][T16422] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 544.204055][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 544.211079][ T3591] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 544.219904][ T3591] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 544.228839][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 544.237633][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 544.245927][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 544.253818][T10626] Bluetooth: hci5: command tx timeout [ 544.263229][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 544.983462][T20482] chnl_net:caif_netlink_parms(): no params data found [ 545.330974][ T5861] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 545.350639][ T5861] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 545.358309][ T5861] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 545.367462][ T5861] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 545.376128][ T5861] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 545.408918][T20482] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.425510][T20482] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.433105][T20482] bridge_slave_0: entered allmulticast mode [ 545.442309][T20482] bridge_slave_0: entered promiscuous mode [ 545.457973][T20482] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.466298][T20482] bridge0: port 2(bridge_slave_1) entered disabled state [ 545.473618][T20482] bridge_slave_1: entered allmulticast mode [ 545.482446][T20482] bridge_slave_1: entered promiscuous mode [ 545.561052][T20482] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 545.590876][T20482] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 545.682599][T20482] team0: Port device team_slave_0 added [ 545.702241][T20482] team0: Port device team_slave_1 added [ 545.843381][T20482] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 545.856838][T20482] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 545.918015][T20482] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 545.960104][T20482] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 545.977321][T20482] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 546.052098][T20482] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 546.084028][T20505] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4898'. [ 546.196683][T20513] netlink: 'syz.8.4899': attribute type 10 has an invalid length. [ 546.271396][T20515] netlink: 'syz.8.4899': attribute type 10 has an invalid length. [ 546.328961][ T5861] Bluetooth: hci0: command tx timeout [ 546.391392][T20513] bond0: (slave dummy0): Releasing backup interface [ 546.410417][T20513] team0: Port device dummy0 added [ 546.430321][ T5853] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 546.430708][T20506] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4898'. [ 546.465156][ T5853] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 546.473373][ T5853] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 546.484385][ T5853] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 546.493473][ T5853] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 546.503195][T20482] hsr_slave_0: entered promiscuous mode [ 546.511282][T20482] hsr_slave_1: entered promiscuous mode [ 546.519426][T20482] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 546.526991][T20482] Cannot create hsr debugfs directory [ 546.562141][T20515] team0: Port device dummy0 removed [ 546.602062][T20515] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 547.220864][T20536] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4902'. [ 547.292149][T20540] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4902'. [ 547.450558][ T5853] Bluetooth: hci4: command tx timeout [ 547.533012][T20544] netlink: 260 bytes leftover after parsing attributes in process `syz.7.4902'. [ 547.605692][T20547] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4904'. [ 547.629529][T20482] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.787999][T20482] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.963700][T20499] chnl_net:caif_netlink_parms(): no params data found [ 548.074598][T20482] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.239139][T20482] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.420310][ T5853] Bluetooth: hci0: command tx timeout [ 548.433704][T20565] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.4909'. [ 548.517636][T20499] bridge0: port 1(bridge_slave_0) entered blocking state [ 548.534681][T20499] bridge0: port 1(bridge_slave_0) entered disabled state [ 548.549120][T20499] bridge_slave_0: entered allmulticast mode [ 548.568711][ T5853] Bluetooth: hci5: command tx timeout [ 548.573161][T20499] bridge_slave_0: entered promiscuous mode [ 548.598159][T20499] bridge0: port 2(bridge_slave_1) entered blocking state [ 548.605495][T20499] bridge0: port 2(bridge_slave_1) entered disabled state [ 548.612943][T20499] bridge_slave_1: entered allmulticast mode [ 548.620987][T20499] bridge_slave_1: entered promiscuous mode [ 548.749467][T20572] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4911'. [ 548.805280][T20499] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 548.887585][T20499] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 548.922303][T20569] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4911'. [ 549.004806][T20482] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 549.076566][T20482] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 549.123470][T20578] syzkaller0: entered promiscuous mode [ 549.139130][T20578] syzkaller0: entered allmulticast mode [ 549.181578][T20499] team0: Port device team_slave_0 added [ 549.190753][T20482] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 549.213698][T20482] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 549.285828][T20499] team0: Port device team_slave_1 added [ 549.359458][T20587] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4915'. [ 549.487033][T20517] chnl_net:caif_netlink_parms(): no params data found [ 549.528850][ T5853] Bluetooth: hci4: command tx timeout [ 549.650262][T20499] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 549.657233][T20499] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 549.710731][T20499] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 549.772647][T20499] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 549.789467][T20499] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 549.848937][T20499] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 550.063518][T20609] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.4920'. [ 550.121988][T20499] hsr_slave_0: entered promiscuous mode [ 550.141342][T20499] hsr_slave_1: entered promiscuous mode [ 550.147873][T20499] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 550.157757][T20499] Cannot create hsr debugfs directory [ 550.245988][T20614] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4921'. [ 550.259470][T20614] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4921'. [ 550.268351][T20614] netlink: 'syz.7.4921': attribute type 5 has an invalid length. [ 550.306024][T20617] netlink: 132 bytes leftover after parsing attributes in process `syz.7.4921'. [ 550.320722][T20517] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.349108][T20517] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.356385][T20517] bridge_slave_0: entered allmulticast mode [ 550.374513][T20517] bridge_slave_0: entered promiscuous mode [ 550.386600][T20517] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.393870][T20517] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.402350][T20517] bridge_slave_1: entered allmulticast mode [ 550.407354][ T30] audit: type=1800 audit(1752045926.241:22): pid=20616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.4922" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=433 res=0 errno=0 [ 550.418754][T20517] bridge_slave_1: entered promiscuous mode [ 550.468778][ T30] audit: type=1804 audit(1752045926.241:23): pid=20616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.4922" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=433 res=1 errno=0 [ 550.500054][ T5853] Bluetooth: hci0: command tx timeout [ 550.643203][T20517] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 550.652942][ T5853] Bluetooth: hci5: command tx timeout [ 550.694299][T20517] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 550.722466][T20624] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4925'. [ 550.813246][T20517] team0: Port device team_slave_0 added [ 550.856153][T20626] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4925'. [ 550.872520][T20517] team0: Port device team_slave_1 added [ 551.002116][T20482] 8021q: adding VLAN 0 to HW filter on device bond0 [ 551.028026][T20517] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 551.038479][T20517] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 551.108751][T20517] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 551.142027][T20631] netlink: 'syz.7.4926': attribute type 10 has an invalid length. [ 551.198362][T20640] netlink: 'syz.7.4926': attribute type 10 has an invalid length. [ 551.281563][T20517] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 551.293564][T20517] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 551.366090][T20517] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 551.403397][T20631] bond0: (slave dummy0): Releasing backup interface [ 551.416547][T20631] team0: Port device dummy0 added [ 551.447848][T20640] team0: Port device dummy0 removed [ 551.464287][T20640] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 551.529853][T20641] syzkaller0: entered promiscuous mode [ 551.535413][T20641] syzkaller0: entered allmulticast mode [ 551.580677][T20482] 8021q: adding VLAN 0 to HW filter on device team0 [ 551.617130][ T5853] Bluetooth: hci4: command tx timeout [ 551.699754][T20499] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.912196][T16438] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.919377][T16438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 551.956071][T16428] bridge0: port 2(bridge_slave_1) entered blocking state [ 551.963221][T16428] bridge0: port 2(bridge_slave_1) entered forwarding state [ 552.015536][T20499] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.056514][T20661] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.4931'. [ 552.143750][T20499] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.192927][T20517] hsr_slave_0: entered promiscuous mode [ 552.200853][T20517] hsr_slave_1: entered promiscuous mode [ 552.207991][T20517] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 552.217579][T20517] Cannot create hsr debugfs directory [ 552.272233][T20499] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.428139][T20669] netlink: 'syz.7.4933': attribute type 5 has an invalid length. [ 552.569152][ T5853] Bluetooth: hci0: command tx timeout [ 552.729458][ T5853] Bluetooth: hci5: command tx timeout [ 553.013742][T20517] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 553.050753][T20499] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 553.112714][T20499] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 553.174833][T20499] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 553.283209][T20517] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 553.333627][T20499] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 553.366427][T20684] syzkaller0: entered promiscuous mode [ 553.373045][T20684] syzkaller0: entered allmulticast mode [ 553.434319][T20517] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 553.524803][T20482] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 553.599096][T20517] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 553.703616][ T5853] Bluetooth: hci4: command tx timeout [ 553.804106][T20707] __nla_validate_parse: 4 callbacks suppressed [ 553.804125][T20707] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.4943'. [ 553.833201][T20482] veth0_vlan: entered promiscuous mode [ 553.864372][ T30] audit: type=1800 audit(1752045929.721:24): pid=20709 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.4944" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=490 res=0 errno=0 [ 553.901744][ T30] audit: type=1804 audit(1752045929.721:25): pid=20709 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.4944" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=490 res=1 errno=0 [ 554.037812][T20711] netlink: 132 bytes leftover after parsing attributes in process `syz.8.4945'. [ 554.125866][T20482] veth1_vlan: entered promiscuous mode [ 554.142921][T20499] 8021q: adding VLAN 0 to HW filter on device bond0 [ 554.154333][T20517] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 554.209253][T20517] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 554.288825][T20517] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 554.318075][T20499] 8021q: adding VLAN 0 to HW filter on device team0 [ 554.362956][T20517] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 554.405791][T16435] bridge0: port 1(bridge_slave_0) entered blocking state [ 554.412926][T16435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 554.468528][T20482] veth0_macvtap: entered promiscuous mode [ 554.516868][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 554.524032][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 554.543127][T20482] veth1_macvtap: entered promiscuous mode [ 554.613678][T20482] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 554.672552][T20482] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 554.694429][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.716707][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.730499][T16438] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.772876][T16438] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.809556][ T5853] Bluetooth: hci5: command tx timeout [ 554.821668][T20499] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 554.923786][T20735] syzkaller0: entered promiscuous mode [ 554.932853][T20735] syzkaller0: entered allmulticast mode [ 555.134329][ T3591] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 555.165086][ T3591] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 555.180861][T20517] 8021q: adding VLAN 0 to HW filter on device bond0 [ 555.327282][T20517] 8021q: adding VLAN 0 to HW filter on device team0 [ 555.334744][ T3591] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 555.369748][ T3591] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 555.398465][T20499] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 555.438020][ T3591] bridge0: port 1(bridge_slave_0) entered blocking state [ 555.445170][ T3591] bridge0: port 1(bridge_slave_0) entered forwarding state [ 555.533465][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 555.540645][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 555.825366][T20752] netlink: 132 bytes leftover after parsing attributes in process `syz.7.4957'. [ 556.220456][ T30] audit: type=1800 audit(1752045932.071:26): pid=20762 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.4959" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=528 res=0 errno=0 [ 556.314875][ T30] audit: type=1804 audit(1752045932.071:27): pid=20762 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.4959" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=528 res=1 errno=0 [ 556.355269][T20499] veth0_vlan: entered promiscuous mode [ 556.400134][T20499] veth1_vlan: entered promiscuous mode [ 556.471713][T20517] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 556.585346][T20499] veth0_macvtap: entered promiscuous mode [ 556.603915][T20499] veth1_macvtap: entered promiscuous mode [ 556.656969][T20499] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 556.700461][T20499] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 556.733799][T16422] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.770014][T16422] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.805446][T16422] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.827400][T16422] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 556.953964][T16426] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 556.964492][T20517] veth0_vlan: entered promiscuous mode [ 556.979685][T16426] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 557.059915][T20517] veth1_vlan: entered promiscuous mode [ 557.080186][T16438] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 557.094083][T16438] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 557.163406][T20517] veth0_macvtap: entered promiscuous mode [ 557.174216][T20517] veth1_macvtap: entered promiscuous mode [ 557.237913][T20517] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 557.254011][T20517] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 557.281376][T16422] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.302990][T16422] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.316478][T16422] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.339492][T16422] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.426549][T16438] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 557.439846][T16438] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 557.520762][T16435] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 557.550383][T16435] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 558.210144][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 558.224438][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 558.232604][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 558.241232][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 558.255405][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 558.985742][T20778] chnl_net:caif_netlink_parms(): no params data found [ 559.157034][ T5853] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 559.166346][ T5853] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 559.176809][T20778] bridge0: port 1(bridge_slave_0) entered blocking state [ 559.184263][ T5853] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 559.192732][T20778] bridge0: port 1(bridge_slave_0) entered disabled state [ 559.192807][ T5853] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 559.209219][T20778] bridge_slave_0: entered allmulticast mode [ 559.215488][ T5853] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 559.265739][T20778] bridge_slave_0: entered promiscuous mode [ 559.282755][T20778] bridge0: port 2(bridge_slave_1) entered blocking state [ 559.292267][T20778] bridge0: port 2(bridge_slave_1) entered disabled state [ 559.299950][T20778] bridge_slave_1: entered allmulticast mode [ 559.307703][T20778] bridge_slave_1: entered promiscuous mode [ 559.386624][T20778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 559.412789][T20797] syzkaller0: entered promiscuous mode [ 559.418283][T20797] syzkaller0: entered allmulticast mode [ 559.437415][T20778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 559.562051][T20778] team0: Port device team_slave_0 added [ 559.688179][T20778] team0: Port device team_slave_1 added [ 559.902086][T20778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 559.928574][T20778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 560.015660][T20804] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4968'. [ 560.051760][T20778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 560.128374][ T5861] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 560.138372][ T5861] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 560.149932][ T5861] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 560.158424][ T5861] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 560.190149][ T5861] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 560.205486][T20778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 560.218762][T20778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 560.272913][T20778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 560.284178][T20808] netlink: 132 bytes leftover after parsing attributes in process `syz.8.4969'. [ 560.303445][T20811] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4970'. [ 560.329581][ T5861] Bluetooth: hci0: command tx timeout [ 560.460178][ T30] audit: type=1800 audit(1752045936.301:28): pid=20816 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.4971" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=567 res=0 errno=0 [ 560.511775][T20778] hsr_slave_0: entered promiscuous mode [ 560.518556][ T30] audit: type=1804 audit(1752045936.311:29): pid=20816 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.4971" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=567 res=1 errno=0 [ 560.543159][T20778] hsr_slave_1: entered promiscuous mode [ 560.549897][T20778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 560.557463][T20778] Cannot create hsr debugfs directory [ 560.564480][T20812] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4970'. [ 561.290874][ T5861] Bluetooth: hci4: command tx timeout [ 561.584329][T20842] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4981'. [ 561.599901][T20843] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4980'. [ 561.604644][T20778] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.787853][T20778] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.811503][T20791] chnl_net:caif_netlink_parms(): no params data found [ 561.916589][T20778] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 562.016010][T20778] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 562.093789][T20791] bridge0: port 1(bridge_slave_0) entered blocking state [ 562.101600][T20791] bridge0: port 1(bridge_slave_0) entered disabled state [ 562.118284][T20791] bridge_slave_0: entered allmulticast mode [ 562.127468][T20791] bridge_slave_0: entered promiscuous mode [ 562.157602][T20791] bridge0: port 2(bridge_slave_1) entered blocking state [ 562.165343][T20791] bridge0: port 2(bridge_slave_1) entered disabled state [ 562.175220][T20791] bridge_slave_1: entered allmulticast mode [ 562.183777][T20791] bridge_slave_1: entered promiscuous mode [ 562.249142][ T5861] Bluetooth: hci5: command tx timeout [ 562.293289][T20791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 562.328416][T20806] chnl_net:caif_netlink_parms(): no params data found [ 562.347931][T20791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 562.408921][ T5861] Bluetooth: hci0: command tx timeout [ 562.550355][ T30] audit: type=1800 audit(1752045938.411:30): pid=20859 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.4984" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=697 res=0 errno=0 [ 562.637358][ T30] audit: type=1804 audit(1752045938.431:31): pid=20859 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.4984" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=697 res=1 errno=0 [ 562.671666][T20791] team0: Port device team_slave_0 added [ 562.774019][T20791] team0: Port device team_slave_1 added [ 562.780110][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.791906][T20778] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 562.843067][T20778] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 562.956938][T20778] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 563.016968][T20871] netlink: 'syz.7.4987': attribute type 10 has an invalid length. [ 563.069889][T20868] netlink: 'syz.7.4987': attribute type 10 has an invalid length. [ 563.080914][T20791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 563.087878][T20791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 563.153968][T20791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 563.173220][T20778] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 563.210252][T20871] bond0: (slave dummy0): Releasing backup interface [ 563.244258][T20871] team0: Port device dummy0 added [ 563.287143][T20868] team0: Port device dummy0 removed [ 563.366506][T20868] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 563.381986][ T5861] Bluetooth: hci4: command tx timeout [ 563.408991][T20806] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.418848][T20806] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.426117][T20806] bridge_slave_0: entered allmulticast mode [ 563.451287][T20806] bridge_slave_0: entered promiscuous mode [ 563.460572][T20791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 563.473026][T20791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 563.512020][T20791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 563.581932][T20806] bridge0: port 2(bridge_slave_1) entered blocking state [ 563.592894][T20806] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.612501][T20806] bridge_slave_1: entered allmulticast mode [ 563.630917][T20806] bridge_slave_1: entered promiscuous mode [ 563.942670][T20806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 564.000554][T20791] hsr_slave_0: entered promiscuous mode [ 564.007583][T20791] hsr_slave_1: entered promiscuous mode [ 564.017706][T20791] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 564.026798][T20791] Cannot create hsr debugfs directory [ 564.035931][T20806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 564.066797][T20902] syzkaller0: entered promiscuous mode [ 564.072577][T20902] syzkaller0: entered allmulticast mode [ 564.240749][T20806] team0: Port device team_slave_0 added [ 564.263577][T20806] team0: Port device team_slave_1 added [ 564.329411][ T5861] Bluetooth: hci5: command tx timeout [ 564.444626][T20806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 564.454630][T20806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 564.491534][ T5861] Bluetooth: hci0: command tx timeout [ 564.497074][T20806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 564.532229][T20806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 564.539370][T20806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 564.577251][T20806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 564.741590][T20806] hsr_slave_0: entered promiscuous mode [ 564.749312][T20806] hsr_slave_1: entered promiscuous mode [ 564.755791][T20806] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 564.763499][T20806] Cannot create hsr debugfs directory [ 564.897889][T20917] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4999'. [ 564.911773][T20791] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.031309][T20791] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.134667][T20791] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.195141][T20778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 565.260582][T20791] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.452206][ T5861] Bluetooth: hci4: command tx timeout [ 565.471351][T20778] 8021q: adding VLAN 0 to HW filter on device team0 [ 565.500298][T16438] bridge0: port 1(bridge_slave_0) entered blocking state [ 565.507463][T16438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 565.650248][T20806] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.686017][T20933] netlink: 'syz.8.5003': attribute type 10 has an invalid length. [ 565.706969][T20931] netlink: 32 bytes leftover after parsing attributes in process `syz.7.5004'. [ 565.720323][T16433] bridge0: port 2(bridge_slave_1) entered blocking state [ 565.727455][T16433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 565.743483][T20936] netlink: 'syz.8.5003': attribute type 10 has an invalid length. [ 565.789667][T20933] bond0: (slave dummy0): Releasing backup interface [ 565.825988][T20933] team0: Port device dummy0 added [ 565.851132][T20806] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.889935][T20936] team0: Port device dummy0 removed [ 565.912167][T20936] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 565.946987][T20806] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.969304][T20934] netlink: 32 bytes leftover after parsing attributes in process `syz.7.5004'. [ 566.065274][T20806] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.350609][T20791] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 566.379420][T20791] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 566.415086][ T5861] Bluetooth: hci5: command tx timeout [ 566.422567][T20947] netlink: 16 bytes leftover after parsing attributes in process `syz.7.5006'. [ 566.453392][T20791] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 566.572831][ T5861] Bluetooth: hci0: command tx timeout [ 566.643173][T20791] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 566.800925][T20806] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 566.843902][T20806] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 566.863000][T20806] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 566.894617][T20778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 566.908976][T20806] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 567.110516][T20778] veth0_vlan: entered promiscuous mode [ 567.184858][T20778] veth1_vlan: entered promiscuous mode [ 567.220708][T20791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 567.314532][T20806] 8021q: adding VLAN 0 to HW filter on device bond0 [ 567.348011][T20791] 8021q: adding VLAN 0 to HW filter on device team0 [ 567.397290][T20778] veth0_macvtap: entered promiscuous mode [ 567.435902][T20806] 8021q: adding VLAN 0 to HW filter on device team0 [ 567.451554][T20778] veth1_macvtap: entered promiscuous mode [ 567.465306][T16438] bridge0: port 1(bridge_slave_0) entered blocking state [ 567.472539][T16438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 567.526081][ T3591] bridge0: port 1(bridge_slave_0) entered blocking state [ 567.533285][ T3591] bridge0: port 1(bridge_slave_0) entered forwarding state [ 567.540788][ T5861] Bluetooth: hci4: command tx timeout [ 567.574202][ T3591] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.581380][ T3591] bridge0: port 2(bridge_slave_1) entered forwarding state [ 567.611624][T20778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 567.630624][T20778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 567.654695][ T3591] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.661897][ T3591] bridge0: port 2(bridge_slave_1) entered forwarding state [ 567.704101][T16422] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 567.715192][T16422] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 567.724313][T16422] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 567.764109][T16422] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.095071][T20986] netlink: 32 bytes leftover after parsing attributes in process `syz.7.5016'. [ 568.221180][T16422] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 568.269716][T16422] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 568.384536][T20983] netlink: 32 bytes leftover after parsing attributes in process `syz.7.5016'. [ 568.403475][T20996] netlink: 'syz.8.5018': attribute type 10 has an invalid length. [ 568.479026][T20999] netlink: 'syz.8.5018': attribute type 10 has an invalid length. [ 568.494207][ T5861] Bluetooth: hci5: command tx timeout [ 568.504902][T16422] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 568.527710][T16422] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 568.572873][T20996] bond0: (slave dummy0): Releasing backup interface [ 568.623330][T20996] team0: Port device dummy0 added [ 568.721939][T20999] team0: Port device dummy0 removed [ 568.744478][T20999] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 568.875997][T20791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 568.917795][T20806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 569.524520][T20791] veth0_vlan: entered promiscuous mode [ 569.602787][T20791] veth1_vlan: entered promiscuous mode [ 569.646645][T20806] veth0_vlan: entered promiscuous mode [ 569.673770][T20806] veth1_vlan: entered promiscuous mode [ 569.721666][T20791] veth0_macvtap: entered promiscuous mode [ 569.744341][T20791] veth1_macvtap: entered promiscuous mode [ 569.754245][T20806] veth0_macvtap: entered promiscuous mode [ 569.780612][T20806] veth1_macvtap: entered promiscuous mode [ 569.806687][T20791] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 569.828294][T20791] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 569.846496][T20806] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 569.862790][T16435] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.871954][T16435] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.899853][T16435] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.911318][T16435] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.924476][T20806] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 569.945492][T16428] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.980194][T16428] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.002360][T16428] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.021100][T16428] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.189276][T16428] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.218752][T16428] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.252810][T16433] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.269246][T16433] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.322306][T16422] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.349615][T16422] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.363689][T16428] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.386325][T16428] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 571.577888][ T5853] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 571.590491][ T5853] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 571.599228][ T5853] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 571.607175][ T5853] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 571.616007][ T5853] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 572.220563][T21024] chnl_net:caif_netlink_parms(): no params data found [ 572.267069][ T5861] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 572.276098][ T5861] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 572.284079][ T5861] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 572.292498][ T5861] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 572.300292][ T5861] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 572.439735][T21024] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.481431][T21024] bridge0: port 1(bridge_slave_0) entered disabled state [ 572.498917][T21024] bridge_slave_0: entered allmulticast mode [ 572.508949][T21024] bridge_slave_0: entered promiscuous mode [ 572.531078][T21024] bridge0: port 2(bridge_slave_1) entered blocking state [ 572.538268][T21024] bridge0: port 2(bridge_slave_1) entered disabled state [ 572.566832][T21024] bridge_slave_1: entered allmulticast mode [ 572.590576][T21024] bridge_slave_1: entered promiscuous mode [ 572.678121][T21024] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 572.696827][T21024] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 572.762915][T21024] team0: Port device team_slave_0 added [ 572.783413][T21024] team0: Port device team_slave_1 added [ 572.871469][T21024] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 572.879169][T21024] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 572.907354][T21024] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 572.931217][T21024] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 572.938175][T21024] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 573.030041][T21024] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 573.161033][T21024] hsr_slave_0: entered promiscuous mode [ 573.180232][T21024] hsr_slave_1: entered promiscuous mode [ 573.186724][T21024] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 573.195022][T21024] Cannot create hsr debugfs directory [ 573.366224][T21042] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5024'. [ 573.691168][ T5853] Bluetooth: hci0: command tx timeout [ 573.732577][T21024] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.777349][T21030] chnl_net:caif_netlink_parms(): no params data found [ 573.936425][T21024] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.982419][T10626] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 574.001250][T10626] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 574.015568][T10626] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 574.024390][T10626] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 574.032153][T10626] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 574.100726][T21024] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.229837][T21030] bridge0: port 1(bridge_slave_0) entered blocking state [ 574.254223][T21030] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.269158][T21030] bridge_slave_0: entered allmulticast mode [ 574.289218][T21030] bridge_slave_0: entered promiscuous mode [ 574.335997][T10626] Bluetooth: hci4: command tx timeout [ 574.350813][T21024] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.412454][T21030] bridge0: port 2(bridge_slave_1) entered blocking state [ 574.427581][T21030] bridge0: port 2(bridge_slave_1) entered disabled state [ 574.443581][T21030] bridge_slave_1: entered allmulticast mode [ 574.452448][T21030] bridge_slave_1: entered promiscuous mode [ 574.544692][T21030] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 574.589481][T21030] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 574.936274][T21030] team0: Port device team_slave_0 added [ 574.980557][T21030] team0: Port device team_slave_1 added [ 575.026676][T21024] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 575.051497][T10626] Bluetooth: hci2: command 0x0406 tx timeout [ 575.057679][T21024] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 575.082669][T21077] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5037'. [ 575.245806][T21024] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 575.270018][T21024] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 575.377303][T21030] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 575.387037][T21030] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 575.430923][T21030] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 575.445199][T21030] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 575.452877][T21030] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 575.480905][T21030] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 575.499938][T21093] netlink: 16 bytes leftover after parsing attributes in process `syz.7.5040'. [ 575.544657][T21084] syzkaller0: entered promiscuous mode [ 575.556266][T21084] syzkaller0: entered allmulticast mode [ 575.768692][ T5861] Bluetooth: hci0: command tx timeout [ 575.795005][T21030] hsr_slave_0: entered promiscuous mode [ 575.803240][T21030] hsr_slave_1: entered promiscuous mode [ 575.811853][T21030] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 575.819737][T21030] Cannot create hsr debugfs directory [ 576.089714][ T5861] Bluetooth: hci5: command tx timeout [ 576.354801][T21053] chnl_net:caif_netlink_parms(): no params data found [ 576.409374][ T5861] Bluetooth: hci4: command tx timeout [ 576.432897][T21113] netlink: 'syz.7.5044': attribute type 10 has an invalid length. [ 576.473953][T21030] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.485886][T21115] netlink: 'syz.7.5044': attribute type 10 has an invalid length. [ 576.526942][T21113] bond0: (slave dummy0): Releasing backup interface [ 576.557767][T21113] team0: Port device dummy0 added [ 576.577125][T21115] team0: Port device dummy0 removed [ 576.590611][T21115] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 576.625629][T21030] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.730153][T21030] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.787020][T21053] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.795087][T21053] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.802823][T21053] bridge_slave_0: entered allmulticast mode [ 576.814162][T21053] bridge_slave_0: entered promiscuous mode [ 576.824160][T21053] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.834227][T21053] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.842110][T21053] bridge_slave_1: entered allmulticast mode [ 576.856546][T21053] bridge_slave_1: entered promiscuous mode [ 576.910893][T21030] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.996341][T21053] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.026093][T21053] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 577.134317][T21053] team0: Port device team_slave_0 added [ 577.185286][T21024] 8021q: adding VLAN 0 to HW filter on device bond0 [ 577.207332][T21053] team0: Port device team_slave_1 added [ 577.354104][T21053] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 577.361416][T21053] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 577.399031][T21053] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 577.431280][T21127] netlink: 32 bytes leftover after parsing attributes in process `syz.7.5048'. [ 577.484072][T21053] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 577.500779][T21053] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 577.553505][T21053] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 577.585479][T21024] 8021q: adding VLAN 0 to HW filter on device team0 [ 577.595262][T21134] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5050'. [ 577.612972][T21134] netlink: 24 bytes leftover after parsing attributes in process `syz.8.5050'. [ 577.639358][T21128] netlink: 32 bytes leftover after parsing attributes in process `syz.7.5048'. [ 577.663255][T21134] netlink: 132 bytes leftover after parsing attributes in process `syz.8.5050'. [ 577.702656][T16426] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.709833][T16426] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.789996][T16426] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.797140][T16426] bridge0: port 2(bridge_slave_1) entered forwarding state [ 577.822544][T21030] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 577.848949][ T5861] Bluetooth: hci0: command tx timeout [ 577.854789][T21030] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 577.914819][T21053] hsr_slave_0: entered promiscuous mode [ 577.923857][T21053] hsr_slave_1: entered promiscuous mode [ 577.931304][T21053] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 577.941922][T21053] Cannot create hsr debugfs directory [ 577.955160][T21030] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 577.993216][T21030] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 578.044373][T21139] syzkaller0: entered promiscuous mode [ 578.052428][T21139] syzkaller0: entered allmulticast mode [ 578.169304][ T5861] Bluetooth: hci5: command tx timeout [ 578.495154][ T5861] Bluetooth: hci4: command tx timeout [ 578.820795][T21053] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.023221][T21053] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.144137][T21053] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.202165][T21030] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.272406][T21053] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.345926][T21169] netlink: 'syz.8.5058': attribute type 10 has an invalid length. [ 579.350744][T21024] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 579.371785][ T31] INFO: task syz.0.4281:18011 blocked for more than 143 seconds. [ 579.387193][ T31] Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 579.395770][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 579.399594][T21167] netlink: 'syz.8.5058': attribute type 10 has an invalid length. [ 579.429671][ T31] task:syz.0.4281 state:D stack:23704 pid:18011 tgid:18006 ppid:13853 task_flags:0x400140 flags:0x00004004 [ 579.442106][ T31] Call Trace: [ 579.445404][ T31] [ 579.448350][ T31] __schedule+0x16f5/0x4d00 [ 579.454332][ T31] ? schedule+0x165/0x360 [ 579.459109][ T31] ? __lock_acquire+0xab9/0xd20 [ 579.464132][ T31] ? __pfx___schedule+0x10/0x10 [ 579.469469][ T31] ? schedule+0x91/0x360 [ 579.473942][ T31] schedule+0x165/0x360 [ 579.478200][ T31] schedule_timeout+0x9a/0x270 [ 579.483309][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 579.488922][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 579.494205][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 579.523516][ T31] ? wait_for_completion+0x267/0x5d0 [ 579.535175][ T31] wait_for_completion+0x2bf/0x5d0 [ 579.551092][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 579.556764][ T31] ? up_write+0x1c4/0x420 [ 579.579261][ T31] ? remove_client_context+0xc0/0x1e0 [ 579.584717][ T31] disable_device+0x1c6/0x320 [ 579.594811][ T31] ? __pfx_disable_device+0x10/0x10 [ 579.604923][ T31] __ib_unregister_device+0x2cb/0x3f0 [ 579.621121][ T31] ? __pfx_ib_device_get_by_index+0x10/0x10 [ 579.628764][ T31] ib_unregister_device_and_put+0xb8/0xf0 [ 579.634518][ T31] nldev_dellink+0x2d1/0x320 [ 579.639663][ T31] ? __pfx_nldev_dellink+0x10/0x10 [ 579.644888][ T31] ? rcu_is_watching+0x15/0xb0 [ 579.649856][ T31] ? apparmor_capable+0x137/0x1b0 [ 579.654903][ T31] ? bpf_lsm_capable+0x9/0x20 [ 579.659977][ T31] ? security_capable+0x7e/0x2e0 [ 579.665032][ T31] ? __pfx_nldev_dellink+0x10/0x10 [ 579.670309][ T31] rdma_nl_rcv+0x6ab/0x980 [ 579.674760][ T31] ? __pfx_rdma_nl_rcv+0x10/0x10 [ 579.699303][ T31] ? __lock_acquire+0xab9/0xd20 [ 579.704218][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 579.731650][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 579.736909][ T31] netlink_unicast+0x758/0x8d0 [ 579.751598][ T31] netlink_sendmsg+0x805/0xb30 [ 579.756429][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 579.778927][ T31] ? aa_sock_msg_perm+0x94/0x160 [ 579.783923][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 579.798718][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 579.804062][ T31] __sock_sendmsg+0x219/0x270 [ 579.818760][ T31] ____sys_sendmsg+0x505/0x830 [ 579.836492][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 579.841982][ T31] ? import_iovec+0x74/0xa0 [ 579.846529][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 579.852221][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 579.857499][ T31] ? __fget_files+0x2a/0x420 [ 579.865137][ T31] ? __fget_files+0x3a0/0x420 [ 579.870165][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 579.875139][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 579.881745][ T31] ? rcu_is_watching+0x15/0xb0 [ 579.886554][ T31] ? do_syscall_64+0xbe/0x3b0 [ 579.908248][ T31] do_syscall_64+0xfa/0x3b0 [ 579.919323][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 579.938733][ T5861] Bluetooth: hci0: command tx timeout [ 579.983451][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.014200][ T31] ? clear_bhb_loop+0x60/0xb0 [ 580.061662][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.067606][ T31] RIP: 0033:0x7f0a0938e929 [ 580.090001][ T31] RSP: 002b:00007f0a0a165038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 580.098455][ T31] RAX: ffffffffffffffda RBX: 00007f0a095b6160 RCX: 00007f0a0938e929 [ 580.114065][ T31] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000000b [ 580.139105][ T31] RBP: 00007f0a09410b39 R08: 0000000000000000 R09: 0000000000000000 [ 580.147113][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 580.169211][ T31] R13: 0000000000000000 R14: 00007f0a095b6160 R15: 00007ffd3d2d0698 [ 580.178540][ T31] [ 580.191550][ T31] [ 580.191550][ T31] Showing all locks held in the system: [ 580.199315][T21169] bond0: (slave dummy0): Releasing backup interface [ 580.246975][ T31] 3 locks held by kworker/1:0/24: [ 580.250112][ T5861] Bluetooth: hci5: command tx timeout [ 580.259589][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 580.263200][T21169] team0: Port device dummy0 added [ 580.275787][ T31] #1: ffffc900001e7bc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 580.286455][ T31] #2: ffffffff8e144938 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 580.303072][ T31] 1 lock held by khungtaskd/31: [ 580.307966][ T31] #0: ffffffff8e13ee20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 580.317976][ T31] 3 locks held by kworker/u8:9/3591: [ 580.359563][ T31] #0: ffff88802fc3d948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 580.371473][ T31] #1: ffffc9000b6a7bc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 580.398616][ T31] #2: ffffffff8f51f048 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 [ 580.408178][ T31] 2 locks held by getty/5607: [ 580.420852][ T31] #0: ffff88814d6d00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 580.431756][ T31] #1: ffffc900036cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 580.468805][ T31] 2 locks held by kworker/u9:3/5858: [ 580.474120][ T31] #0: ffff888025a61948 ((wq_completion)nbd13-recv){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 580.498712][ T31] #1: ffffc9000407fbc0 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 580.512397][ T31] 4 locks held by kworker/u8:14/16430: [ 580.517891][ T31] #0: ffff88801b2fe148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 580.531465][ T31] #1: ffffc90003cdfbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 580.552706][ T31] #2: ffffffff8f512270 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 580.562290][ T31] #3: ffff8880795006d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x39/0x300 [ 580.574213][ T5861] Bluetooth: hci4: command tx timeout [ 580.579846][ T31] 2 locks held by kworker/u8:16/16435: [ 580.585316][ T31] 2 locks held by syz.0.4281/18010: [ 580.590608][ T31] #0: ffffffff8f512270 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 580.600186][ T31] #1: ffff8880795006d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x39/0x300 [ 580.611525][ T31] 2 locks held by syz.0.4281/18011: [ 580.616732][ T31] #0: ffffffff99e7dd18 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv+0x302/0x980 [ 580.626941][ T31] #1: ffff8880795006d0 (&device->unregistration_lock){+.+.}-{4:4}, at: __ib_unregister_device+0x284/0x3f0 [ 580.638440][ T31] 2 locks held by syz.0.4281/18024: [ 580.657604][ T31] #0: ffffffff8f512270 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 580.667555][ T31] #1: ffff8880795006d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x39/0x300 [ 580.678963][ T31] 2 locks held by syz.2.4601/19163: [ 580.684167][ T31] #0: ffffffff8f512270 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 580.693711][ T31] #1: ffff8880795006d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x39/0x300 [ 580.705101][ T31] 2 locks held by syz.6.4685/19479: [ 580.710371][ T31] #0: ffffffff8f512270 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 580.719910][ T31] #1: ffff8880795006d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x39/0x300 [ 580.731353][ T31] 5 locks held by syz-executor/19493: [ 580.736730][ T31] #0: ffff888033a94dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 580.752997][ T31] #1: ffff888033a940b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 580.762924][ T31] #2: ffffffff8f686468 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 580.773033][ T31] #3: ffff88806e3b7b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 580.782583][ T31] #4: ffffffff8e144938 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 580.793601][ T31] 7 locks held by syz-executor/21053: [ 580.799149][ T31] #0: ffff888023a6c428 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x211/0xa90 [ 580.808085][ T31] #1: ffff8880842b2488 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1e0/0x4f0 [ 580.818435][ T31] #2: ffff888143f45878 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x203/0x4f0 [ 580.828732][ T31] #3: ffffffff8edacce8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x360 [ 580.839207][ T31] #4: ffff8880311a10e8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x7c0 [ 580.855951][ T31] #5: ffff8880311a0250 (&devlink->lock_key#47){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 [ 580.866260][ T31] #6: ffffffff8e144938 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 580.877297][ T31] 1 lock held by syz.8.5058/21167: [ 580.882541][ T31] #0: ffffffff8f51f048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 580.893306][ T31] [ 580.926833][T21167] team0: Port device dummy0 removed [ 580.928753][ T31] ============================================= [ 580.928753][ T31] [ 580.938339][T21167] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 580.978688][ T31] NMI backtrace for cpu 1 [ 580.978707][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 580.978730][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 580.978742][ T31] Call Trace: [ 580.978750][ T31] [ 580.978759][ T31] dump_stack_lvl+0x189/0x250 [ 580.978783][ T31] ? __wake_up_klogd+0xd9/0x110 [ 580.978813][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 580.978835][ T31] ? __pfx__printk+0x10/0x10 [ 580.978874][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 580.978899][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 580.978918][ T31] ? _printk+0xcf/0x120 [ 580.978956][ T31] ? __pfx__printk+0x10/0x10 [ 580.978983][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 580.979006][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 580.979030][ T31] watchdog+0xfee/0x1030 [ 580.979051][ T31] ? watchdog+0x1de/0x1030 [ 580.979078][ T31] kthread+0x70e/0x8a0 [ 580.979109][ T31] ? __pfx_watchdog+0x10/0x10 [ 580.979126][ T31] ? __pfx_kthread+0x10/0x10 [ 580.979155][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 580.979177][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 580.979201][ T31] ? __pfx_kthread+0x10/0x10 [ 580.979229][ T31] ret_from_fork+0x3fc/0x770 [ 580.979251][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 580.979277][ T31] ? __switch_to_asm+0x39/0x70 [ 580.979301][ T31] ? __switch_to_asm+0x33/0x70 [ 580.979324][ T31] ? __pfx_kthread+0x10/0x10 [ 580.979351][ T31] ret_from_fork_asm+0x1a/0x30 [ 580.979391][ T31] [ 580.979399][ T31] Sending NMI from CPU 1 to CPUs 0: [ 581.144012][ C0] NMI backtrace for cpu 0 [ 581.144027][ C0] CPU: 0 UID: 0 PID: 21024 Comm: syz-executor Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 581.144047][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 581.144056][ C0] RIP: 0010:lock_release+0x295/0x3e0 [ 581.144076][ C0] Code: 5c 24 08 48 c7 c7 e2 a5 b8 8d e8 d6 6d d2 09 b8 ff ff ff ff 65 0f c1 05 e9 ba 02 11 83 f8 01 75 51 48 c7 44 24 20 00 00 00 00 <9c> 8f 44 24 20 f7 44 24 20 00 02 00 00 75 56 f7 c3 00 02 00 00 74 [ 581.144090][ C0] RSP: 0018:ffffc900135bf508 EFLAGS: 00000046 [ 581.144105][ C0] RAX: 0000000000000001 RBX: 0000000000000202 RCX: 1332c55ae9fff400 [ 581.144116][ C0] RDX: 0000000000000000 RSI: ffffffff8db8a5e2 RDI: ffffffff8be28f80 [ 581.144127][ C0] RBP: ffff8880594b64f0 R08: 0000000000000000 R09: ffffffff81cf4906 [ 581.144138][ C0] R10: ffffc900135bf658 R11: ffffffff81acf6d0 R12: 0000000000000000 [ 581.144149][ C0] R13: 0000000000000000 R14: ffffffff8e13ee20 R15: ffff8880594b5a00 [ 581.144161][ C0] FS: 0000000000000000(0000) GS:ffff888125c14000(0000) knlGS:0000000000000000 [ 581.144173][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 581.144185][ C0] CR2: 000000110c361752 CR3: 000000003408a000 CR4: 00000000003526f0 [ 581.144198][ C0] Call Trace: [ 581.144205][ C0] [ 581.144212][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 581.144235][ C0] is_bpf_text_address+0x28d/0x2b0 [ 581.144253][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 581.144273][ C0] kernel_text_address+0xa5/0xe0 [ 581.144290][ C0] __kernel_text_address+0xd/0x40 [ 581.144304][ C0] unwind_get_return_address+0x4d/0x90 [ 581.144323][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 581.144346][ C0] arch_stack_walk+0xfc/0x150 [ 581.144372][ C0] stack_trace_save+0x9c/0xe0 [ 581.144394][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 581.144421][ C0] save_stack+0xf5/0x1f0 [ 581.144441][ C0] ? __pfx_save_stack+0x10/0x10 [ 581.144460][ C0] ? __free_frozen_pages+0xc71/0xe70 [ 581.144481][ C0] ? vfree+0x25a/0x400 [ 581.144499][ C0] ? kcov_close+0x28/0x50 [ 581.144513][ C0] ? __fput+0x449/0xa70 [ 581.144526][ C0] ? task_work_run+0x1d1/0x260 [ 581.144548][ C0] ? do_exit+0x6b5/0x22e0 [ 581.144569][ C0] ? do_group_exit+0x21c/0x2d0 [ 581.144591][ C0] ? get_signal+0x1286/0x1340 [ 581.144607][ C0] ? arch_do_signal_or_restart+0x9a/0x750 [ 581.144631][ C0] ? exit_to_user_mode_loop+0x75/0x110 [ 581.144647][ C0] ? do_syscall_64+0x2bd/0x3b0 [ 581.144668][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.144688][ C0] ? page_ext_put+0x97/0xc0 [ 581.144711][ C0] __reset_page_owner+0x71/0x1f0 [ 581.144732][ C0] __free_frozen_pages+0xc71/0xe70 [ 581.144758][ C0] vfree+0x25a/0x400 [ 581.144778][ C0] ? __pfx_kcov_close+0x10/0x10 [ 581.144793][ C0] kcov_close+0x28/0x50 [ 581.144806][ C0] __fput+0x449/0xa70 [ 581.144826][ C0] task_work_run+0x1d1/0x260 [ 581.144851][ C0] ? __pfx_task_work_run+0x10/0x10 [ 581.144876][ C0] ? kmem_cache_free+0x18f/0x400 [ 581.144899][ C0] do_exit+0x6b5/0x22e0 [ 581.144925][ C0] ? do_raw_spin_lock+0x121/0x290 [ 581.144949][ C0] ? __pfx_do_exit+0x10/0x10 [ 581.144985][ C0] do_group_exit+0x21c/0x2d0 [ 581.145007][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 581.145029][ C0] get_signal+0x1286/0x1340 [ 581.145056][ C0] arch_do_signal_or_restart+0x9a/0x750 [ 581.145081][ C0] ? fput_close_sync+0x119/0x200 [ 581.145097][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 581.145130][ C0] ? exit_to_user_mode_loop+0x40/0x110 [ 581.145147][ C0] exit_to_user_mode_loop+0x75/0x110 [ 581.145164][ C0] do_syscall_64+0x2bd/0x3b0 [ 581.145185][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 581.145205][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.145221][ C0] ? clear_bhb_loop+0x60/0xb0 [ 581.145239][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.145255][ C0] RIP: 0033:0x7fc4a93907bc [ 581.145268][ C0] Code: Unable to access opcode bytes at 0x7fc4a9390792. [ 581.145276][ C0] RSP: 002b:00007ffdb6718180 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 581.145291][ C0] RAX: 0000000000000028 RBX: 00007fc4aa0e4620 RCX: 00007fc4a93907bc [ 581.145302][ C0] RDX: 0000000000000028 RSI: 00007fc4aa0e4670 RDI: 0000000000000003 [ 581.145313][ C0] RBP: 0000000000000000 R08: 00007ffdb67181d4 R09: 000000000000000c [ 581.145323][ C0] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 581.145332][ C0] R13: 0000000000000000 R14: 00007fc4aa0e4670 R15: 0000000000000000 [ 581.145351][ C0] [ 581.618154][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 581.625030][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 581.636845][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 581.646917][ T31] Call Trace: [ 581.650209][ T31] [ 581.653160][ T31] dump_stack_lvl+0x99/0x250 [ 581.657771][ T31] ? __asan_memcpy+0x40/0x70 [ 581.662381][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 581.667601][ T31] ? __pfx__printk+0x10/0x10 [ 581.672224][ T31] panic+0x2db/0x790 [ 581.676150][ T31] ? __pfx_panic+0x10/0x10 [ 581.680579][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 581.686409][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 581.691791][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 581.697973][ T31] watchdog+0x102d/0x1030 [ 581.702341][ T31] ? watchdog+0x1de/0x1030 [ 581.706775][ T31] kthread+0x70e/0x8a0 [ 581.710873][ T31] ? __pfx_watchdog+0x10/0x10 [ 581.715561][ T31] ? __pfx_kthread+0x10/0x10 [ 581.720180][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 581.725407][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 581.730634][ T31] ? __pfx_kthread+0x10/0x10 [ 581.735250][ T31] ret_from_fork+0x3fc/0x770 [ 581.739857][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 581.744985][ T31] ? __switch_to_asm+0x39/0x70 [ 581.749765][ T31] ? __switch_to_asm+0x33/0x70 [ 581.754554][ T31] ? __pfx_kthread+0x10/0x10 [ 581.759160][ T31] ret_from_fork_asm+0x1a/0x30 [ 581.763957][ T31] [ 581.767284][ T31] Kernel Offset: disabled [ 581.771611][ T31] Rebooting in 86400 seconds..