last executing test programs: 1m27.092669859s ago: executing program 3 (id=933): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000280)="4ba45dd66d9736a4d70fbec9e40436988a1815e87d67815e2443482a940f6f6c8b1b252a695da86c367aeb07682c4c13d97f66a3b34b2cdcd8abef96f7bb9cb54aa355bdabcc012a3190477cf2cb93b60bc494022cbbf49b5cd2bb919d6e94c75a3fe17ec70aed6e11fca2b34fd2a967f34b8c543df9e03f14767ddd3a82b0c56553fb449541aa4fa9cd305edda71d79eda1cb6f17b303487e9e769554ed7e1faa3a76ea5160911ad2f87d76ec19ed8e41efe8941aa1b55eb4f1d150da6c310c122fd80150aadc877e6db5b1d9c81838934d34530e18be2e412d805e537c77ddbed09b0c") sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) read(r0, &(0x7f0000000180)=""/234, 0xea) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001240)=""/219, 0xdb}], 0x1}, 0x12121) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000040)={0x0, 0x2710}, 0x10) recvmsg$can_bcm(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000005c0)=""/170, 0xaa}], 0x1}, 0x0) 1m26.789257979s ago: executing program 3 (id=935): unshare(0x6a040000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x12, 0x10, &(0x7f0000000180)=@raw=[@ringbuf_query, @call={0x85, 0x0, 0x0, 0x54}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_query, @map_idx={0x18, 0x7, 0x5, 0x0, 0x8}], &(0x7f00000000c0)='GPL\x00', 0x0, 0x7, &(0x7f0000000200)=""/7, 0x0, 0x30, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xd, 0x4, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f00000002c0)=[0x1, 0x1, 0x1], &(0x7f0000000300)=[{0x0, 0x1, 0xe, 0x9}, {0x5, 0x4, 0x9, 0x7}, {0x3, 0x4, 0x6, 0x8}, {0x0, 0x4, 0x4, 0x1}, {0x1, 0x1, 0x10, 0xa}], 0x10, 0x3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r2, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x21, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x27, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) recvmsg$can_raw(r1, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x2000) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1a, 0x4, 0x0, 0x1, 0xa528, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) 1m25.135711587s ago: executing program 2 (id=940): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, &(0x7f0000000000)={0x2, [0x0, 0x0]}) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$caif_stream(0x25, 0x1, 0x2) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x6}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000140)={r2, 0x2, 0x2, 0x7}) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x6, [@int={0x2, 0x0, 0x0, 0x1, 0x0, 0x9, 0x0, 0x11, 0x5}, @ptr={0xd, 0x0, 0x0, 0x2, 0x3}]}, {0x0, [0x5f, 0x30, 0x5f, 0x30]}}, &(0x7f0000000340)=""/248, 0x3a, 0xf8, 0x0, 0x0, 0x10000}, 0x28) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000500)={0x40, 0x0}, 0x8) r7 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000580)=@generic={&(0x7f0000000540)='./file0\x00', 0x0, 0x18}, 0x18) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000640)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000005c0), &(0x7f0000000600)='%pS \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000700)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000680), &(0x7f00000006c0)='%ps \x00'}, 0x20) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000780)=@generic={&(0x7f0000000740)='./file0\x00', 0x0, 0x18}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x5, 0x16, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @jmp={0x5, 0x0, 0xa, 0x0, 0xb, 0x8, 0x1}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x1}, @generic={0x0, 0xc, 0x8, 0x3, 0x10001}, @ldst={0x2, 0x0, 0x1, 0x1, 0x4, 0xc, 0xfffffffffffffffc}, @cb_func={0x18, 0xb, 0x4, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @map_idx={0x18, 0x9, 0x5, 0x0, 0x8}, @exit]}, &(0x7f0000000240)='GPL\x00', 0xb1c, 0x53, &(0x7f0000000280)=""/83, 0x41000, 0x4, '\x00', 0x0, @fallback=0x5, r5, 0x8, &(0x7f0000000480)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x3, 0x3, 0x3, 0xfffffffa}, 0x10, r6, r7, 0x2, &(0x7f00000007c0)=[r8, 0xffffffffffffffff, r9, r10], &(0x7f0000000800)=[{0x2, 0x4, 0xd, 0x1}, {0x4, 0x3, 0xb, 0x7}], 0x10, 0x10001}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nbd(&(0x7f0000000940), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r11, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x38, r12, 0x8, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x64f3}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2c}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x100000000}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040010}, 0x814) ioctl$SIOCAX25GETINFOOLD(r4, 0x89e9, &(0x7f0000000a40)) sendmsg$NLBL_CIPSOV4_C_ADD(r11, &(0x7f0000000d40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000d00)={&(0x7f0000000ac0)={0x21c, 0x0, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x164, 0xc, 0x0, 0x1, [{0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd536}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x49341160}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x253ae571}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf0f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9e90}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x801f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x613917e8}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x55b612f3}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbea4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2fdd6798}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x76a7fc5f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8291}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x36f0b32f}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa46f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b88}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6f7a7c34}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7f15}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb529}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x19a10941}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6b738a27}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8edf}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3aa5a67}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x413a67e5}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x27eea817}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7d2c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdfc9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x588c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3206a9a6}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa577}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd655d4d}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x45c7}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xfe46}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6aa}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd8af}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x19d9fb15}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x81ce}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf567}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7b385de0}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x74, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa5f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x94d1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x292269e6}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4361}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6365}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x20ac0538}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd9a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x68bc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd995}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7f4fb252}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x80f2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf681}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x81}, 0x4020000) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000e40)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x20, 0x0, 0x300, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x20}}, 0x400a000) sendmsg$NBD_CMD_RECONFIGURE(r11, &(0x7f0000000f40)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x28, r12, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfff}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x81}, 0x14) syz_genetlink_get_family_id$nfc(&(0x7f0000000f80), r11) socket$nl_route(0x10, 0x3, 0x0) r13 = syz_genetlink_get_family_id$devlink(&(0x7f0000001000), r4) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r4, &(0x7f0000001100)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000010c0)={&(0x7f0000001040)={0x50, r13, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x464a}, {0xc, 0x90, 0xf12d}}]}, 0x50}, 0x1, 0x0, 0x0, 0x8001}, 0x40000) listen(r0, 0x3) setsockopt$IP_VS_SO_SET_FLUSH(r4, 0x0, 0x485, 0x0, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000001140), r11) syz_init_net_socket$x25(0x9, 0x5, 0x0) 1m24.633505721s ago: executing program 2 (id=942): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x7, 0x1, 0x0, 0x6, {{0x5, 0x4, 0x2, 0x2d, 0x14, 0x64, 0x0, 0xe0, 0x2f, 0x0, @local, @empty}}}}) r1 = socket$netlink(0x10, 0x3, 0x15) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x58) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x7ffd) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000000)=[{0x40, 0x0, 0x0, 0x5}, {0x6, 0x80, 0x4f, 0xffffffff}]}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$BTRFS_IOC_DEFRAG_RANGE(r4, 0x40309410, &(0x7f00000000c0)={0xfffffffffffffffa, 0xbff, 0x2, 0x1, 0x2, [0x7, 0x101, 0xc021, 0x8001]}) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000cc0), 0x10) write$ppp(r0, &(0x7f00000001c0)="0000599928cbd3", 0x7) 1m4.21553198s ago: executing program 3 (id=935): unshare(0x6a040000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x12, 0x10, &(0x7f0000000180)=@raw=[@ringbuf_query, @call={0x85, 0x0, 0x0, 0x54}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_query, @map_idx={0x18, 0x7, 0x5, 0x0, 0x8}], &(0x7f00000000c0)='GPL\x00', 0x0, 0x7, &(0x7f0000000200)=""/7, 0x0, 0x30, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xd, 0x4, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f00000002c0)=[0x1, 0x1, 0x1], &(0x7f0000000300)=[{0x0, 0x1, 0xe, 0x9}, {0x5, 0x4, 0x9, 0x7}, {0x3, 0x4, 0x6, 0x8}, {0x0, 0x4, 0x4, 0x1}, {0x1, 0x1, 0x10, 0xa}], 0x10, 0x3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r2, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x21, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x27, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) recvmsg$can_raw(r1, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x2000) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1a, 0x4, 0x0, 0x1, 0xa528, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) 1m1.376000061s ago: executing program 2 (id=942): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x7, 0x1, 0x0, 0x6, {{0x5, 0x4, 0x2, 0x2d, 0x14, 0x64, 0x0, 0xe0, 0x2f, 0x0, @local, @empty}}}}) r1 = socket$netlink(0x10, 0x3, 0x15) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x58) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x7ffd) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000000)=[{0x40, 0x0, 0x0, 0x5}, {0x6, 0x80, 0x4f, 0xffffffff}]}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$BTRFS_IOC_DEFRAG_RANGE(r4, 0x40309410, &(0x7f00000000c0)={0xfffffffffffffffa, 0xbff, 0x2, 0x1, 0x2, [0x7, 0x101, 0xc021, 0x8001]}) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000cc0), 0x10) write$ppp(r0, &(0x7f00000001c0)="0000599928cbd3", 0x7) 42.601515447s ago: executing program 3 (id=935): unshare(0x6a040000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x12, 0x10, &(0x7f0000000180)=@raw=[@ringbuf_query, @call={0x85, 0x0, 0x0, 0x54}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_query, @map_idx={0x18, 0x7, 0x5, 0x0, 0x8}], &(0x7f00000000c0)='GPL\x00', 0x0, 0x7, &(0x7f0000000200)=""/7, 0x0, 0x30, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xd, 0x4, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f00000002c0)=[0x1, 0x1, 0x1], &(0x7f0000000300)=[{0x0, 0x1, 0xe, 0x9}, {0x5, 0x4, 0x9, 0x7}, {0x3, 0x4, 0x6, 0x8}, {0x0, 0x4, 0x4, 0x1}, {0x1, 0x1, 0x10, 0xa}], 0x10, 0x3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r2, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x21, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x27, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) recvmsg$can_raw(r1, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x2000) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1a, 0x4, 0x0, 0x1, 0xa528, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) 41.837499449s ago: executing program 2 (id=942): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x7, 0x1, 0x0, 0x6, {{0x5, 0x4, 0x2, 0x2d, 0x14, 0x64, 0x0, 0xe0, 0x2f, 0x0, @local, @empty}}}}) r1 = socket$netlink(0x10, 0x3, 0x15) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x58) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x7ffd) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000000)=[{0x40, 0x0, 0x0, 0x5}, {0x6, 0x80, 0x4f, 0xffffffff}]}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$BTRFS_IOC_DEFRAG_RANGE(r4, 0x40309410, &(0x7f00000000c0)={0xfffffffffffffffa, 0xbff, 0x2, 0x1, 0x2, [0x7, 0x101, 0xc021, 0x8001]}) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000cc0), 0x10) write$ppp(r0, &(0x7f00000001c0)="0000599928cbd3", 0x7) 26.638862257s ago: executing program 3 (id=935): unshare(0x6a040000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x12, 0x10, &(0x7f0000000180)=@raw=[@ringbuf_query, @call={0x85, 0x0, 0x0, 0x54}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_query, @map_idx={0x18, 0x7, 0x5, 0x0, 0x8}], &(0x7f00000000c0)='GPL\x00', 0x0, 0x7, &(0x7f0000000200)=""/7, 0x0, 0x30, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xd, 0x4, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f00000002c0)=[0x1, 0x1, 0x1], &(0x7f0000000300)=[{0x0, 0x1, 0xe, 0x9}, {0x5, 0x4, 0x9, 0x7}, {0x3, 0x4, 0x6, 0x8}, {0x0, 0x4, 0x4, 0x1}, {0x1, 0x1, 0x10, 0xa}], 0x10, 0x3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r2, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x21, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x27, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) recvmsg$can_raw(r1, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x2000) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1a, 0x4, 0x0, 0x1, 0xa528, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) 21.930376164s ago: executing program 2 (id=942): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x7, 0x1, 0x0, 0x6, {{0x5, 0x4, 0x2, 0x2d, 0x14, 0x64, 0x0, 0xe0, 0x2f, 0x0, @local, @empty}}}}) r1 = socket$netlink(0x10, 0x3, 0x15) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x58) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x7ffd) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000000)=[{0x40, 0x0, 0x0, 0x5}, {0x6, 0x80, 0x4f, 0xffffffff}]}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$BTRFS_IOC_DEFRAG_RANGE(r4, 0x40309410, &(0x7f00000000c0)={0xfffffffffffffffa, 0xbff, 0x2, 0x1, 0x2, [0x7, 0x101, 0xc021, 0x8001]}) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000cc0), 0x10) write$ppp(r0, &(0x7f00000001c0)="0000599928cbd3", 0x7) 9.35905261s ago: executing program 3 (id=935): unshare(0x6a040000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x12, 0x10, &(0x7f0000000180)=@raw=[@ringbuf_query, @call={0x85, 0x0, 0x0, 0x54}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_query, @map_idx={0x18, 0x7, 0x5, 0x0, 0x8}], &(0x7f00000000c0)='GPL\x00', 0x0, 0x7, &(0x7f0000000200)=""/7, 0x0, 0x30, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xd, 0x4, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f00000002c0)=[0x1, 0x1, 0x1], &(0x7f0000000300)=[{0x0, 0x1, 0xe, 0x9}, {0x5, 0x4, 0x9, 0x7}, {0x3, 0x4, 0x6, 0x8}, {0x0, 0x4, 0x4, 0x1}, {0x1, 0x1, 0x10, 0xa}], 0x10, 0x3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r2, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x21, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x27, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) recvmsg$can_raw(r1, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x2000) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1a, 0x4, 0x0, 0x1, 0xa528, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) 8.11156636s ago: executing program 2 (id=942): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x7, 0x1, 0x0, 0x6, {{0x5, 0x4, 0x2, 0x2d, 0x14, 0x64, 0x0, 0xe0, 0x2f, 0x0, @local, @empty}}}}) r1 = socket$netlink(0x10, 0x3, 0x15) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x58) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x7ffd) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000000)=[{0x40, 0x0, 0x0, 0x5}, {0x6, 0x80, 0x4f, 0xffffffff}]}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$BTRFS_IOC_DEFRAG_RANGE(r4, 0x40309410, &(0x7f00000000c0)={0xfffffffffffffffa, 0xbff, 0x2, 0x1, 0x2, [0x7, 0x101, 0xc021, 0x8001]}) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000cc0), 0x10) write$ppp(r0, &(0x7f00000001c0)="0000599928cbd3", 0x7) 2.616404771s ago: executing program 0 (id=1331): r0 = socket(0x28, 0x1, 0x0) connect$packet(r0, &(0x7f0000000100)={0x28}, 0x14) (async) r1 = socket$kcm(0xf, 0x3, 0x2) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="02e9a6e4ff4204fd09abc0e32a", 0xd}, {&(0x7f0000000380)="5ec0cc", 0x3}], 0x2, &(0x7f00000037c0)=ANY=[], 0x14d8}, 0x48000) 2.187705989s ago: executing program 1 (id=1333): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)=@newqdisc={0x80, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x50, 0x2, {{0x0, 0xffffffff}, [@TCA_NETEM_LOSS={0x34, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18}, @NETEM_LOSS_GI={0x18}]}]}}}]}, 0x80}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r2}) sendto$packet(r5, &(0x7f0000001300)="877d0fbc91c96f9b2a6a371f88419b327de3bfdf610426f3ebcae2f1564418fba8ecf85f9266e173c24f5a2efab9fa1768a0ca6134665f49347cdbb043f5f85e28089039e7288060d26038b28af18c20939a230c0353057d70a0048b6f8f7de989564a8365bb8cdf36c697a0cab5f5b77a89395257e67eb70c7fe6e491c33ddb5755475a29cbf22f67526f78e5e81229361f3ed14d2710ab4e828abd8c35ca7ad2d4235de9ed6e846c0e89c0f78d797dd73c5aa12367f81ee1ec2fa31c3341a56555fccd43fa122b36bd451cd6bc8ac9ea509f516213974805c21f5a17954bd15c8d39fcd95c48cdfd5c4e2db61489b88f82a92a2da6ffa99201a520919cacc7e47db0c24472bd06ab4241720375c772cd1e628cff0a325f5f92ecf1175b9407268c9ae0728fed5862254d245607b6c7fb395096358858a3a2222632c25dd6b49b97db3b1c2b9caa22feaf50ab387d1d21fce138e2caef39548647046f2825996b31fc258668587581b7a5d08fbcbeb3eca748ebe13d78459c05218b13cce0e893cabd891ed85c871db7699fc3081d789fcabbc35ce5ee16826c8d713ace45b9c96d918e22072b7c4c7d0d338973f08e52d98f6f520967bd6d632261c3f3bd07e639caf293c95795d79557fed9252e26021552b35e3ac881dbd4527fe0fecca94a47a6ad70f4422ae0d332319062c0627bd95473ee495833916727dfb39d115cddc9b95f8569cfc8bbea75bc4b4c38c6ba373347511d1f5bc4aac9d3fd0b3741ea81712b2b89392d785af78645d847ff81c452a15a20ccf305a4a164b9fc968a53770b69e8593c9ebb921f2de5ac170dccccbeb329693bd36131fa62cbc6e0059a31b8730151651aa38ca5cf460b5ba37d2b105d29ac5b444064a9fc14a8b8679fe506db51c3b03b94f6331c440ee349885e2cf1ef7d229004f868ac94bb6746812f03a2ebdd46c176bb1f1763c7efd853ec7995e127859b1d50087cc3075c7ae49d5cf52adee89e830503ed17b9ab3890208b22d811816414bd79e9c11600857c4a707b7e516930d34b4c3768f32802c98818f3d580a091ad6a91bf675bdc93379e363d605ccec5411a271f6d2c1be899386adcc67e87b0b5ea8d92ef8cf29e1bb60477426349551809c79f9088d522918ad3d43fc3d23fef98b40f1c90aaa38dbac02cfea2eec94f54d2577842b5260dfca23810e803cf9f61b2b0ca9274fc8b7c8e0226e66fe615a3a3fdd79338ad23fcbdb87e34b1c4ac8f7dbc2adb12812f180b83ec1704be6a8d88ff03cb70b3a0f07b3c63aa66535ebb28f6791bc27fe06499481c8c28448eb34914e412d889426368e66cdb169b47bdbf8e4088615a094f1100fd3a9d0653c221983882ba48212d883e32a32385a3a59017b9f8a23e034da9a9fb35999f1c7d5d3cf2df8f9f4f370dcc616c67ec9d61bc8706adacf1705a173afb00fced0eba9d1b3258e92e6dc70d8947c81a3c28647ceb132b340121632afea61e135f460de867b71db3f4b46d6963b10ae5242a6b88a89d5c311f69373843c881eeb21322ca4571ddf3257ce12dae7656d57f30773385f5899f93efc65b28a2dfb0beb9151dfefd03582e33bfc3df2045423391df77a1090fd4232f9428e942b861291fa416c29571da934582ba65a3b90a0a630bf142fc9a56c32bac5a64959f4921e57de80ea391288e4b9f18c3b2575f8a76881615dac41773bafbd76a37d2f5b927ed8d059a9b2cdf851aac3bac597edd6afcbf3540f1e95a2d2708da01e3dfb87bd7c1d4269d412b9c2f3f99271dc59d98842af1f8592511cf53d9f9a9a72edea7bc791f4ff585ffdeeaeff862809c1a3d163661228ed2ceccc9bd386830669e412c5194a4be63c521ad86030f2783281cbff6aa7db8a22f3f24e9e7b41b3bb97077a2f09bc65ffaa8822b0ec469129b1ca4e131a14e702ac4b31f8e0b451b179a5896a1b2107238cc5aa222a62a9065a947a70c8af0a173e538360543699b5b3c587e0729de3165ad036867ad14f750c2d4b332533f15684e06aeb80891835a5e36636a85b2c063c0cee46a4c996fe883982eb3a0178db40adaa23ea9213e752d1986eda813723b7078b4559ee997a249a4aab7e0ac1d5bf7919d9952b118e86bf3fcc201b1a58a4ba9646b8568363d73a4ce3befe81c228f36785b2550615351e2990e04d1e36874383946d4c042769b664bb9a8b0508f4ff0ebed33ff86efdc5faf6fe3ddd7f3fb5408efdb8bb50a43d1440a8c47fc6612ca578138a9c69fa67afbe9890d57f1664cf04a541b07d81a2cfea89d48b7d054bfbd260fc1562156babf138a8a7ddef1d23c66562681447b1644a9cce611949cf6584941ba89d67291ae5f2a3ee555e14e9be710298ec5c6c5011c645bfd9b9ce64631e99cc60a728c1a2410466591497bb4250fdd10b4d192bb58f32445b0291cf6874afd5729fea0972bb6f846c073cebac383ec55d054a4bb8ffc7c36a2cf9962f60dff12b6465f673f29bb3f63deb1f641535dbb7bf45c36f95c5775d036a60efa0bce891cba5cb271cc187767c1a7f92ab385dad7dc67f773d31b449d644ca27118ca796963296be555d48fd6a9fc2c9846b2ddf1eb9b95ef60cd38051b032e0ad3ba4431e205a66aa8ce72999652647e9efe475f23d06cf343af1e274440459af183f9ae94944b4d9e234896bb43b820a6abdb94378d1be2a25c5849a7af0aa496bcc4c271ccabe96830ab334122fa6870c4e2a696693b2c17cc6d247acb364f034be2ff3c68b59ce2c455a61ec7f40b9afc37e3af53bebb73817129456909c06a2af4ab0d68336e68665d110acc3e9db1db620070a5ad211b586c2bf8a9d4fe2d1e479128d3ace56d2ee2e4a538010f0a044fd58bfa92ba7e3e238e698d6afed3d6b719b157c6bcab1dba359f1b105a937ab70db4e80f528959cd824264e6a34cf2fa07f16255a0864656b41518a1405ab06cc30e0de04c917230876747967f495e9b48e5e85e96a1065783ae7f6fb47209f8b7d5b0409652c4f001d00fad89cf00519841bddf70c42617935f7d861a5a34f99514e04df3feeeb39786a630eb202d9ab8f3e7fcfec0794f549db09fe6304cc60794b5d738306597befe98a43311376388209152c5396fbed4706b168b6b0a23fc2b3b1153e59a94a966dbed03ccf11d8e9d6e674845f05f63fb81cf5fe6eb6f70c15112ff557afaf908631580573bb2d5921f05d85f00ae4e7a9491e427bce40d572aef11406bca7ecaec69eaabd10fc261a51fa200e4d06d091eb279dce48b89ab6dafbae1f1cde45195a25a57eba4b5ae4b14c64bcf1a4050fc276990a1c24facadf1521dbde8264d770eaf3f6c67b322754c0a07d1d50e385e89e9dc05da8fa41be1bbed16d68e29bc797b82fc25b21388220cafca2cb2a9ca39610ea9d82e003930b28c08c37cdf02ef9fe4d49d5cbf80c5a2c88dc45d93b23e779dfd1e865488d75dccf87f6a58ccbb72a1747da80c3b1f7f06a2fe2d1062174331589687588d84957458970214b605070e65b8b8917789af762d304fed1efc94aea785551bb9510aa49e3907120626661caaaee03c6d3a7a3001ae3b1c03cb864439e1483ece4b1ca4cd252819b0e4943009bb21760cc6d2d59511e846bff704e6e3b4be1520609223720d15d613de1ca4d18f98f1dfdb17213e03d8b090335436baeb155b5b6d301eb7fb13ea25fa5488d733eb2258925f81ffa28e5e4e8719b48e42f2adb430cb482a5f3e9ca35d5cc0941e8be66bd78cd8a74b76a93a170cf53a09da9b23daab667c4c6e16906e855409b1ca9056d9b7f9e3bdd994814249505197ab699fcc5715f8142ca4293187d63945036eb21f7863237b2ee9c7802d7b992c53594dd27244f7a4cf3cbeece64383f1d84437fd49bc8cebf7809bd0603c07fbcd98de6a889d29c5b6f51e0a1cc14960793c18b81184f4f2d7b7b1ed57b3e3b2439513a56adfc7bfacd4c036dcbda8c202d99194858c63a195932f3b4f9e5406e65c8760ac6c693f78c434c2c3f60471522d7d69a58282d50997a573c408134151e904df30921b380b3bc6108a8fe8907e346033cd31cd0575a77b0a21106ce58a151269d2ca4b7e6d7ac83932eac451a397cc5731af1997695c4e1c39404b1dcaf99626b97ea68b9d0b4c956ff79aefb726b0e9257b80bd9d6b3df9fe2616595d7782a8f675e2090b51a33181b6b704ba21b6a9d428ea074d8a2d130e8cb0c8ea1f506d0c8f3ab1a5ea6242032aa14c40db7b59823c71a94e9a7620fb8f1cb1f11175ea8a528008cbf9703bb435d963ba4e5d813315628658693496a819dfd0b40113768409035f4aa372238ecb308cbe7eb593ab0ddef4d00feb03673554301b8f5e2708dd2366b64b993749b4570c975de637d6d99cb92d96c0c8716b7b598d0b7f870e44bb89e710be0c8f6fb6f37ebe247e0f324057540f064c55c47131ce4d807dd89b56f51f258b103a2bcb8e5c97dce53f68dc34c52c72cd20169f8367c4f75f7aa3bd2f6d7d3b6bc00bd0e40fa9d4ae47f7817e3c2d3fa0cb29e3af4b1394e008dd7694a7c2659182d659027cb60ae129f618706859d8bde510f8a9b26f5181f2fe8829a3f0e78ad3a2ab3baf56f7dd46b4dbb05be0026f383d347ce863b626c0fe89e0c0de08fb740440e64147ea2de36d0f599d4d3bb98b05cd85cd591bb5962b2a8e2b829bbb6ce15ee33f67208bd9a88531491224a09f28f884e50c5128d8a3b1ad318ffbd147ea262c74528da8e395c91be6511bfa7351af25a576c86ed5009e53af4ba1dc89bbcbf495a5c4900c0237924198fd15bf7321fa8992648f5dd6f2ed2b1545e30afd86730b60e105093b3dec894e61dbaf8e31b1eae4f78851a8a855f9f9ef35c32487f1b0e42d9de1fd78c6c613f00073d34d21ce1489054063308db9023ec92fb4b962e3ab476212d5e2eb3c22cc86a2efbce4178e20ddac757485eb31930ba7aa619c407fc682310b96f285f10d21ca1fc07634457db05bed4078bca7757166d22deba2984ddca141bb264bfdd807228b5d9e5ec4f0e1a2c5771aaa417fbd6f420a87a78303efdd813278195995aa481ca949038fd42d1a14592b1cac5528ca4174385f6065d365494c0048a7aff661639b183dea3d17fa649d9514578cd02f4db46a7403f8fb843786f7bde3e249f6698b7ff6a91b489a0f628236b3bb8be1f0ffe0783f26109c3ccbc2fc1719ad185e2da2036a88e9e32da1f3372386ab90069bc90fd11bcd62ed62d5ebb9c260a13e7e15fd306c3be19d875fd6851f806f2ac7cbe0f292983781ba849cbf4f938ea0e588af642920fd69cb0111c83206b16d7d187bf3735f4589aa3ab25dfeb321472dc86138de4125ee3a036fc15ccd2c9a03d02009f3c4a8dc6b7ca6fb47419b4a8278ff377955b918d563e8b08f5add7c8dd95568a51ad8bb36df7483fe65ce68ecbdf6f805f5ee66aad56900e3694df45858a0fa6c1be1f5c5b50b1f1b8d65febd5d9c168725d2ee2a0cde50a324fba24add602817208409bd3be2501018d6fdd382c48fb88e26aec6b27a599f4e2a554dcae61735f5f02041ab945b545bb4d974e4ecca67feb34eeafc52f8e960983f8ba2f491126c7fac488845531dfafc402c403fd73ff0cd014111218d964c1c6c3314bac1c0783e1830c8f7d39adff39124515e4481f06e2a6ee69ae2a359911514f1e99069335c3a55555073a3e295e31f68fc727cc508eddea333a193c1d8a938ddad8ed5bf3e9db501175fc1d0a17abcd2e4a90f3327d869257f", 0x1000, 0x40000c1, &(0x7f0000000080)={0x11, 0x7, r4, 0x1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x14) 2.187495935s ago: executing program 0 (id=1334): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x40000000}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x4ffc0}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.187334919s ago: executing program 0 (id=1335): ioctl$EXT4_IOC_CHECKPOINT(0xffffffffffffffff, 0x4004662b, &(0x7f0000000040)=0x6) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101c02, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001dc0)=@ipv6_newrule={0x30, 0x1a, 0x1, 0x0, 0x0, {0x81}, [@FRA_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @remote}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000002000000c00000a20000000000a03000000000000000000010000000900010073797a300000000200000000090a0104000000000000000001000000000a40000000000900020073797a31000000000900010073797a30000000000800054000090000000000000000010074617267657400001c0002800400030008000240000000002100010041554449540000001400000010000000000afcd1bf4ecd004e8c3200c9ed2d9610bf36e5b49471c6bd1d93350335f38ee981569bb1cbb13f6bafd6d360e2946172b40bb194dbb5869e7681d6a1999eeef93c6095b22a3f6bbb663fff8f948d8d7ea047a3979fc0a250edf6dae8d92f1340439387ba7aeed808c1486e55a0d1a484e0f1"], 0xb0}}, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f0000000240)={0x1, &(0x7f0000000180)=[{0x6, 0x3, 0xd9, 0x1}]}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) unshare(0x2040400) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000006800010003001000fdffff7f00000000000000000c000200020000000800000014000c8008000300fffffffffffffffaf6ffffff06000300", @ANYRES16=r4], 0x40}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r4}, 0x8) write$ppp(r1, &(0x7f0000000200)="7489", 0x2) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@ipv4_newroute={0x38, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, @LWTUNNEL_IP_OPT_GENEVE_CLASS={0x6, 0x1, 0x3ff}}}}]}, 0x38}}, 0x4800) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f0000000340)=""/159, &(0x7f0000000140)=0x9f) 2.18670198s ago: executing program 1 (id=1336): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async, rerun: 32) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01f71800000000000000240000002400000002000000000000000000000400000003000000000000000000000000000000000000000d0200000000000006"], 0xffffffffffffffff, 0x3e, 0x0, 0xa}, 0x28) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000040000080200007bf8339a52e15b6c0000005105909877ecf892cf6033cf144c673876eea8bf31"], 0x0, 0x28, 0x0, 0x1}, 0x1f) r2 = socket$kcm(0x10, 0x2, 0x10) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000003c0)={{{@in6, @in6=@private2}}, {{@in=@local}, 0x0, @in6=@ipv4={""/10, ""/2, @broadcast}}}, &(0x7f0000000180)=0xe8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) (async) pread64(r1, &(0x7f0000000340)=""/124, 0x7c, 0x26b) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e0030000280080006"], 0x68}}, 0x0) (async) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="510000001000090e0400"/20, @ANYRES32=0x0, @ANYBLOB="a7ffa888080001002c00128008000100677470002000028005000500010000001400080000000000000000000000ffff0000000008000a00", @ANYRES32=r3, @ANYBLOB], 0x54}}, 0x20000040) 1.702118891s ago: executing program 1 (id=1338): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="bc010000190001002abd7000000000007f000001000000000020000000000000fe8000000000000000000000000000210000000000000000020000003c000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000001000000a80c00000000000000000000000000000000000000000000060000000000000003000000000000000000000000000000000000000000000000000000000000000004000000000000010000000000000004010500ff010000000000000000000000000001000004d56c00000000000000ff0200000000000000000000000000010000000000000000000000000000000000000000fe8000000000000000000000000000bb000004d43c00000000000000fe800000000000000000000000000001000000000000000000080000b300000001000000fe8000000000000000000000000000aa00000000320000000000000000000000000000000000000000000001030000000000810008000000000000000800f500ac1e0101000000000000000000000000fffffffa3c"], 0x1bc}, 0x1, 0x0, 0x0, 0x20040041}, 0x0) 1.54522116s ago: executing program 1 (id=1339): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0xfffc, @local}]}, &(0x7f0000000440)=0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000000206010800000000000000000100000a11000300686173683a69702c6d61726b00000000050001000790116005000500020000000900020073797a300000000005000400000000001400078008000840000000d308000640"], 0x60}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={r1, 0x1}, &(0x7f0000000100)=0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x3ec0) close(r5) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket(0x840000000002, 0x3, 0xf8) connect$inet(r8, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r8, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r8, 0x0, 0x2a, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x7, 0xd, 0x0, 0xc, 0xf, 0xe, 0x1, 0x4, 0x3, 0x88, 0x1, 0x2, 0x4}, 0xe) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@struct={0x2, 0x1, 0x0, 0x13, 0x1, 0x2, [{0x2, 0x4, 0x5}]}]}, {0x0, [0x0, 0x2e, 0x2e]}}, 0x0, 0x35, 0x0, 0x1}, 0x28) getsockopt$PNPIPE_IFINDEX(r9, 0x113, 0x2, &(0x7f0000000800), &(0x7f0000000840)=0x4) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[@ANYRES32=r9, @ANYRESOCT=r7, @ANYBLOB="5800000002060102000000000000000006000002050005000200000005000400000000000c000780080012400010000014000300686173683a69702c706f72742c69700005000100070000000900020073797a3000000000088f2b8a5b3557ee", @ANYRES8=r3, @ANYRESDEC=0x0], 0x58}}, 0x8000) 1.428547493s ago: executing program 0 (id=1340): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200c}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_FORWARD_DELAY={0x8, 0x1, 0x19}, @IFLA_BR_HELLO_TIME={0x8, 0x2, 0x5}]}}}]}, 0x44}}, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001a00)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="090b0000000000000000050000ff070003"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 1.309850306s ago: executing program 1 (id=1341): unshare(0x22020400) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000005000000020000000400000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000180000000"], 0x48) (async) close(0x3) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0000000000f90000000000000000000000000000fb3d051d97e2a2ef016e7d72a7121baccd175654ee9d371b577e", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000009c0)=ANY=[@ANYBLOB="000000000900f41811000000000051cbbdec00000000000000903c498e5cc4085dd714680500961511bd3334096bf742bdec6bde47e66a083f16119f760db2afeba1dea070228da45884e49b487726585f4262f78778df4b70797072cf54b0553a268543d9ab8a40f91d7c673576b709b2f27ae17f05d83a131d6dfaf9e892ee0b5c2bb4ac91279d6881fb683fa5477e8835cfa1ce6792a7b6d6959f78fcdb925f54671741f3d0c72cd8fcee913f2733c7d8f1f4e9e6fb212aef4233cca9e7f55e23f9a8563e653686001843d058a35245da47e23186a22f60d1451e3e44b774c1a7a499eaa550af017ba456d2bdc2e9f231eee175067eaefce2443187857f4e98acc22ef93925c53596edc82b7f86ccd1a7a4e61698455d069a4d7312f2e6e1f7ded7876190486704ab2860c70eea3b835fec36f6cc093d00216a8160488c792d0be15515a721ac6ea56e7256167b24b234b4b216d28872802de1088631572dbcafa35cfb127012cc9eda61d2eb7b32d38e4b2b68d8673de93b5bc713da08d680080b80fc8701bf7f5f10144da59bc11ca8edf650ec0a86851f1e1739d926b8de315015d0e90496aa829c8ddd086a086ea5d7d883faef46581cc735187818e028a7125384972792b4fb300c0d59d4eb3970b219d8129de4a5578d9d2114216c76728688333880fc00000000000000000000000000000000be0a5ed27f62829153c4f20ffebdd89bc13d9e1a312df74e5d31aef54c52a59ade38c7e424f75b3c788d7b6f359d01ccf351bb7b39aa547be0d00b953acd0a211978da6274b9f23763608a46ab36218f5ac450083b29414cdb2129ca3045358f13abb60515fee82971925f367d7076034687bfb018bac74572e54bdcf36ac3eace7364783e98c5eeba6d9b897dc47b8a7b3fc077e6cf0f0320de64419b9d290b6280b6cb7884f07056556fd59a3799917f474c5ca20a72b721803e8ed1", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000010000e1850000008600000018110000", @ANYRES16=0x0, @ANYBLOB="0000000000000000b7080000001800007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x13, 0x21d7, &(0x7f0000000600)=ANY=[@ANYRES16=r3], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r0}, &(0x7f0000000080), &(0x7f00000004c0)=r6}, 0x20) (async) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) (async) sendmsg$unix(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0000000061000000180012800e0001006970366772657461700000000000000006000100"], 0x44}}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) (async) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="120000000b0000000800000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r9, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000100)=r8}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000240)={r9, &(0x7f0000000700)="0265ded971db93f0037ce2d9ebd6352384fe2f4830102f88f87fcf9ba909a5c55ccb7bf3d851599d348f044a8d400310206f5a71eb85783117616a75d7706173847f7a8092ac8208fcdae0909f330ae5c547ca958697ca4ef263a02293eb5a2fd5b1b8394395508c532bee33bf4a2feb3a45c2eec8e99e1143390e758fee5643b9607cfa1d3d81a2e1907aa6089e77cae72726b9feea24f111d06fb34adff37c7481bdad0f67dd0ebb36a94d1a02804fce92984b38233836e91a190cc29f32dc47c97a6f3d1baeafedf4dda50171938467af3189b38ff0071cd5ef53c03fd6163250c91ee00d1a9285c2b45cbf007138f4a94f1cf41b1f97379d429370781b3e5be075d74461dc209cda6f4ba63818c6c6b3e54338895bc1c4b630bcc241e55faa8e1069ff5cf90f3edd5a1981cc06f21afb039c462603c91a4e555b495b1d577a771f35e02dd0e822083471d094405ddb2ffe2f", 0x0}, 0x20) (async) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000000)={r10, &(0x7f0000000400), &(0x7f00000004c0)=""/78}, 0x20) r11 = socket(0x2, 0x2, 0x1) bind$unix(r11, &(0x7f0000000000)=@file={0x0, './bus\x00'}, 0x6e) r12 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0008004a00003c00000000000690780a010102ac1414aa07070441b6ccdc440c0b01e0000001000000000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c0000003066932d7e6209c894ad1815a6cc94907800006cba3f69c034217505000000824494b8bf57048365bfd4c59a4e602f22fef5f70fe0d3b9d3592d3096e6f88771ebcd5ded949e8de8d0fb3c4e28ac6f97484906435fd685405c"], 0x0) (async, rerun: 32) sendmsg$nl_route(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIN_LINKS={0x8, 0x12, 0xe}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bond0\x00'}]}, 0x50}}, 0x40) (async, rerun: 32) r13 = socket$kcm(0x23, 0x2, 0x0) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), r14) (async) sendmsg$NLBL_CIPSOV4_C_ADD(r14, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYBLOB="010000000000000000000100000008000100030000002c0004800500030001000000050003000000000005000300000000000500030005000000050003008000000008000200"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async, rerun: 32) sendmsg$sock(r13, &(0x7f0000000680)={&(0x7f00000002c0)=@nfc={0x27, 0x0, 0x1, 0x6}, 0x80, &(0x7f0000000940)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="d01022b9031591cb00f6947437f6d95ae42ba1e7c4696afbc5a9997e319485b4fa1936454d16b6d409e0d432c20aa1a93c81191c6f4c504bb5038d29ed", 0x3d}], 0x4}, 0x81) (async, rerun: 32) r15 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r15, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000013c0)=@mpls_getnetconf={0x14, 0x52, 0xd03, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8000800}, 0x8014) 1.179025994s ago: executing program 1 (id=1342): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x22500, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="180200000a00000000000000030000008500000041000000850000005000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x359}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r1, 0x0, 0x3a, 0x0, &(0x7f0000000140)="09b8232df7ffffffffffff4273f928901a70464133e98967edc0d0a1b71dfb35237eb30101a2b6295bb1a33e3f3f5f8f23000000000000000000", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x9}, 0x2e) r2 = socket(0x10, 0x803, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = socket(0x11, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8954, 0x0) close(r6) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r10) r11 = socket$unix(0x1, 0x1, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0xaab}}, @TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x9}, @TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x8}, @TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x9}, @TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7, 0x3}}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000007c0)=@newqdisc={0x110, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r13, {0x0, 0xa}, {0x2, 0xb}, {0xd, 0xb}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x44, 0x2, [@TCA_HHF_NON_HH_WEIGHT={0x8, 0x7, 0x2}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x1}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0xfe}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_QUANTUM={0x8, 0x2, 0x10001}, @TCA_HHF_NON_HH_WEIGHT={0x8, 0x7, 0x7}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0xac, 0x29, 0x7f, 0x0, 0xfffffff7, 0x6, 0x5}}, {0xe, 0x2, [0x800, 0x200, 0x9, 0xa, 0xffff]}}, {{0x1c, 0x1, {0x7, 0x4, 0x8, 0x0, 0x0, 0x1, 0x7, 0x4}}, {0xc, 0x2, [0x2a0, 0x5, 0x18, 0xd1]}}, {{0x1c, 0x1, {0xb, 0x11, 0xfc01, 0x3, 0x3, 0x4, 0xfffffffc, 0x2}}, {0x8, 0x2, [0x1ff, 0x1a50]}}, {{0x1c, 0x1, {0x5, 0x7, 0x0, 0x3759ed75, 0x0, 0xfffffffe, 0x400, 0x2}}, {0x8, 0x2, [0x40, 0x6]}}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x2000c061}, 0x2400c810) ioctl$SIOCSIFHWADDR(r10, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xffff}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x40) listen(r2, 0xc) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x68, 0x2c, 0xd27, 0x70bd2a, 0x8000002, {0x0, 0x0, 0x0, r4, {0x0, 0x6}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x38, 0x2, [@TCA_BASIC_EMATCHES={0x34, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xff, 0x1, 0x8001}, {0x8, 0x6a6, 0xffff, 0x5, 0x2, 0x2}}}, @TCF_EM_META={0xc, 0x2, 0x0, 0x0, {{0x5, 0x4, 0xc1c}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008004}, 0x0) 1.047207402s ago: executing program 0 (id=1343): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)={0x24, r1, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x8}, @NL80211_ATTR_TXQ_LIMIT={0x8, 0x10a, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x8090}, 0x20048800) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}}, 0x28}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="7a0a00ff00000000711065000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) 998.484511ms ago: executing program 4 (id=1344): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) unshare(0x22020400) socket(0x10, 0x803, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, 0x0) 931.790454ms ago: executing program 0 (id=1345): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x60, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x5}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x9}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0xc0d1}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f0006400303000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, &(0x7f0000000000)=@framed={{0x6, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x4b}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x8c}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f00000000c0)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000080)="5d3dd18987cd5789531472c5532abebc", 0x10) setsockopt$MRT6_PIM(0xffffffffffffffff, 0x29, 0xcf, &(0x7f0000000000)=0x2, 0x4) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000065c0)=[{{&(0x7f0000000180)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x24}}}, 0x1c, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRESOCT], 0x28}}], 0x1, 0x0) 914.584411ms ago: executing program 4 (id=1346): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r0, 0x1, 0x13, &(0x7f0000000180), &(0x7f0000000200)=0x4) (async) r2 = socket$packet(0x11, 0x3, 0x300) (async) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) (async) socket$alg(0x26, 0x5, 0x0) (async) ioctl$FICLONERANGE(r3, 0x4020940d, &(0x7f0000000240)={{r2}, 0x2, 0x6, 0x6}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x0) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) (async, rerun: 32) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f00000002c0)={0x0, 'ip6_vti0\x00', {0x3}, 0x4}) (async, rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) (rerun: 32) 632.864961ms ago: executing program 4 (id=1347): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="e80100000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff020d40f799000000000000000000011400040020010000000000000000000000000001080007400000000010000d800c000380060002004e210000080007400000000da800068004000380080002006401010124000380060001004e230000060001004e230000060001004e210000060002004e24000008000200e000000234000380060002004e230000060002004e240000060001004e200000060002004e200000060002004e230000060001004e200000140004000000000000000000000000000000000008000200ac1414aa140005000000000000000000000000000000000008000100e000000284000e80140001"], 0x1e8}}, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x758, 0x0, 0x1, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x58, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000600)=0xffffffffffffffff, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a80)={{r7}, &(0x7f0000000a00), &(0x7f0000000a40)=r6}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r7}, &(0x7f0000000880), &(0x7f00000008c0)=r6}, 0x20) r8 = socket$tipc(0x1e, 0x2, 0x0) connect$tipc(r8, &(0x7f0000003100)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x2}}, 0x10) sendmmsg$inet(r8, &(0x7f0000002f40)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f00000002c0)="91199893b794f675ec88239fef317c764ee3a8ecbdc2a8c32d46f77944d1de9f924d05d3566b8eb8f5750393c669559d05543efa2927ef0d2b10e3d4f8541f34e1c7c8ca2d1e811f67f3dc50fdd469af72a49e684e28a364f5da124dff2b55a5536aa670b82da70bf0f19cd420371848ddc41d65649fde307c1971599f2fec84845e32bb2b6ebda099de12e8b64842024389524a1c5a97608000d1030d99e2a6e23a0bc8", 0xa4}, {&(0x7f0000000380)="11a68683394e1541cc444dff7adf30f079408cb066a6f8f4d33c4f11850de78c586d1a2ccff92e8e83fb82e447d9b88de42182e9e8c97415f41ef8a504215a2b2fdb1404c9659fdb988d0f527c3675cf2b", 0x51}, {&(0x7f0000000400)="875ad17d55c11f1ea6ec6cd17661afc73209e32142961e4660591bf3ca40d05a507ac0b0e71f7ed4c63f52a003cc8102f20dc6e33b5dc6de64ac815cf87867507cc072f0cb762aa5deb8731a699d3c7c69f85266ba51eb244f20129de491adaeb0c2d2eb13c1f215ddff92b05148f0ad513018b14798e45e55ecb916d4dd89f2df7e33c470998f325bf453f929d86196", 0x90}, {&(0x7f00000004c0)="1273dd9951adeaefffe3c4957c86dbff8693adf2202b620b3aec000cf330bb7249", 0x21}, {&(0x7f0000000500)="4167c4fd9ea8b423c01e798bbd631e888a04e31e6865a2d55b31833b82989759c0f3241bb5ebe979636a5f22244112d95d11a07cb172724ec37ef9faaf227d64f5190c9d82dfe194b2cf6d77e917e513170fa1e8e4c82dd9898b4ad23e677261595ec62844104d7ca15aa7eec90685ad92f2cd5b745910e47d703315a0d1d3a6d143575da2604e54bb1ddb295e590a1392770befa52aaf1651d375682bcf94e5da4ea37e1cde1d2a80890d896cfe4d08801bc50d9bc08480de2b2710b694ff7fb5bda12cd8a8cb8dc18bf0c265b71aef50ec0ee22e1968a4f3487d8487026bc2b721692064dcfdd1b6b6aec3e8da3d0ab7d3cc51e2db33c169e6354ea425fbfc1bc39057e64d3aff3749d60edcf0a50fe0e973b5ee3a7cd45ad967564fdbc9832869346037dabe420448b5089ab553c2c87e94befac8d3a0c2a56ca2ab778c2f34f571217c837580e8a524db35baea8024482bb32306182faaf39bb1c4e992c4440889e274952ed3d17d5e87224fec8048e6b7344270e046ab2fdda270ad4e5f651fd6eede5d42d9599265520d45d6f500fd733372a62ab4f496b56839b0d6418961a3b6016c26409daba4f2beeceeb38cc6ba75f57e8ee45d8a6c2ecc031c9469d937b9d7db91ded158ebd7f7d512d445f4104130a429ce7fce52d3fec37df953fc6e6adaa781b820b4bb6d4ffd2c10a16f9583890118793bae09157d3ac5625ad8e66a367488e2722bb82161661711d91a5540a92e3de7506861875575d40465cda28989cbc46fb3d80c2bc7e96afbde1cbd2e89103c55bde669c77b774ea570b26e93a1be5e50269ea5f3355869ac5a9701ac0e7d8f69b0a3186e118c6e2ce8e946c95bd729d94d237e5915e2711cc82826f147176a8a0555b9e11fb9a8ad736d016d202cea43b10a5102e48387ab70069b876051ac0557528c14748aa9cc0e0d9bf512533bdc83610d9f801ec4ed512a4a877e2f45b0cbe87ee25a314d481153eefe8643fb2f3e0478353552b0ae863635ab12e7bf0e4f046e8ba9cb7ce3189d52b2a27ff9e4eb5bf8b12d09d610705eec149589bdd38c951de63de4e3065e45eeb261a72c980349387514cb42467e1fe5812abaf4670e993c6fb561e5cccf7a472ee874bbfe73412bc63f706424f174afd1a3f16fb8b8305d932d33ab211d473d210b87e2f20b6ba951a2b98206793c04516fd57fc7365cec4a1831548470ebefe7f9487cc7b287b2f45eb69b4e165b9f3404d8ac84b2b57ace34de669a85fd885ecb055a6fd2ba5d5396737c702c082bfb35f3ccace91eacfc7a71b2bca1e228170ad6d194aa7c2dc2cf5f0bce153ac1befb2b82e6cf1f12d28812e309f5da0dbe1cad03172d296fa13247b1952ec988316f668aa65e1ca7e9e383b115ce5c25130955c118a0b4567bd180c07ce18bd0c459cc33ed7ba1c43262034a60711315ed81bbc95b7e3088dbd22b976fcd18bae330f08c89236f770478305fac20b5d9bd5cbc98c5c0f9713345c7362bc0e0bc78d212433bcdc6142989bc6ab82160df897825aa906d739dac905a434c90b2cbc72223011ea11480278b681cdcdf5fa63ac5f8b8f1f3ef7d4eb02f422e9fc52b98163630cd2f130f076a33bb011bb8e42800c9475f5cbee042b79fda44b6432b126f085a17553b82d9cae519ec239a9cccb99444f24b8f11e255e31e0d53a28e36949a3f8238c2ea3f4e3d8cf3b85b031c962504d00a4e7928b5fa2fab311bcc54d68738086ce70a8e5bdaf425033036a85e59aa3bb1b01f8b6c6a2e221c69e48565b55a196b2dc9cb067b4ccf8a7c81e31795a8b74e8940455126f19c8bbb9b941cc66c9443fd13e20c2074a9c3bc1740262c1fcb8e9ca5ac5729dfe6e25561eba41ccae8ca2e851affc1ab4ec912925ef7ccf72e97c577413260ccda170d75741336f837258a59da907460a2917f652c6e4ebc0467da8a95f2ceae9afcc4e0d1f4b95fc68b2f5e32af96fb12a8e7f3140dd235a30e5ad94e78cf58ad75ca8a871a70820090ba510e7563c0f78cf364369a51fa6683ff8d24924ceb922927eb0ba1395b7a4f37d92913a9688ef8428a887f1161f10aeab749f5ea8ca24e579008f542a9b785841dae071b94b5a8ba79985930f60ac2c93aa002d84b212e2e2b6c9c2a0694595dad99fd1f27d0044481ef5b364a059599ef982a114a61094b3b7d0f9a7b78d7615cc8573430e676987ab7421fde9abeb29e4529beb6a2724bed86a7b1d27ee73585892f083fad4307696a4166356b9c20a9579bbf3e8cda9ad7ec2b2bb973d05cf8d9457dc03eee2cfbf630dd917768ae652c0627e32ebb4c62951dfbd8e074dfdf02c5517ace50d5813c8d8d7f1fc0fc63a4fae5c2bcf26560c627500e03692384630be287790d545403adc500ef732d66e269b8b051aa57bb865a9b709c7a0426188daf29caf1d062b104592b4f6acc86895956d8085424dba0bfafdf900419f2227db1eca75b338091d23da2067566c6d54de1604bf8d4cce8a0b4484c4645a305861bc46ebccafbe500e01d51236b40027d1b2c7a72937b15899bb982c880d83ed6b70502bd0d68d2a2146a85c6518a11c386df610243ec513e7a284a81c841f9201ee3b9d3a8f44cdf52ec842e07c1f2f35e2a5b17278dce1f9b7fa09866ecb0d2e78fc8095b7dee81d3e308fd10a1490036194bfa89c118bd9c72d4747b90724d7bd0a7ead28c89c23cc6667c1a8b362ca5385d24b2c1265957764a4e46176365a5348bcf85c457921e7fa6c9e165b6c4d8bd9e8782c96839a5fd2679cd08f656ca5b41d00f8429d517a0d776049918e73b4a258fd2a1576b6420b67fc9ff3520556881ef4838e973f552edebde686af1d55e6172e5bb9b01543d32c0c7753b380dd9ed3f5c0b663a9b1bcb4bd36a365172aeee96a8d69c1e5c5b6c88fc9453ace6aa24bdfc1cfa27ea8cc36c80cace296259545a4e155d154ccbf00ae4ff912c583c871b7cdb46813584ea14bb6943d16b3f12e8fe149076e5e646e1dca0bf121a2e2fa09816e9056aa1143988ff17c21c49981445d98d88fd4bba6a59d9f97d301d90e3754103389b36308713c1ba31031e42f2d759343a95bbae9c01a3bb3e6b537b658d1c028c8ec3126bf79db223a3320e25a671ef834c924f02c1bbab338517accb8378f945cb1d65d4dff90f1e3af8168e33a5a124aef715b656075f6a62099afa110f2fe5eb83e0b3e36df91be2125be6500e5f3a81f8bc116f42734c784f6bb6c7e968610243b06026a9def4e85f8344fae36602aa3795cf71ecf7e57a3da0bef859daf649abc6390e86edaa84eefe48999ddba9067b90dd5ea2477f150ab588dadfe79ab7524157d1b94c738ca3345ce8657bfac981cb30b7c0f05f96dafcdce3e41471943609b121de1eda3e95a1c31bada084beec699512c7d5cec71e06a57c177ca1f383120bf46a9c805c9220d3d0c6807d60e6b7f9c80de1d815bdf1ebe62338862719eab55ef4971a69c76aa2f25c3c9d0c2e5c7857a86f9ab26c3c6aa395f2c366548f60a40abbe14dd011358d9b3695b8a091e16552478aeee1e2e91abd67deeb15732f428c3304a2bf2e4cbb3768875b35d126ca46d29e506ee1e0aba7a17eba27c19d7626064c0a17d7ee7f2f220e5e28bd7d691dffa84f2a2f92c924b87da382ae9a688ad4322fa0cc72604fc43e17002b8f3844a7431205de46818310d0fcf4676f45c9941dde767c9a4376e13cd7e91308cc0df25a4c79e390674fa0161695cc9e9bee12620d8571a4b3800370cd01bf0546758a048563539edf15d58b108159ea5fe0f038281c7855bbd92cc86de38df60b8597f4bce4ae9cae1647b5024bfb73630cdf4d1827a5f0ff779a1e6c6efbc6561d06b249986703b9dc61a63e2068e4786e6a8be34a808143301ef00f21bee8399d88ecffddb4867790d4d1cbe827a5a220834ba831d3ba424ff8fc9a99b175d2feca9f581e24bb69bdc4f64a6ea0c9c37d6976d15e9388519a2bed100a2a8358215a8b63b6e25a677875ee2bc3fd9c77783b39a166b863376b496775b83804a2c7f5363cca9ade819034afc2f7b40ffc316089556dec2e55e1bd92c9b905d6b1b9160d6c492d4384acd7e380874939b1ab02dbbacfbedd74cd524b4eab643e8b92d38d9fae446afd8d774d1c933bce8c341f0ff283acec3bbbbfdb06a15eb88ca6600542dda45334a374e31bae", 0xba7}], 0x5}}], 0x300, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x14, 0x4, 0x4, 0x448, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r9, 0x0, &(0x7f00000000c0)=""/193}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r0, 0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000900)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x3}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a00)={{0x1, 0xffffffffffffffff}, &(0x7f0000000980), &(0x7f00000009c0)='%pK \x00'}, 0x20) r13 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000a40)={0xffffffffffffffff, 0x80000000, 0x8}, 0xc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b00)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000a80), &(0x7f0000000ac0)='%ps \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0x2f, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xc75, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x17}}, @call={0x85, 0x0, 0x0, 0x95}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @alu={0x7, 0x0, 0xd, 0x2, 0x1, 0xfffffffffffffffc, 0xfffffffffffffff0}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x87}}, @ldst={0x1, 0x1, 0x2, 0x2, 0x6, 0x40, 0xfffffffffffffff0}, @generic={0x6, 0xe, 0x1, 0x1, 0x6}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000400)='syzkaller\x00', 0xbdf, 0xe0, &(0x7f0000000440)=""/224, 0x41100, 0x8, '\x00', r4, 0x0, r5, 0x8, &(0x7f0000000640)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000680)={0x3, 0x2, 0x1, 0x5}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000b40)=[r7, r9, r10, r11, r12, r13, r14], &(0x7f0000000b80)=[{0x1, 0x2, 0xf}], 0x10, 0xfffffffb}, 0x94) 273.873583ms ago: executing program 4 (id=1348): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, r1, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x9}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000c4}, 0x0) (async) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r3, 0x29, 0x19, &(0x7f0000000400)=0xa4, 0x4) (async) syz_emit_ethernet(0x6e, &(0x7f00000002c0)={@multicast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "828bf7", 0x38, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, @mcast2, {[], @time_exceed={0x2, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "fd9063", 0x0, 0x3a, 0x0, @private1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [], "1e520b4c951ee12e"}}}}}}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000940)=[{{0x0, 0xfffffffffffffde1, 0x0, 0x0, 0x0, 0xffffffffffffff4f}}, {{&(0x7f0000000340)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)=""/190}]}, 0x9}, {{&(0x7f0000000600)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x0, &(0x7f0000000700)=[{&(0x7f0000000280)}, {&(0x7f0000000680)=""/106}, {&(0x7f0000000480)=""/61}, {&(0x7f0000000800)=""/130}], 0x0, &(0x7f00000008c0)=""/99}, 0x16a}], 0x1, 0x0, 0x0) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)=@flushpolicy={0x38, 0x12, 0x105, 0x0, 0x0, "", [@address_filter={0x28, 0x1a, {@in=@dev={0xac, 0x14, 0x14, 0x18}, @in=@private=0xa010102, 0x2, 0x6, 0x9}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000001}, 0x20040810) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, &(0x7f0000000d00)=0x2b56, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) sendto$packet(r7, 0x0, 0x0, 0x20000080, &(0x7f0000000080)={0x11, 0xf8, r8, 0x1, 0x1f, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}}, 0x14) recvfrom$packet(r7, 0x0, 0x0, 0x2000, 0x0, 0x0) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_KEY(r6, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x14, r9, 0x10, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}}, 0x14}}, 0x20008000) (async, rerun: 64) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0xffffffff, @empty, 0x10001}, 0x1c) (async, rerun: 64) r10 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r10, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) (async, rerun: 32) shutdown(r10, 0x1) (async, rerun: 32) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000040000000400000014100000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x50) (async) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r12, 0x0) (async) r13 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000a80)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001240)={0x8, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000020000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000004509010000000370952c96116027fc26d4909dbf59772400000000000000bf91000000020000b702000000000000850000ddac000000b70000d7370d1f0e0147cfad2a881c45000000000094fffffffffff00000"], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x100b, &(0x7f0000001e40)=""/4107, 0x40f00, 0x0, '\x00', 0x0, 0x0, r12, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r11}, 0x50) 119.050045ms ago: executing program 4 (id=1349): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="bc010000190001002abd7000000000007f000001000000000000000100000000fe8000000000000000000000000000210000000000000000020000003c000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000001000000a80c00000000000000000000000000000000000000000000060000000000000003000000000000000000000000000000000000000000000000000000000000000004000000000000010000000000000004010500ff010000000000000000000000000001000004d56c00000000000000ff0200000000000000000000000000010000000000000000000000000000000000000000fe8000000000000000000000000000bb000004d43c00000000000000fe800000000000000000000000000001000000000000000000080000b300000001000000fe8000000000000000000000000000aa00000000320000000000000000000000000000000000000000000001030000000000810008000000000000000800f500ac1e0101000000000000000000000000fffffffa3c"], 0x1bc}, 0x1, 0x0, 0x0, 0x20040041}, 0x0) 0s ago: executing program 4 (id=1350): r0 = socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r3 = socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(r4, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$inet(r3, &(0x7f00000053c0)=[{{&(0x7f0000000180)={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f00000001c0), 0x0, &(0x7f00000004c0)=ANY=[@ANYRES16=r4], 0x70}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x3, 0x4) setsockopt$EBT_SO_SET_COUNTERS(r3, 0x0, 0x81, &(0x7f0000000400)={'nat\x00', 0x0, 0x0, 0x0, [0x1, 0xe43, 0xf, 0x1, 0x1, 0x8], 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}, {}]}, 0xc8) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r7, &(0x7f00000004c0)=[{&(0x7f0000000200)="db", 0x1}], 0x1, 0xc1a1, 0x0) preadv(r6, &(0x7f0000000180)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1, 0x6, 0x2) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180001000000000000000000000000001801000020646c210000000000202008001a0000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b708000000000000000007020000f8ffffff00b70400000000000085000000030000009500"/58], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r11, 0x0, 0x10000002}, 0x18) getsockname$packet(r6, &(0x7f0000000500), &(0x7f0000000340)=0x14) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r12 = socket(0x400000000010, 0x3, 0x0) r13 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c00)=@getchain={0x34, 0x66, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0xa, 0xffe0}, {0xb, 0xfff3}, {0x0, 0xfff2}}, [{0x8, 0xb, 0xd}, {0x8, 0xb, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'geneve0\x00'}) kernel console output (not intermixed with test programs): speed is unknown, defaulting to 1000 [ 148.490883][ T5940] syz1: Port: 1 Link DOWN [ 148.537485][ T6223] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.568744][ T6223] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.610455][ T6223] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.643029][ T6223] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.829598][ T7518] tipc: Started in network mode [ 148.842401][ T7518] tipc: Node identity ce81459ac482, cluster identity 4711 [ 148.876100][ T7518] tipc: Enabled bearer , priority 0 [ 148.955928][ T7521] syzkaller0: entered promiscuous mode [ 149.025385][ T7521] syzkaller0: entered allmulticast mode [ 149.130811][ T7529] netlink: 'syz.0.393': attribute type 1 has an invalid length. [ 149.201159][ T7521] tipc: Resetting bearer [ 149.227693][ T7509] tipc: Resetting bearer [ 149.330858][ T7509] tipc: Disabling bearer [ 149.620633][ T7536] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 149.669000][ T7549] netlink: 20 bytes leftover after parsing attributes in process `syz.1.396'. [ 149.679796][ T7537] 8021q: adding VLAN 0 to HW filter on device bond1 [ 149.688579][ T6223] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 149.752281][ T7551] trusted_key: syz.3.397 sent an empty control message without MSG_MORE. [ 149.794307][ T7541] veth3: entered promiscuous mode [ 149.801945][ T7553] netlink: 8 bytes leftover after parsing attributes in process `syz.4.398'. [ 149.806652][ T7541] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 149.820878][ T7531] pim6reg1: entered allmulticast mode [ 149.826829][ T6223] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 150.018427][ T7559] tipc: Resetting bearer [ 150.044848][ T7559] tipc: Disabling bearer [ 150.088518][ T7561] tipc: Started in network mode [ 150.124036][ T7561] tipc: Node identity 06e13fc196a3, cluster identity 4711 [ 150.131738][ T7561] tipc: Enabled bearer , priority 0 [ 150.145993][ T7561] syzkaller0: entered promiscuous mode [ 150.151485][ T7561] syzkaller0: entered allmulticast mode [ 150.216783][ T7561] __nla_validate_parse: 1 callbacks suppressed [ 150.216802][ T7561] netlink: 24 bytes leftover after parsing attributes in process `syz.2.400'. [ 150.239822][ T7565] netlink: 8 bytes leftover after parsing attributes in process `syz.0.402'. [ 150.251059][ T7565] syz_tun: entered allmulticast mode [ 150.268151][ T7562] netlink: 24 bytes leftover after parsing attributes in process `syz.2.400'. [ 150.393160][ T7560] tipc: Resetting bearer [ 150.407077][ T7572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.403'. [ 150.438912][ T7560] tipc: Disabling bearer [ 150.558752][ T7549] lo speed is unknown, defaulting to 1000 [ 150.602609][ T7578] netlink: 24 bytes leftover after parsing attributes in process `syz.3.405'. [ 151.068920][ T7596] tipc: Enabled bearer , priority 0 [ 151.171532][ T7596] tipc: Disabling bearer [ 151.710261][ T7610] wireguard0: entered promiscuous mode [ 151.753297][ T7610] wireguard0: entered allmulticast mode [ 152.151676][ T7483] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 152.169850][ T7483] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 152.193045][ T7483] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 152.218606][ T7642] netlink: 12 bytes leftover after parsing attributes in process `syz.3.425'. [ 152.222548][ T7483] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 152.239663][ T7642] vlan0: entered promiscuous mode [ 152.245349][ T7642] team0: entered promiscuous mode [ 152.250408][ T7642] team_slave_0: entered promiscuous mode [ 152.256419][ T7642] team_slave_1: entered promiscuous mode [ 152.273328][ T7483] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 152.294120][ T7483] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x3 [ 152.335632][ T7483] hid-generic 0005:16C0:5505.0001: hidraw0: BLUETOOTH HID v0.8b Device [syz0] on aa:aa:aa:aa:aa:aa [ 152.338648][ T7644] netlink: 12 bytes leftover after parsing attributes in process `syz.4.426'. [ 152.406546][ T7646] netlink: 12 bytes leftover after parsing attributes in process `syz.4.426'. [ 152.558207][ T7656] netlink: 8 bytes leftover after parsing attributes in process `syz.2.428'. [ 152.660270][ T7645] fido_id[7645]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci4/hci4:200/report_descriptor': No such file or directory [ 152.761779][ T7661] tipc: Enabled bearer , priority 0 [ 152.850667][ T7661] tipc: Resetting bearer [ 152.872138][ T7660] tipc: Resetting bearer [ 152.945923][ T7660] tipc: Disabling bearer [ 153.104788][ T7677] netlink: 36 bytes leftover after parsing attributes in process `syz.4.437'. [ 153.116569][ T7679] bridge_slave_1: left allmulticast mode [ 153.145876][ T7679] bridge_slave_1: left promiscuous mode [ 153.169912][ T7679] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.271271][ T7679] bridge_slave_0: left allmulticast mode [ 153.312669][ T7679] bridge_slave_0: left promiscuous mode [ 153.351516][ T7679] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.720265][ T7676] lo speed is unknown, defaulting to 1000 [ 154.366082][ T7726] openvswitch: netlink: Flow key attr not present in new flow. [ 154.422641][ T7703] lo speed is unknown, defaulting to 1000 [ 155.174491][ T7755]  (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 155.825694][ T7777] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 155.874361][ T7772] syzkaller1: entered promiscuous mode [ 155.879882][ T7772] syzkaller1: entered allmulticast mode [ 156.010067][ T7791] __nla_validate_parse: 7 callbacks suppressed [ 156.010087][ T7791] netlink: 36 bytes leftover after parsing attributes in process `syz.1.473'. [ 156.019273][ T7793] netlink: 80 bytes leftover after parsing attributes in process `syz.0.474'. [ 156.473031][ T7811] netlink: 4 bytes leftover after parsing attributes in process `syz.3.479'. [ 156.708498][ T7823] netlink: 28 bytes leftover after parsing attributes in process `syz.3.483'. [ 156.748290][ T7823] netlink: 4 bytes leftover after parsing attributes in process `syz.3.483'. [ 156.978413][ T7834] netlink: 12 bytes leftover after parsing attributes in process `syz.3.486'. [ 157.021086][ T7833] netlink: 12 bytes leftover after parsing attributes in process `syz.3.486'. [ 157.044297][ T7833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.486'. [ 157.079338][ T7837] netlink: 'syz.0.488': attribute type 2 has an invalid length. [ 157.143839][ T7837] þ: entered promiscuous mode [ 158.604066][ T7849] netlink: 'syz.3.492': attribute type 29 has an invalid length. [ 158.611927][ T7849] netlink: 4 bytes leftover after parsing attributes in process `syz.3.492'. [ 158.621337][ T7815] lo speed is unknown, defaulting to 1000 [ 158.632212][ T7857] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 158.834270][ T7864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.495'. [ 159.141221][ T7877] batadv0: entered promiscuous mode [ 159.150753][ T7877] batadv0: left promiscuous mode [ 159.572063][ T7894] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 160.255490][ T7919] tipc: Enabled bearer , priority 0 [ 160.275812][ T7919] syzkaller0: entered promiscuous mode [ 160.287489][ T7919] syzkaller0: entered allmulticast mode [ 160.397552][ T30] audit: type=1800 audit(1752106193.984:4): pid=7931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.515" name="memory.events" dev="tmpfs" ino=650 res=0 errno=0 [ 160.634295][ T7919] tipc: Resetting bearer [ 160.697954][ T7919] tipc: Disabling bearer [ 160.708321][ T7499] IPVS: starting estimator thread 0... [ 160.804631][ T7945] IPVS: using max 26 ests per chain, 62400 per kthread [ 161.216946][ T7922] lo speed is unknown, defaulting to 1000 [ 161.235707][ T7944] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 161.539143][ T7981] netlink: 'syz.2.532': attribute type 1 has an invalid length. [ 161.753686][ T7981] 8021q: adding VLAN 0 to HW filter on device bond2 [ 161.866973][ T7990] gretap1: entered promiscuous mode [ 162.219501][ T8009] netlink: 'syz.2.540': attribute type 9 has an invalid length. [ 162.599414][ T8036] delete_channel: no stack [ 162.721513][ T8033] delete_channel: no stack [ 163.228051][ T8052] __nla_validate_parse: 12 callbacks suppressed [ 163.228073][ T8052] netlink: 8 bytes leftover after parsing attributes in process `syz.2.547'. [ 163.268147][ T8053] netlink: 'syz.3.548': attribute type 7 has an invalid length. [ 163.313250][ T8053] netlink: 176 bytes leftover after parsing attributes in process `syz.3.548'. [ 163.351030][ T8057] netlink: 12 bytes leftover after parsing attributes in process `syz.4.550'. [ 163.497628][ T8057] geneve2: entered promiscuous mode [ 163.538965][ T8066] netlink: 14 bytes leftover after parsing attributes in process `syz.1.551'. [ 163.583240][ T5167] Bluetooth: hci4: command 0x0405 tx timeout [ 163.674051][ T55] block nbd0: Possible stuck request ffff888025290000: control (read@0,1024B). Runtime 60 seconds [ 163.685230][ T55] block nbd0: Possible stuck request ffff8880252901c0: control (read@1024,1024B). Runtime 60 seconds [ 163.696395][ T55] block nbd0: Possible stuck request ffff888025290380: control (read@2048,1024B). Runtime 60 seconds [ 163.708579][ T55] block nbd0: Possible stuck request ffff888025290540: control (read@3072,1024B). Runtime 60 seconds [ 163.777560][ T8066] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 163.815656][ T8066] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 163.840079][ T8066] bond0 (unregistering): Released all slaves [ 163.952091][ T7499] syz2: Port: 1 Link DOWN [ 164.241659][ T8054] lo speed is unknown, defaulting to 1000 [ 164.248684][ T8090] netlink: 'syz.4.556': attribute type 5 has an invalid length. [ 164.668420][ T8115] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 0, id = 0 [ 164.698156][ T8104] tipc: Enabled bearer , priority 0 [ 164.714166][ T8104] syzkaller0: entered promiscuous mode [ 164.732552][ T8104] syzkaller0: entered allmulticast mode [ 164.750382][ T8104] tipc: New replicast peer: 255.255.255.255 [ 164.774569][ T8104] tipc: Enabled bearer , priority 10 [ 164.835042][ T8104] netlink: 12 bytes leftover after parsing attributes in process `syz.0.561'. [ 164.857473][ T8106] pim6reg1: entered allmulticast mode [ 164.933830][ T8104] veth1: mtu less than device minimum [ 164.960214][ T8102] tipc: Resetting bearer [ 165.080061][ T8102] tipc: Disabling bearer [ 165.353837][ T8131] netlink: 8 bytes leftover after parsing attributes in process `syz.0.569'. [ 165.356357][ T8132] netlink: 'syz.4.570': attribute type 2 has an invalid length. [ 165.423533][ T8131] netlink: 15 bytes leftover after parsing attributes in process `syz.0.569'. [ 165.427411][ T8132] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 165.439733][ T8132] IPv6: NLM_F_CREATE should be set when creating new route [ 165.447012][ T8132] IPv6: NLM_F_CREATE should be set when creating new route [ 165.470647][ T8113] lo speed is unknown, defaulting to 1000 [ 165.507906][ T8136] netlink: 24 bytes leftover after parsing attributes in process `syz.3.572'. [ 165.701693][ T8141] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 101 [ 165.726064][ T8140] netlink: 24 bytes leftover after parsing attributes in process `syz.0.573'. [ 165.737661][ T8144] netlink: 'syz.3.575': attribute type 7 has an invalid length. [ 165.876875][ T8145] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.038024][ T8145] batman_adv: batadv0: Interface deactivated: macvlan2 [ 166.144148][ T8145] batman_adv: batadv0: Removing interface: macvlan2 [ 166.200851][ T8145] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.353016][ T8145] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.526870][ T8145] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.744970][ T8160] bond0: peer notification delay (5) is not a multiple of miimon (33271), value rounded to 0 ms [ 166.790851][ T8160] bond0: entered allmulticast mode [ 166.799482][ T8160] bond_slave_0: entered allmulticast mode [ 166.810855][ T8160] bond_slave_1: entered allmulticast mode [ 166.899414][ T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 166.936777][ T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 167.013300][ T8174] syz_tun: entered allmulticast mode [ 167.018848][ T8174] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 167.069547][ T8178] netlink: 24 bytes leftover after parsing attributes in process `syz.0.584'. [ 167.090389][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 167.123583][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 167.702221][ T8212] nbd: illegal input index 65508 [ 168.079890][ T8224] geneve3: entered promiscuous mode [ 168.336046][ T8167] lo speed is unknown, defaulting to 1000 [ 168.573079][ T8243] __nla_validate_parse: 2 callbacks suppressed [ 168.590977][ T8243] netlink: 100 bytes leftover after parsing attributes in process `syz.2.600'. [ 168.694046][ T8246] tipc: Enabled bearer , priority 0 [ 168.839357][ T8250] tipc: Disabling bearer [ 168.886350][ T8229] lo speed is unknown, defaulting to 1000 [ 169.059522][ T8255] netlink: 4 bytes leftover after parsing attributes in process `syz.0.604'. [ 169.531294][ T8271] xt_hashlimit: size too large, truncated to 1048576 [ 169.538626][ T8271] xt_hashlimit: overflow, try lower: 3/0 [ 169.681162][ T8274] netlink: 12 bytes leftover after parsing attributes in process `syz.3.611'. [ 169.948408][ T8287] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 169.973542][ T8287] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 169.986869][ T8288] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 169.998967][ T8288] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 170.460054][ T8302] openvswitch: netlink: Duplicate or invalid key (type 0). [ 170.483699][ T8302] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 170.661627][ T8304] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 170.794742][ T8311] sctp: [Deprecated]: syz.1.621 (pid 8311) Use of struct sctp_assoc_value in delayed_ack socket option. [ 170.794742][ T8311] Use struct sctp_sack_info instead [ 171.088179][ T8326] netlink: 8 bytes leftover after parsing attributes in process `syz.2.625'. [ 171.364418][ T8324] xt_CT: You must specify a L4 protocol and not use inversions on it [ 171.402325][ T8339] Cannot find del_set index 1 as target [ 171.410062][ T8342] IPVS: set_ctl: invalid protocol: 58 10.1.1.2:20003 [ 171.417960][ T8339] netlink: 8 bytes leftover after parsing attributes in process `syz.4.628'. [ 171.449422][ T8339] netlink: 8 bytes leftover after parsing attributes in process `syz.4.628'. [ 171.562449][ T8345] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 171.958168][ T8362] netlink: 28 bytes leftover after parsing attributes in process `syz.0.638'. [ 171.972616][ T8362] netlink: 28 bytes leftover after parsing attributes in process `syz.0.638'. [ 171.989938][ T8362] netlink: 'syz.0.638': attribute type 4 has an invalid length. [ 172.039515][ T8367] sctp: [Deprecated]: syz.1.639 (pid 8367) Use of struct sctp_assoc_value in delayed_ack socket option. [ 172.039515][ T8367] Use struct sctp_sack_info instead [ 172.070914][ T8373] ieee802154 phy0 wpan0: encryption failed: -22 [ 172.261122][ T8378] netlink: 'syz.3.643': attribute type 10 has an invalid length. [ 172.276237][ T8379] netlink: 'syz.3.643': attribute type 10 has an invalid length. [ 172.559747][ T8389] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 172.650844][ T8391] tipc: Enabled bearer , priority 0 [ 172.674811][ T8391] syzkaller0: entered promiscuous mode [ 172.680369][ T8391] syzkaller0: entered allmulticast mode [ 172.717416][ T8391] tipc: Resetting bearer [ 172.829115][ T8391] tipc: Resetting bearer [ 172.899857][ T8391] tipc: Disabling bearer [ 172.958782][ T8407] netlink: 4 bytes leftover after parsing attributes in process `syz.1.654'. [ 172.965020][ T8406] netlink: 11 bytes leftover after parsing attributes in process `syz.3.653'. [ 173.250635][ T8423] (unnamed net_device) (uninitialized): option arp_validate: invalid value (18446744073709551614) [ 173.291965][ T8425] syz_tun: entered allmulticast mode [ 173.297928][ T8421] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 173.428891][ T8419] syz_tun: left allmulticast mode [ 173.640208][ T8440] Cannot find add_set index 0 as target [ 174.333693][ T8467] syz2: rxe_newlink: already configured on bond_slave_1 [ 174.516774][ T8475] FAULT_INJECTION: forcing a failure. [ 174.516774][ T8475] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 174.539996][ T8471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.676'. [ 174.549427][ T8475] CPU: 1 UID: 0 PID: 8475 Comm: syz.3.677 Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 174.549467][ T8475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 174.549492][ T8475] Call Trace: [ 174.549501][ T8475] [ 174.549510][ T8475] dump_stack_lvl+0x189/0x250 [ 174.549558][ T8475] ? __pfx____ratelimit+0x10/0x10 [ 174.549587][ T8475] ? __pfx_dump_stack_lvl+0x10/0x10 [ 174.549612][ T8475] ? __pfx__printk+0x10/0x10 [ 174.549640][ T8475] ? __might_fault+0xb0/0x130 [ 174.549678][ T8475] should_fail_ex+0x414/0x560 [ 174.549715][ T8475] _copy_from_user+0x2d/0xb0 [ 174.549741][ T8475] __sys_bpf+0x1ed/0x860 [ 174.549765][ T8475] ? __pfx___sys_bpf+0x10/0x10 [ 174.549799][ T8475] ? ksys_write+0x22a/0x250 [ 174.549826][ T8475] ? __pfx_ksys_write+0x10/0x10 [ 174.549848][ T8475] ? rcu_is_watching+0x15/0xb0 [ 174.549881][ T8475] __x64_sys_bpf+0x7c/0x90 [ 174.549912][ T8475] do_syscall_64+0xfa/0x3b0 [ 174.549939][ T8475] ? lockdep_hardirqs_on+0x9c/0x150 [ 174.549983][ T8475] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.550004][ T8475] ? clear_bhb_loop+0x60/0xb0 [ 174.550030][ T8475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.550051][ T8475] RIP: 0033:0x7f8b2bd8e929 [ 174.550075][ T8475] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 174.550093][ T8475] RSP: 002b:00007f8b2cce4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 174.550119][ T8475] RAX: ffffffffffffffda RBX: 00007f8b2bfb5fa0 RCX: 00007f8b2bd8e929 [ 174.550134][ T8475] RDX: 0000000000000094 RSI: 0000200000000840 RDI: 0000000000000005 [ 174.550148][ T8475] RBP: 00007f8b2cce4090 R08: 0000000000000000 R09: 0000000000000000 [ 174.550160][ T8475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 174.550173][ T8475] R13: 0000000000000000 R14: 00007f8b2bfb5fa0 R15: 00007ffd1bff31f8 [ 174.550206][ T8475] [ 174.574998][ T8471] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.676'. [ 175.175525][ T8495] netlink: 4 bytes leftover after parsing attributes in process `syz.2.683'. [ 175.215988][ T8495] dummy0: entered promiscuous mode [ 175.241549][ T8495] macvtap1: entered promiscuous mode [ 175.277982][ T8495] macvtap1: entered allmulticast mode [ 175.304706][ T8495] dummy0: entered allmulticast mode [ 175.341407][ T8498] dummy0: left allmulticast mode [ 175.354137][ T8498] dummy0: left promiscuous mode [ 175.544422][ T8504] netlink: 2 bytes leftover after parsing attributes in process `syz.2.688'. [ 175.575195][ T8504] netlink: 44 bytes leftover after parsing attributes in process `syz.2.688'. [ 175.706403][ T8509] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 176.717248][ T30] audit: type=1800 audit(1752106210.304:5): pid=8518 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.690" name="memory.events" dev="tmpfs" ino=654 res=0 errno=0 [ 176.946936][ T8548] veth1_to_team: entered promiscuous mode [ 176.967135][ T8550] netlink: 20 bytes leftover after parsing attributes in process `syz.0.698'. [ 177.032495][ T8550] A link change request failed with some changes committed already. Interface veth1_to_batadv may have been left with an inconsistent configuration, please check. [ 177.322404][ T8560] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 177.715444][ T8563] team0 (unregistering): Port device team_slave_0 removed [ 177.746430][ T8563] team0 (unregistering): Port device team_slave_1 removed [ 178.028526][ T30] audit: type=1800 audit(1752106211.614:6): pid=8562 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.701" name="memory.events" dev="tmpfs" ino=803 res=0 errno=0 [ 178.580279][ T8597] netlink: 68 bytes leftover after parsing attributes in process `syz.3.712'. [ 178.678299][ T8593] netlink: 28 bytes leftover after parsing attributes in process `syz.0.711'. [ 178.991968][ T8616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.717'. [ 179.003993][ T8610] can: request_module (can-proto-4) failed. [ 179.005497][ T8611] can: request_module (can-proto-4) failed. [ 179.041528][ T8616] geneve2: entered promiscuous mode [ 179.060944][ T8616] geneve2: entered allmulticast mode [ 179.088624][ T6222] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 38410 - 0 [ 179.147375][ T6222] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 38410 - 0 [ 179.162437][ T6222] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 38410 - 0 [ 179.181990][ T6222] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 38410 - 0 [ 179.200619][ T8620] netlink: 12 bytes leftover after parsing attributes in process `syz.1.717'. [ 179.228998][ T8566] lo speed is unknown, defaulting to 1000 [ 179.540997][ T8596] lo speed is unknown, defaulting to 1000 [ 179.549279][ T8612] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 179.648552][ T8629] netlink: 20 bytes leftover after parsing attributes in process `syz.2.719'. [ 180.402567][ T8654] netlink: 'syz.3.726': attribute type 21 has an invalid length. [ 180.418516][ T8654] netlink: 132 bytes leftover after parsing attributes in process `syz.3.726'. [ 180.708529][ T8664] IPVS: set_ctl: invalid protocol: 98 224.0.0.2:20000 [ 180.965730][ T8675] netlink: 8 bytes leftover after parsing attributes in process `syz.4.734'. [ 180.990744][ T8675] netlink: 8 bytes leftover after parsing attributes in process `syz.4.734'. [ 181.159381][ T8682] netlink: 224 bytes leftover after parsing attributes in process `syz.4.738'. [ 181.247081][ T8686] x_tables: duplicate underflow at hook 1 [ 181.539793][ T8692] netlink: 72 bytes leftover after parsing attributes in process `syz.0.742'. [ 181.565864][ T8663] lo speed is unknown, defaulting to 1000 [ 181.572643][ T8667] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 181.914906][ T8707] netlink: 20 bytes leftover after parsing attributes in process `syz.3.745'. [ 182.429312][ T8720] bond_slave_0: entered promiscuous mode [ 182.435158][ T8720] bond_slave_1: entered promiscuous mode [ 182.450861][ T8720] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 182.459910][ T8720] bond_slave_0: left promiscuous mode [ 182.465481][ T8720] bond_slave_1: left promiscuous mode [ 182.648744][ T8731] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 182.682503][ T8733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.754'. [ 182.753928][ T8736] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 182.805444][ T8741] netlink: 4 bytes leftover after parsing attributes in process `syz.3.756'. [ 182.895497][ T8742] netlink: 'syz.3.756': attribute type 10 has an invalid length. [ 182.917543][ T8742] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 182.941122][ T8744] netlink: 8 bytes leftover after parsing attributes in process `syz.4.758'. [ 182.983904][ T8742] bond0: (slave wlan1): Enslaving as an active interface with a down link [ 183.000613][ T8744] netlink: 'syz.4.758': attribute type 5 has an invalid length. [ 183.214597][ T8741] team_slave_0: left promiscuous mode [ 183.256991][ T8741] team0 (unregistering): Port device team_slave_0 removed [ 183.284326][ T8741] team_slave_1: left promiscuous mode [ 183.304050][ T8741] team0 (unregistering): Port device team_slave_1 removed [ 183.467247][ T8764] bridge_slave_0: left allmulticast mode [ 183.491881][ T8764] bridge_slave_0: left promiscuous mode [ 183.542664][ T8764] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.571488][ T8764] bridge_slave_1: left allmulticast mode [ 183.580120][ T8764] bridge_slave_1: left promiscuous mode [ 183.595173][ T8764] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.622260][ T8764] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 183.632394][ T8764] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 183.650429][ T8764] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 183.658322][ T8764] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 183.687342][ T6214] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.699749][ T6214] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.714890][ T8789] xt_hashlimit: size too large, truncated to 1048576 [ 183.760413][ T8777] netlink: 'syz.2.765': attribute type 7 has an invalid length. [ 183.878310][ T8787] xfrm1: entered promiscuous mode [ 183.949489][ T8787] xfrm1: entered allmulticast mode [ 184.029467][ T6214] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 184.104827][ T6214] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 184.281536][ T8795] syzkaller0: entered allmulticast mode [ 184.878762][ T8816] Cannot find add_set index 2 as target [ 184.889654][ T8816] bridge0: port 2(bridge_slave_1) entered disabled state [ 184.899353][ T8816] bridge0: port 1(bridge_slave_0) entered disabled state [ 184.947164][ T8816] Cannot find add_set index 0 as target [ 184.957144][ T8816] netlink: 'syz.0.776': attribute type 2 has an invalid length. [ 185.068863][ T8790] lo speed is unknown, defaulting to 1000 [ 185.079868][ T8801] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 185.302208][ T8827] __nla_validate_parse: 5 callbacks suppressed [ 185.302228][ T8827] netlink: 44 bytes leftover after parsing attributes in process `syz.0.780'. [ 185.510474][ T8835] netlink: 104 bytes leftover after parsing attributes in process `syz.2.783'. [ 185.525176][ T8835] netlink: 104 bytes leftover after parsing attributes in process `syz.2.783'. [ 185.536284][ T8835] netlink: 81 bytes leftover after parsing attributes in process `syz.2.783'. [ 185.916120][ T8845] syz2: rxe_newlink: already configured on bond_slave_1 [ 186.030262][ T8850] netlink: 'syz.4.789': attribute type 1 has an invalid length. [ 186.724065][ T8883] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 186.988727][ T8909] netlink: 120 bytes leftover after parsing attributes in process `syz.1.803'. [ 187.019585][ T8909] netlink: 4 bytes leftover after parsing attributes in process `syz.1.803'. [ 187.234655][ T8914] netlink: 8 bytes leftover after parsing attributes in process `syz.0.807'. [ 187.267907][ T8914] netlink: 8 bytes leftover after parsing attributes in process `syz.0.807'. [ 187.475579][ T8925] netlink: 56 bytes leftover after parsing attributes in process `syz.0.812'. [ 187.485950][ T8925] netlink: 8 bytes leftover after parsing attributes in process `syz.0.812'. [ 187.609851][ T8931] syz2: rxe_newlink: already configured on bond_slave_1 [ 188.716394][ T8984] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 188.792782][ T8993] netlink: 'syz.3.831': attribute type 14 has an invalid length. [ 189.305553][ T9016] netlink: 'syz.3.838': attribute type 9 has an invalid length. [ 189.598296][ T9023] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 189.765608][ T9035] netlink: 'syz.4.845': attribute type 1 has an invalid length. [ 190.367466][ T9056] bond1: entered promiscuous mode [ 190.376181][ T9056] bond1: entered allmulticast mode [ 190.382329][ T9056] 8021q: adding VLAN 0 to HW filter on device bond1 [ 190.500052][ T9045] lo speed is unknown, defaulting to 1000 [ 190.514332][ T9037] infiniband syz!: set active [ 190.519241][ T9037] infiniband syz!: added team_slave_0 [ 190.628488][ T9037] RDS/IB: syz!: added [ 190.647048][ T9037] smc: adding ib device syz! with port count 1 [ 190.653900][ T9037] smc: ib device syz! port 1 has pnetid [ 190.717345][ T9066] netlink: 'syz.3.854': attribute type 1 has an invalid length. [ 190.718630][ T9067] __nla_validate_parse: 6 callbacks suppressed [ 190.718650][ T9067] netlink: 28 bytes leftover after parsing attributes in process `syz.3.854'. [ 190.753829][ T9065] netlink: 28 bytes leftover after parsing attributes in process `syz.3.854'. [ 190.822245][ T9066] 8021q: adding VLAN 0 to HW filter on device bond2 [ 191.142470][ T9080] netlink: 72 bytes leftover after parsing attributes in process `syz.3.858'. [ 191.336687][ T9086] netlink: 8 bytes leftover after parsing attributes in process `syz.4.859'. [ 191.502782][ T9093] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.861'. [ 192.002276][ T9108] netlink: 96 bytes leftover after parsing attributes in process `syz.4.866'. [ 192.029704][ T9108] netlink: 8 bytes leftover after parsing attributes in process `syz.4.866'. [ 192.670268][ T9132] netlink: 68 bytes leftover after parsing attributes in process `syz.1.874'. [ 192.986535][ T9149] netlink: 'syz.1.879': attribute type 1 has an invalid length. [ 193.747267][ T55] block nbd0: Possible stuck request ffff888025290000: control (read@0,1024B). Runtime 90 seconds [ 193.758292][ T55] block nbd0: Possible stuck request ffff8880252901c0: control (read@1024,1024B). Runtime 90 seconds [ 193.769294][ T55] block nbd0: Possible stuck request ffff888025290380: control (read@2048,1024B). Runtime 90 seconds [ 193.780405][ T55] block nbd0: Possible stuck request ffff888025290540: control (read@3072,1024B). Runtime 90 seconds [ 194.091354][ T9187] netlink: 'syz.4.889': attribute type 32 has an invalid length. [ 194.122378][ T9187] netlink: 8 bytes leftover after parsing attributes in process `syz.4.889'. [ 194.132388][ T9187] (unnamed net_device) (uninitialized): Setting coupled_control to off (0) [ 194.284904][ T9071] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 194.379328][ T9194] macvtap0: entered promiscuous mode [ 194.404150][ T9194] macvtap0: entered allmulticast mode [ 194.409683][ T9194] veth0_macvtap: entered allmulticast mode [ 195.364135][ T9232] netlink: 'syz.2.903': attribute type 5 has an invalid length. [ 195.407897][ T9232] ip6erspan0: entered allmulticast mode [ 195.442887][ T9235] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 195.469955][ T9237] netlink: 96 bytes leftover after parsing attributes in process `syz.3.905'. [ 196.287138][ T9269] can: request_module (can-proto-0) failed. [ 196.728088][ T9266] lo speed is unknown, defaulting to 1000 [ 197.269090][ T9281] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 197.422928][ T9307] __nla_validate_parse: 1 callbacks suppressed [ 197.422961][ T9307] netlink: 72 bytes leftover after parsing attributes in process `syz.2.924'. [ 197.459252][ T9307] netlink: 8 bytes leftover after parsing attributes in process `syz.2.924'. [ 197.473582][ T9310] netlink: 8 bytes leftover after parsing attributes in process `syz.2.924'. [ 197.581603][ T9310] netlink: 48 bytes leftover after parsing attributes in process `syz.2.924'. [ 198.546369][ T9328] netlink: 40 bytes leftover after parsing attributes in process `syz.3.932'. [ 199.070174][ T9330] lo speed is unknown, defaulting to 1000 [ 199.413527][ T750] bridge_slave_1: left allmulticast mode [ 199.427150][ T750] bridge_slave_1: left promiscuous mode [ 199.441930][ T750] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.452781][ T750] bridge_slave_0: left allmulticast mode [ 199.458726][ T750] bridge_slave_0: left promiscuous mode [ 199.465361][ T750] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.513461][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.519980][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.597705][ T9340] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 199.815629][ T9346] netlink: 40 bytes leftover after parsing attributes in process `syz.2.938'. [ 199.843849][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 199.853911][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 199.867023][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 199.877210][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 199.905375][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 200.231959][ T750] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 200.241268][ T750] bond_slave_0: left allmulticast mode [ 200.248233][ T750] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 200.257635][ T750] bond_slave_1: left allmulticast mode [ 200.264684][ T750] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 200.274140][ T750] mac80211_hwsim hwsim9 wlan1: left allmulticast mode [ 200.290867][ T750] bond0 (unregistering): Released all slaves [ 200.378900][ T750] bond1 (unregistering): Released all slaves [ 200.464193][ T750] bond2 (unregistering): Released all slaves [ 200.490452][ T9355] C: renamed from lo [ 200.499347][ T9355] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 200.835121][ T9361] netlink: 24 bytes leftover after parsing attributes in process `syz.0.941'. [ 200.845077][ T750] tipc: Left network mode [ 201.355334][ T9349] lo speed is unknown, defaulting to 1000 [ 201.983431][ T5167] Bluetooth: hci3: command tx timeout [ 202.598737][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 202.608830][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 202.617134][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 202.627855][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 202.643626][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 203.019155][ T9393] netlink: 8 bytes leftover after parsing attributes in process `syz.0.946'. [ 203.051806][ T9401] syz2: rxe_newlink: already configured on bond_slave_1 [ 203.481025][ T750] hsr_slave_0: left promiscuous mode [ 203.499486][ T750] hsr_slave_1: left promiscuous mode [ 203.534191][ T750] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 203.544254][ T750] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 204.064778][ T51] Bluetooth: hci3: command tx timeout [ 204.262486][ T9428] netlink: 8 bytes leftover after parsing attributes in process `syz.1.951'. [ 204.272485][ T9428] netlink: 4 bytes leftover after parsing attributes in process `syz.1.951'. [ 204.274282][ T9349] chnl_net:caif_netlink_parms(): no params data found [ 204.351188][ T9392] lo speed is unknown, defaulting to 1000 [ 204.703439][ T51] Bluetooth: hci4: command tx timeout [ 205.252908][ T9349] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.280336][ T9349] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.292119][ T9349] bridge_slave_0: entered allmulticast mode [ 205.318501][ T9349] bridge_slave_0: entered promiscuous mode [ 205.340501][ T9454] veth0: entered promiscuous mode [ 205.362957][ T9349] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.381547][ T9349] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.396770][ T9349] bridge_slave_1: entered allmulticast mode [ 205.415446][ T9349] bridge_slave_1: entered promiscuous mode [ 205.425837][ T9462] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 205.505526][ T9455] veth0: left promiscuous mode [ 205.648126][ T9349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 205.726821][ T9349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 205.867735][ T9481] netlink: 'syz.4.961': attribute type 7 has an invalid length. [ 205.943769][ T9486] netlink: 8 bytes leftover after parsing attributes in process `syz.4.961'. [ 205.980881][ T12] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.043003][ T9349] team0: Port device team_slave_0 added [ 206.094401][ T9489] netlink: 'syz.4.961': attribute type 3 has an invalid length. [ 206.112383][ T9349] team0: Port device team_slave_1 added [ 206.145011][ T5167] Bluetooth: hci3: command tx timeout [ 206.190368][ T12] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.473898][ T12] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.488589][ T9506] netlink: 16 bytes leftover after parsing attributes in process `syz.1.964'. [ 206.523060][ T9349] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 206.561250][ T9349] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 206.628476][ T9349] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 206.682003][ T9349] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 206.702982][ T9349] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 206.765551][ T9349] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 206.783475][ T5167] Bluetooth: hci4: command tx timeout [ 206.807499][ T12] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.934155][ T9517] IPVS: set_ctl: invalid protocol: 135 224.0.0.1:20003 [ 206.984932][ T9519] Bluetooth: MGMT ver 1.23 [ 207.218456][ T9349] hsr_slave_0: entered promiscuous mode [ 207.240146][ T9349] hsr_slave_1: entered promiscuous mode [ 207.246686][ T9532] netlink: 8 bytes leftover after parsing attributes in process `syz.0.972'. [ 207.259694][ T9349] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 207.267643][ T9532] netlink: 84 bytes leftover after parsing attributes in process `syz.0.972'. [ 207.280536][ T9349] Cannot create hsr debugfs directory [ 207.288865][ T9392] chnl_net:caif_netlink_parms(): no params data found [ 207.301581][ T9532] netlink: 'syz.0.972': attribute type 10 has an invalid length. [ 207.319784][ T9532] netlink: 'syz.0.972': attribute type 49 has an invalid length. [ 207.680233][ T9542] ip6gretap0: entered promiscuous mode [ 207.689421][ T9542] ip6gretap0: left promiscuous mode [ 208.223819][ T5167] Bluetooth: hci3: command tx timeout [ 208.864178][ T5167] Bluetooth: hci4: command 0x040f tx timeout [ 208.966276][ T9575] IPVS: set_ctl: invalid protocol: 137 172.30.0.2:20001 [ 209.201709][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 209.213015][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 209.223649][ T12] bond0 (unregistering): Released all slaves [ 209.238225][ T12] bond1 (unregistering): Released all slaves [ 209.330060][ T12] bond2 (unregistering): Released all slaves [ 209.360451][ T9392] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.368977][ T9392] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.379306][ T9392] bridge_slave_0: entered allmulticast mode [ 209.388747][ T9392] bridge_slave_0: entered promiscuous mode [ 209.431410][ T9580] netlink: 12 bytes leftover after parsing attributes in process `syz.0.982'. [ 209.505382][ T9392] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.534918][ T9392] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.542197][ T9392] bridge_slave_1: entered allmulticast mode [ 209.566029][ T9392] bridge_slave_1: entered promiscuous mode [ 209.578581][ T12] tipc: Left network mode [ 209.629293][ T9585] netlink: 16 bytes leftover after parsing attributes in process `syz.1.983'. [ 209.852223][ T9392] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 210.039051][ T9392] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 210.764698][ T9392] team0: Port device team_slave_0 added [ 210.770800][ T9599] @ÿ: renamed from bond_slave_0 (while UP) [ 210.822125][ T9392] team0: Port device team_slave_1 added [ 210.944474][ T5856] Bluetooth: hci4: command 0x040f tx timeout [ 211.271701][ T9630] wg1 speed is unknown, defaulting to 1000 [ 211.345587][ T12] hsr_slave_0: left promiscuous mode [ 211.360650][ T12] hsr_slave_1: left promiscuous mode [ 211.373306][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 211.392640][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 211.427868][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 211.449062][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 211.479066][ T12] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 211.486893][ T12] batman_adv: batadv0: Removing interface: virt_wifi0 [ 211.519797][ T12] veth1_macvtap: left promiscuous mode [ 211.526830][ T12] veth0_macvtap: left promiscuous mode [ 211.532534][ T12] veth1_vlan: left promiscuous mode [ 211.542722][ T12] veth0_vlan: left promiscuous mode [ 211.826271][ T5856] Bluetooth: hci1: command 0x0406 tx timeout [ 211.826300][ T5858] Bluetooth: hci2: command 0x0406 tx timeout [ 212.288944][ T12] team0 (unregistering): Port device team_slave_1 removed [ 212.340649][ T12] team0 (unregistering): Port device team_slave_0 removed [ 212.359068][ T6228] smc: removing ib device syz! [ 212.716363][ T9392] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 212.724579][ T9392] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 212.751110][ T9392] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 212.762292][ T9630] wg1 speed is unknown, defaulting to 1000 [ 212.764165][ T9392] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 212.775183][ T9392] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 212.801325][ T9392] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 212.866127][ T9630] wg1 speed is unknown, defaulting to 1000 [ 213.023716][ T51] Bluetooth: hci4: command 0x040f tx timeout [ 213.357614][ T9392] hsr_slave_0: entered promiscuous mode [ 213.401176][ T9392] hsr_slave_1: entered promiscuous mode [ 213.417356][ T9392] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 213.444109][ T9392] Cannot create hsr debugfs directory [ 213.951857][ T9630] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 214.077579][ T9349] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 214.114920][ T9349] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 214.234666][ T9630] wg1 speed is unknown, defaulting to 1000 [ 214.237978][ T9349] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 214.276722][ T9349] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 214.437541][ T9630] wg1 speed is unknown, defaulting to 1000 [ 214.541557][ T9630] wg1 speed is unknown, defaulting to 1000 [ 214.691946][ T9680] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1001'. [ 214.702411][ T9680] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1001'. [ 214.716963][ T9680] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1001'. [ 214.726476][ T9680] nbd: socks must be embedded in a SOCK_ITEM attr [ 214.753216][ T9630] wg1 speed is unknown, defaulting to 1000 [ 214.762416][ T9630] wg1 speed is unknown, defaulting to 1000 [ 214.809694][ T9630] wg1 speed is unknown, defaulting to 1000 [ 215.244311][ T9688] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1004'. [ 215.261504][ T9349] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.367179][ T9349] 8021q: adding VLAN 0 to HW filter on device team0 [ 215.410751][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.417985][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 215.523518][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.530735][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.813517][ T9392] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 215.874310][ T9392] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 215.898274][ T9392] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 215.924742][ T9392] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 216.115207][ T9709] syzkaller0: entered promiscuous mode [ 216.120737][ T9709] syzkaller0: entered allmulticast mode [ 216.152837][ T9718] netlink: 'syz.0.1009': attribute type 2 has an invalid length. [ 216.161431][ T9718] netlink: 'syz.0.1009': attribute type 1 has an invalid length. [ 216.172476][ T9718] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1009'. [ 217.072053][ T9737] IPv6: addrconf: prefix option has invalid lifetime [ 217.087272][ T9737] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1011'. [ 218.418101][ T9747] netlink: 'syz.4.1013': attribute type 15 has an invalid length. [ 218.445912][ T9747] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1013'. [ 218.468174][ T9392] 8021q: adding VLAN 0 to HW filter on device bond0 [ 218.505111][ T9747] bond0: option resend_igmp: invalid value (196616) [ 218.514238][ T9747] bond0: option resend_igmp: allowed values 0 - 255 [ 218.799837][ T9392] 8021q: adding VLAN 0 to HW filter on device team0 [ 218.855809][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.863063][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 218.922571][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.929876][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 218.970236][ T9724] wg1 speed is unknown, defaulting to 1000 [ 218.990217][ T9349] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 219.411527][ T9349] veth0_vlan: entered promiscuous mode [ 219.457768][ T9349] veth1_vlan: entered promiscuous mode [ 219.533732][ T9750] wg1 speed is unknown, defaulting to 1000 [ 219.637755][ T9780] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1018'. [ 219.716047][ T9780] vlan0: entered promiscuous mode [ 219.737146][ T9780] dummy0: entered promiscuous mode [ 219.927810][ T9349] veth0_macvtap: entered promiscuous mode [ 219.971071][ T9349] veth1_macvtap: entered promiscuous mode [ 220.152378][ T9349] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.189615][ T9349] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 220.205422][ T9392] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.235956][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.266862][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.331258][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.356260][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.585614][ T9392] veth0_vlan: entered promiscuous mode [ 220.699344][ T6214] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 220.726902][ T6214] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 220.770106][ T9392] veth1_vlan: entered promiscuous mode [ 220.918137][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 220.942543][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 220.947563][ T9392] veth0_macvtap: entered promiscuous mode [ 220.982603][ T9392] veth1_macvtap: entered promiscuous mode [ 221.072917][ T9392] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 221.092867][ T9803] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1021'. [ 221.116779][ T9392] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 221.177167][ T6228] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.207881][ T9812] netlink: 'syz.0.1022': attribute type 12 has an invalid length. [ 221.228456][ T6228] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.257574][ T6228] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.278692][ T6228] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.286100][ T9814] netlink: 'syz.1.1023': attribute type 10 has an invalid length. [ 221.692990][ T37] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 221.720853][ T9824] netlink: 'syz.0.1025': attribute type 2 has an invalid length. [ 221.845799][ T9824] þ`Ì: entered promiscuous mode [ 222.033522][ T37] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.205172][ T37] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.363964][ T6228] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.413408][ T6228] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.569571][ T37] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.680104][ T9848] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1027'. [ 222.722488][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.757902][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 223.063992][ T5858] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 223.079467][ T5858] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 223.088497][ T5858] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 223.115375][ T5858] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 223.125798][ T5858] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 223.195084][ T37] bridge_slave_1: left allmulticast mode [ 223.239683][ T30] audit: type=1800 audit(1752106256.804:7): pid=9855 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1030" name="@" dev="tmpfs" ino=1230 res=0 errno=0 [ 223.265942][ T37] bridge_slave_1: left promiscuous mode [ 223.278441][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.287964][ T30] audit: type=1804 audit(1752106256.804:8): pid=9855 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1030" name="/newroot/237/@" dev="tmpfs" ino=1230 res=1 errno=0 [ 223.350475][ T37] bridge_slave_0: left allmulticast mode [ 223.370627][ T37] bridge_slave_0: left promiscuous mode [ 223.404228][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.448820][ T9869] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.1031'. [ 223.464243][ T9869] netlink: 'syz.0.1031': attribute type 9 has an invalid length. [ 223.829451][ T55] block nbd0: Possible stuck request ffff888025290000: control (read@0,1024B). Runtime 120 seconds [ 223.844595][ T55] block nbd0: Possible stuck request ffff8880252901c0: control (read@1024,1024B). Runtime 120 seconds [ 223.856030][ T55] block nbd0: Possible stuck request ffff888025290380: control (read@2048,1024B). Runtime 120 seconds [ 223.867348][ T55] block nbd0: Possible stuck request ffff888025290540: control (read@3072,1024B). Runtime 120 seconds [ 223.962416][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 223.986396][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 224.000634][ T37] bond0 (unregistering): Released all slaves [ 224.901372][ T9841] wg1 speed is unknown, defaulting to 1000 [ 225.146816][ T13] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.179908][ T13] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.190132][ T5858] Bluetooth: hci3: command tx timeout [ 225.209477][ T13] netdevsim netdevsim1 eth0: unset [1, 1] type 2 family 0 port 38410 - 0 [ 225.228397][ T13] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.256199][ T13] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.268280][ T13] netdevsim netdevsim1 eth1: unset [1, 1] type 2 family 0 port 38410 - 0 [ 225.293875][ T9907] xt_hashlimit: size too large, truncated to 1048576 [ 225.309482][ T9905] xfrm1: entered promiscuous mode [ 225.415480][ T9905] xfrm1: entered allmulticast mode [ 225.626422][ T13] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.659914][ T13] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.709458][ T13] netdevsim netdevsim1 eth2: unset [1, 1] type 2 family 0 port 38410 - 0 [ 225.742456][ T13] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.766565][ T13] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.807278][ T13] netdevsim netdevsim1 eth3: unset [1, 1] type 2 family 0 port 38410 - 0 [ 226.117747][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 226.126594][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 226.136481][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 226.157652][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 226.168554][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 226.420150][ T9921] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1034'. [ 226.501771][ T9906] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1032'. [ 226.554199][ T9923] SET target dimension over the limit! [ 226.761852][ T9933] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1036'. [ 226.951843][ T9859] wg1 speed is unknown, defaulting to 1000 [ 227.074089][ T9941] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1037'. [ 227.263532][ T5858] Bluetooth: hci3: command tx timeout [ 227.280309][ T9950] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1038'. [ 227.528696][ T9859] chnl_net:caif_netlink_parms(): no params data found [ 227.574145][ T9916] wg1 speed is unknown, defaulting to 1000 [ 227.593223][ T9959] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1039'. [ 227.635398][ T9901] wg1 speed is unknown, defaulting to 1000 [ 228.237606][ T5858] Bluetooth: hci4: command tx timeout [ 228.281301][ T37] hsr_slave_0: left promiscuous mode [ 228.298169][ T37] hsr_slave_1: left promiscuous mode [ 228.312869][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 228.328750][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 228.337429][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 228.345728][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 228.381352][ T37] veth1_macvtap: left promiscuous mode [ 228.387043][ T37] veth0_macvtap: left promiscuous mode [ 228.392755][ T37] veth1_vlan: left promiscuous mode [ 228.398240][ T37] veth0_vlan: left promiscuous mode [ 228.847050][ T37] team0 (unregistering): Port device team_slave_1 removed [ 228.883833][ T9982] netlink: 'syz.0.1041': attribute type 30 has an invalid length. [ 228.899295][ T37] team0 (unregistering): Port device team_slave_0 removed [ 229.330146][ T9859] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.346240][ T5858] Bluetooth: hci3: command tx timeout [ 229.355581][ T9859] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.362779][ T9859] bridge_slave_0: entered allmulticast mode [ 229.371486][ T9859] bridge_slave_0: entered promiscuous mode [ 229.451146][ T9859] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.482221][ T9859] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.490131][ T9988] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1042'. [ 229.509189][ T9859] bridge_slave_1: entered allmulticast mode [ 229.539784][ T9859] bridge_slave_1: entered promiscuous mode [ 229.767564][ T9859] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 229.809308][ T9859] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 230.069389][ T9859] team0: Port device team_slave_0 added [ 230.102688][ T9859] team0: Port device team_slave_1 added [ 230.208087][ T9916] chnl_net:caif_netlink_parms(): no params data found [ 230.318705][ T5858] Bluetooth: hci4: command tx timeout [ 230.380876][ T37] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.688752][ T37] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.728184][ T9859] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 230.739060][ T9859] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 230.798171][ T9859] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 230.928732][ T37] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.979387][ T9859] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 231.015918][ T9859] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 231.080465][ T9859] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 231.245609][T10047] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 231.265987][ T37] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.423277][ T5858] Bluetooth: hci3: command tx timeout [ 231.650738][ T9859] hsr_slave_0: entered promiscuous mode [ 231.671487][ T9859] hsr_slave_1: entered promiscuous mode [ 231.679884][ T9859] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 231.692194][ T9859] Cannot create hsr debugfs directory [ 231.742642][ T9916] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.750099][ T9916] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.759072][ T9916] bridge_slave_0: entered allmulticast mode [ 231.767450][ T9916] bridge_slave_0: entered promiscuous mode [ 231.811893][T10058] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1054'. [ 231.821741][ T9916] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.833417][ T9916] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.840678][ T9916] bridge_slave_1: entered allmulticast mode [ 231.849015][ T9916] bridge_slave_1: entered promiscuous mode [ 231.960659][ T9916] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 232.010020][ T9916] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 232.171581][ T9916] team0: Port device team_slave_0 added [ 232.215658][ T9916] team0: Port device team_slave_1 added [ 232.401159][ T5858] Bluetooth: hci4: command tx timeout [ 232.424459][T10079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1057'. [ 232.451268][ T9916] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 232.459265][ T9916] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 232.490223][ T9916] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 232.507021][ T37] bridge_slave_1: left allmulticast mode [ 232.524802][ T37] bridge_slave_1: left promiscuous mode [ 232.537904][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.564049][ T37] bridge_slave_0: left allmulticast mode [ 232.570949][ T37] bridge_slave_0: left promiscuous mode [ 232.579992][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.968869][T10093] netlink: 'syz.0.1059': attribute type 3 has an invalid length. [ 232.987858][T10093] netlink: 'syz.0.1059': attribute type 1 has an invalid length. [ 233.008900][T10093] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.1059'. [ 233.195299][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 233.209011][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 233.220924][ T37] bond0 (unregistering): Released all slaves [ 233.274214][ T9916] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 233.281190][ T9916] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 233.315340][ T9916] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 233.624862][ T9916] hsr_slave_0: entered promiscuous mode [ 233.649127][ T9916] hsr_slave_1: entered promiscuous mode [ 233.671232][ T9916] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 233.697711][ T9916] Cannot create hsr debugfs directory [ 233.724099][T10113] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 234.466468][ T5858] Bluetooth: hci4: command tx timeout [ 234.683604][T10138] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1066'. [ 234.742092][ T37] hsr_slave_0: left promiscuous mode [ 234.755065][ T37] hsr_slave_1: left promiscuous mode [ 234.774490][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 234.807900][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 234.917748][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 234.942576][T10138] netlink: 'syz.1.1066': attribute type 1 has an invalid length. [ 234.949414][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 235.040314][ T37] veth1_macvtap: left promiscuous mode [ 235.063364][ T37] veth0_macvtap: left promiscuous mode [ 235.083376][ T37] veth1_vlan: left promiscuous mode [ 235.088762][ T37] veth0_vlan: left promiscuous mode [ 235.530086][ T37] team0 (unregistering): Port device team_slave_1 removed [ 235.567423][ T37] team0 (unregistering): Port device team_slave_0 removed [ 236.207509][T10160] tun0: tun_chr_ioctl cmd 2147767521 [ 236.538347][T10170] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1076'. [ 236.564624][T10176] netlink: 'syz.0.1077': attribute type 1 has an invalid length. [ 237.098817][ T9859] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 237.148973][ T9859] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 237.171986][ T9859] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 237.216845][ T9859] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 237.224580][T10202] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1082'. [ 237.594783][ T9916] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 237.668016][ T9916] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 237.781168][ T9916] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 237.967344][ T9916] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 238.339736][ T9859] 8021q: adding VLAN 0 to HW filter on device bond0 [ 238.425568][T10211] wg1 speed is unknown, defaulting to 1000 [ 238.447253][ T9859] 8021q: adding VLAN 0 to HW filter on device team0 [ 238.580852][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.588089][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 238.630414][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.637690][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 238.772082][ T9916] 8021q: adding VLAN 0 to HW filter on device bond0 [ 238.959092][ T9916] 8021q: adding VLAN 0 to HW filter on device team0 [ 239.019868][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.027098][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 239.102324][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.109577][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 240.100420][ T9859] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 240.262284][ T9859] veth0_vlan: entered promiscuous mode [ 240.363624][ T9859] veth1_vlan: entered promiscuous mode [ 240.372627][ T9916] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 240.559014][ T9859] veth0_macvtap: entered promiscuous mode [ 240.639492][ T9859] veth1_macvtap: entered promiscuous mode [ 240.695180][ T9916] veth0_vlan: entered promiscuous mode [ 240.765426][ T9859] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 240.812285][T10240] netlink: 'syz.4.1087': attribute type 21 has an invalid length. [ 240.825861][ T9916] veth1_vlan: entered promiscuous mode [ 240.862354][ T9859] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 240.885696][T10243] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1088'. [ 240.920862][ T37] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.942017][ T37] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.984575][ T37] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.000064][ T37] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.107304][ T9916] veth0_macvtap: entered promiscuous mode [ 241.121877][T10249] netlink: 'syz.0.1090': attribute type 11 has an invalid length. [ 241.151191][ T9916] veth1_macvtap: entered promiscuous mode [ 241.167232][T10247] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 241.261944][T10247] netlink: 'syz.4.1089': attribute type 4 has an invalid length. [ 241.297508][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 241.343122][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 241.482885][T10247] bridge0: port 3(team0) entered disabled state [ 241.489790][T10247] bridge0: port 2(bridge_slave_1) entered disabled state [ 241.498541][T10247] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.121677][T10247] veth0_macvtap: left allmulticast mode [ 242.184854][ T24] wg1 speed is unknown, defaulting to 1000 [ 242.190725][ T24] syz0: Port: 1 Link DOWN [ 242.200520][ T750] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 242.233460][ T750] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.254611][ T9916] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 242.302473][ T9916] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 242.318781][T10268] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 242.329258][ T750] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 242.344489][ T750] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.363361][ T750] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 242.380650][ T750] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.392610][ T6231] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 242.425839][ T750] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 242.443162][ T6231] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 242.444379][ T750] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.475702][ T6214] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.529818][ T6214] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.555488][ T6214] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.578207][ T6214] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.615098][T10274] FAULT_INJECTION: forcing a failure. [ 242.615098][T10274] name failslab, interval 1, probability 0, space 0, times 1 [ 242.632045][T10272] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 242.647022][T10274] CPU: 1 UID: 0 PID: 10274 Comm: syz.0.1100 Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 242.647053][T10274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 242.647066][T10274] Call Trace: [ 242.647075][T10274] [ 242.647085][T10274] dump_stack_lvl+0x189/0x250 [ 242.647117][T10274] ? __pfx____ratelimit+0x10/0x10 [ 242.647146][T10274] ? __pfx_dump_stack_lvl+0x10/0x10 [ 242.647191][T10274] ? __pfx__printk+0x10/0x10 [ 242.647228][T10274] ? __pfx___might_resched+0x10/0x10 [ 242.647253][T10274] ? fs_reclaim_acquire+0x7d/0x100 [ 242.647291][T10274] should_fail_ex+0x414/0x560 [ 242.647330][T10274] should_failslab+0xa8/0x100 [ 242.647362][T10274] __kmalloc_noprof+0xcb/0x4f0 [ 242.647387][T10274] ? kfree+0x4d/0x440 [ 242.647408][T10274] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 242.647438][T10274] tomoyo_realpath_from_path+0xe3/0x5d0 [ 242.647471][T10274] ? tomoyo_domain+0xd9/0x130 [ 242.647500][T10274] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 242.647531][T10274] tomoyo_path_number_perm+0x1e8/0x5a0 [ 242.647567][T10274] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 242.647602][T10274] ? sb_end_write+0xe9/0x1c0 [ 242.647635][T10274] ? vfs_write+0x8d8/0xa90 [ 242.647704][T10274] ? ksys_write+0x1e1/0x250 [ 242.647744][T10274] security_file_ioctl+0xcb/0x2d0 [ 242.647776][T10274] __se_sys_ioctl+0x47/0x170 [ 242.647805][T10274] do_syscall_64+0xfa/0x3b0 [ 242.647834][T10274] ? lockdep_hardirqs_on+0x9c/0x150 [ 242.647862][T10274] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.647884][T10274] ? clear_bhb_loop+0x60/0xb0 [ 242.647912][T10274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.647933][T10274] RIP: 0033:0x7fd07dd8e929 [ 242.647953][T10274] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 242.647973][T10274] RSP: 002b:00007fd07eba1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 242.647996][T10274] RAX: ffffffffffffffda RBX: 00007fd07dfb5fa0 RCX: 00007fd07dd8e929 [ 242.648012][T10274] RDX: 0000200000002800 RSI: 0000000000008982 RDI: 000000000000000d [ 242.648026][T10274] RBP: 00007fd07eba1090 R08: 0000000000000000 R09: 0000000000000000 [ 242.648040][T10274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 242.648053][T10274] R13: 0000000000000000 R14: 00007fd07dfb5fa0 R15: 00007fff8cfbf568 [ 242.648088][T10274] [ 242.648163][T10274] ERROR: Out of memory at tomoyo_realpath_from_path. [ 242.947941][T10276] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1101'. [ 243.116443][ T6231] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 243.144783][ T6231] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 243.188928][T10284] ieee802154 phy0 wpan0: encryption failed: -22 [ 243.234765][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.366427][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.402815][ T750] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 243.423985][ T750] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 243.495344][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.817254][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.214311][ T13] bridge_slave_1: left allmulticast mode [ 244.220015][ T13] bridge_slave_1: left promiscuous mode [ 244.238122][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.304224][ T13] bridge_slave_0: left allmulticast mode [ 244.333316][ T13] bridge_slave_0: left promiscuous mode [ 244.339156][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.359056][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 244.367932][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 244.377809][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 244.387269][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 244.399163][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 244.728386][T10324] syz2: rxe_newlink: already configured on bond_slave_1 [ 244.944630][T10320] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1111'. [ 245.105950][ T5858] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 245.118262][ T5858] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 245.127278][ T5858] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 245.145316][ T5858] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 245.153312][ T5858] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 245.285498][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 245.308098][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 245.328134][ T13] bond0 (unregistering): Released all slaves [ 245.392318][ T30] audit: type=1800 audit(1752106278.974:9): pid=10325 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1111" name="cgroup.controllers" dev="tmpfs" ino=1440 res=0 errno=0 [ 245.783361][T10332] FAULT_INJECTION: forcing a failure. [ 245.783361][T10332] name failslab, interval 1, probability 0, space 0, times 0 [ 245.801412][T10332] CPU: 1 UID: 0 PID: 10332 Comm: syz.1.1114 Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 245.801444][T10332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 245.801467][T10332] Call Trace: [ 245.801476][T10332] [ 245.801485][T10332] dump_stack_lvl+0x189/0x250 [ 245.801522][T10332] ? __pfx____ratelimit+0x10/0x10 [ 245.801551][T10332] ? __pfx_dump_stack_lvl+0x10/0x10 [ 245.801577][T10332] ? __pfx__printk+0x10/0x10 [ 245.801610][T10332] ? __pfx___might_resched+0x10/0x10 [ 245.801636][T10332] ? fs_reclaim_acquire+0x7d/0x100 [ 245.801673][T10332] should_fail_ex+0x414/0x560 [ 245.801710][T10332] should_failslab+0xa8/0x100 [ 245.801742][T10332] __kmalloc_noprof+0xcb/0x4f0 [ 245.801768][T10332] ? tomoyo_encode+0x28b/0x550 [ 245.801795][T10332] tomoyo_encode+0x28b/0x550 [ 245.801823][T10332] tomoyo_realpath_from_path+0x58d/0x5d0 [ 245.801848][T10332] ? tomoyo_domain+0xd9/0x130 [ 245.801877][T10332] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 245.801907][T10332] tomoyo_path_number_perm+0x1e8/0x5a0 [ 245.801940][T10332] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 245.801974][T10332] ? sb_end_write+0xe9/0x1c0 [ 245.802006][T10332] ? vfs_write+0x8d8/0xa90 [ 245.802071][T10332] ? ksys_write+0x1e1/0x250 [ 245.802104][T10332] security_file_ioctl+0xcb/0x2d0 [ 245.802134][T10332] __se_sys_ioctl+0x47/0x170 [ 245.802167][T10332] do_syscall_64+0xfa/0x3b0 [ 245.802196][T10332] ? lockdep_hardirqs_on+0x9c/0x150 [ 245.802224][T10332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 245.802245][T10332] ? clear_bhb_loop+0x60/0xb0 [ 245.802271][T10332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 245.802292][T10332] RIP: 0033:0x7fb1c638e929 [ 245.802311][T10332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 245.802330][T10332] RSP: 002b:00007fb1c7236038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 245.802353][T10332] RAX: ffffffffffffffda RBX: 00007fb1c65b5fa0 RCX: 00007fb1c638e929 [ 245.802369][T10332] RDX: 0000200000002800 RSI: 0000000000008982 RDI: 000000000000000d [ 245.802382][T10332] RBP: 00007fb1c7236090 R08: 0000000000000000 R09: 0000000000000000 [ 245.802396][T10332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 245.802408][T10332] R13: 0000000000000000 R14: 00007fb1c65b5fa0 R15: 00007ffe573f0b98 [ 245.802441][T10332] [ 245.802464][T10332] ERROR: Out of memory at tomoyo_realpath_from_path. [ 246.122467][T10311] wg1 speed is unknown, defaulting to 1000 [ 246.168446][T10334] netlink: 84 bytes leftover after parsing attributes in process `syz.4.1115'. [ 246.471834][ T51] Bluetooth: hci3: command tx timeout [ 246.536021][T10348] netlink: 27 bytes leftover after parsing attributes in process `syz.4.1120'. [ 246.589339][T10352] netlink: 27 bytes leftover after parsing attributes in process `syz.4.1120'. [ 246.651775][T10351] veth0_to_bridge: entered promiscuous mode [ 246.692928][T10350] veth0_to_bridge: left promiscuous mode [ 246.733531][T10311] chnl_net:caif_netlink_parms(): no params data found [ 246.889861][T10365] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 246.924829][T10326] wg1 speed is unknown, defaulting to 1000 [ 246.991260][T10364] syz2: rxe_newlink: already configured on bond_slave_1 [ 247.176354][T10373] FAULT_INJECTION: forcing a failure. [ 247.176354][T10373] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.189965][ T51] Bluetooth: hci4: command tx timeout [ 247.240476][T10373] CPU: 1 UID: 0 PID: 10373 Comm: syz.1.1127 Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 247.240510][T10373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 247.240524][T10373] Call Trace: [ 247.240532][T10373] [ 247.240542][T10373] dump_stack_lvl+0x189/0x250 [ 247.240575][T10373] ? __pfx____ratelimit+0x10/0x10 [ 247.240605][T10373] ? __pfx_dump_stack_lvl+0x10/0x10 [ 247.240633][T10373] ? __pfx__printk+0x10/0x10 [ 247.240663][T10373] ? __might_fault+0xb0/0x130 [ 247.240704][T10373] should_fail_ex+0x414/0x560 [ 247.240743][T10373] _copy_from_user+0x2d/0xb0 [ 247.240772][T10373] vlan_ioctl_handler+0x9d/0x650 [ 247.240811][T10373] ? __pfx_vlan_ioctl_handler+0x10/0x10 [ 247.240862][T10373] ? __pfx_vlan_ioctl_handler+0x10/0x10 [ 247.240894][T10373] sock_ioctl+0x60d/0x790 [ 247.240923][T10373] ? __pfx_sock_ioctl+0x10/0x10 [ 247.240949][T10373] ? ksys_write+0x1e1/0x250 [ 247.240984][T10373] ? bpf_lsm_file_ioctl+0x9/0x20 [ 247.241015][T10373] ? __pfx_sock_ioctl+0x10/0x10 [ 247.241040][T10373] __se_sys_ioctl+0xf9/0x170 [ 247.241068][T10373] do_syscall_64+0xfa/0x3b0 [ 247.241098][T10373] ? lockdep_hardirqs_on+0x9c/0x150 [ 247.241127][T10373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.241149][T10373] ? clear_bhb_loop+0x60/0xb0 [ 247.241176][T10373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.241197][T10373] RIP: 0033:0x7fb1c638e929 [ 247.241216][T10373] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 247.241234][T10373] RSP: 002b:00007fb1c7236038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 247.241256][T10373] RAX: ffffffffffffffda RBX: 00007fb1c65b5fa0 RCX: 00007fb1c638e929 [ 247.241272][T10373] RDX: 0000200000002800 RSI: 0000000000008982 RDI: 000000000000000d [ 247.241286][T10373] RBP: 00007fb1c7236090 R08: 0000000000000000 R09: 0000000000000000 [ 247.241298][T10373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.241310][T10373] R13: 0000000000000000 R14: 00007fb1c65b5fa0 R15: 00007ffe573f0b98 [ 247.241345][T10373] [ 247.521186][ T13] hsr_slave_0: left promiscuous mode [ 247.548108][ T13] hsr_slave_1: left promiscuous mode [ 247.557131][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 247.565079][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 247.584292][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 247.613271][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 247.646163][ T13] veth1_macvtap: left promiscuous mode [ 247.651881][ T13] veth0_macvtap: left promiscuous mode [ 247.658231][ T13] veth1_vlan: left promiscuous mode [ 247.670475][ T13] veth0_vlan: left promiscuous mode [ 248.189441][ T13] team0 (unregistering): Port device team_slave_1 removed [ 248.226482][ T13] team0 (unregistering): Port device team_slave_0 removed [ 248.546174][ T51] Bluetooth: hci3: command tx timeout [ 248.646528][T10311] bridge0: port 1(bridge_slave_0) entered blocking state [ 248.663266][T10311] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.684866][T10311] bridge_slave_0: entered allmulticast mode [ 248.695308][T10311] bridge_slave_0: entered promiscuous mode [ 248.711547][T10311] bridge0: port 2(bridge_slave_1) entered blocking state [ 248.750359][T10392] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 248.762905][T10311] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.782989][T10394] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 248.784874][T10311] bridge_slave_1: entered allmulticast mode [ 248.809074][T10311] bridge_slave_1: entered promiscuous mode [ 248.840638][T10399] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1131'. [ 248.930949][T10311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 248.935635][T10400] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1132'. [ 248.981111][T10311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 249.138417][T10311] team0: Port device team_slave_0 added [ 249.167415][T10311] team0: Port device team_slave_1 added [ 249.243476][T10326] chnl_net:caif_netlink_parms(): no params data found [ 249.267044][ T51] Bluetooth: hci4: command tx timeout [ 249.276010][T10311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 249.283226][T10311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 249.309846][T10311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 249.337949][T10311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 249.345119][T10311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 249.371387][T10311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 249.498164][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.667849][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.756988][T10326] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.765155][T10326] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.772455][T10326] bridge_slave_0: entered allmulticast mode [ 249.781654][T10326] bridge_slave_0: entered promiscuous mode [ 249.797262][T10311] hsr_slave_0: entered promiscuous mode [ 249.802786][T10419] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1136'. [ 249.804336][T10311] hsr_slave_1: entered promiscuous mode [ 249.839617][T10311] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 249.847894][T10311] Cannot create hsr debugfs directory [ 249.858713][T10420] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 249.920698][T10326] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.932741][T10326] bridge0: port 2(bridge_slave_1) entered disabled state [ 249.944223][T10326] bridge_slave_1: entered allmulticast mode [ 249.952422][T10326] bridge_slave_1: entered promiscuous mode [ 250.048539][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.069867][T10424] FAULT_INJECTION: forcing a failure. [ 250.069867][T10424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 250.095488][T10430] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1137'. [ 250.110786][T10424] CPU: 0 UID: 0 PID: 10424 Comm: syz.0.1138 Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 250.110817][T10424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 250.110830][T10424] Call Trace: [ 250.110838][T10424] [ 250.110848][T10424] dump_stack_lvl+0x189/0x250 [ 250.110880][T10424] ? __pfx____ratelimit+0x10/0x10 [ 250.110909][T10424] ? __pfx_dump_stack_lvl+0x10/0x10 [ 250.110934][T10424] ? __pfx__printk+0x10/0x10 [ 250.110976][T10424] should_fail_ex+0x414/0x560 [ 250.111014][T10424] _copy_to_user+0x31/0xb0 [ 250.111042][T10424] simple_read_from_buffer+0xe1/0x170 [ 250.111075][T10424] proc_fail_nth_read+0x1df/0x250 [ 250.111109][T10424] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 250.111143][T10424] ? rw_verify_area+0x258/0x650 [ 250.111166][T10424] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 250.111198][T10424] vfs_read+0x200/0x980 [ 250.111228][T10424] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 250.111259][T10424] ? __pfx_vfs_read+0x10/0x10 [ 250.111308][T10424] ksys_read+0x145/0x250 [ 250.111340][T10424] ? __pfx_ksys_read+0x10/0x10 [ 250.111359][T10424] ? rcu_is_watching+0x15/0xb0 [ 250.111391][T10424] ? do_syscall_64+0xbe/0x3b0 [ 250.111424][T10424] do_syscall_64+0xfa/0x3b0 [ 250.111452][T10424] ? lockdep_hardirqs_on+0x9c/0x150 [ 250.111479][T10424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.111500][T10424] ? clear_bhb_loop+0x60/0xb0 [ 250.111535][T10424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.111556][T10424] RIP: 0033:0x7fd07dd8d33c [ 250.111574][T10424] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 250.111594][T10424] RSP: 002b:00007fd07eba1030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 250.111616][T10424] RAX: ffffffffffffffda RBX: 00007fd07dfb5fa0 RCX: 00007fd07dd8d33c [ 250.111632][T10424] RDX: 000000000000000f RSI: 00007fd07eba10a0 RDI: 000000000000000f [ 250.111645][T10424] RBP: 00007fd07eba1090 R08: 0000000000000000 R09: 0000000000000000 [ 250.111658][T10424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.111670][T10424] R13: 0000000000000000 R14: 00007fd07dfb5fa0 R15: 00007fff8cfbf568 [ 250.111704][T10424] [ 250.371275][T10429] (unnamed net_device) (uninitialized): option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 250.518765][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.576873][T10326] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 250.617480][T10326] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 250.630027][ T51] Bluetooth: hci3: command tx timeout [ 250.749818][T10444] tipc: Enabled bearer , priority 0 [ 250.770887][T10326] team0: Port device team_slave_0 added [ 250.780974][T10326] team0: Port device team_slave_1 added [ 250.808104][T10443] syzkaller0: entered promiscuous mode [ 250.828486][T10443] syzkaller0: entered allmulticast mode [ 250.852196][T10453] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1145'. [ 250.914672][T10455] netlink: 'syz.4.1146': attribute type 1 has an invalid length. [ 251.044250][T10326] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 251.063611][T10326] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 251.090958][T10326] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 251.140377][T10444] tipc: Resetting bearer [ 251.189078][T10326] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 251.197971][T10326] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 251.224818][T10326] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 251.265053][T10441] tipc: Resetting bearer [ 251.301401][T10441] tipc: Disabling bearer [ 251.344014][ T51] Bluetooth: hci4: command tx timeout [ 251.514527][T10326] hsr_slave_0: entered promiscuous mode [ 251.521416][T10326] hsr_slave_1: entered promiscuous mode [ 251.533727][T10326] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 251.541463][T10326] Cannot create hsr debugfs directory [ 251.556426][ T13] bridge_slave_1: left allmulticast mode [ 251.562113][ T13] bridge_slave_1: left promiscuous mode [ 251.577870][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.592683][ T13] bridge_slave_0: left allmulticast mode [ 251.633537][ T13] bridge_slave_0: left promiscuous mode [ 251.639374][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 252.066932][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 252.078543][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 252.088824][ T13] bond0 (unregistering): Released all slaves [ 252.307532][T10485] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1156'. [ 252.429675][T10311] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 252.483763][T10311] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 252.622524][T10311] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 252.646057][T10500] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1161'. [ 252.695070][T10311] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 252.703777][ T51] Bluetooth: hci3: command tx timeout [ 252.930932][T10516] syz2: rxe_newlink: already configured on bond_slave_1 [ 253.081239][T10518] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 253.181908][ T13] hsr_slave_0: left promiscuous mode [ 253.200055][ T13] hsr_slave_1: left promiscuous mode [ 253.213985][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 253.231791][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 253.250389][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 253.268203][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 253.317610][ T13] veth1_macvtap: left promiscuous mode [ 253.335659][ T13] veth0_macvtap: left promiscuous mode [ 253.341569][ T13] veth1_vlan: left promiscuous mode [ 253.354320][ T13] veth0_vlan: left promiscuous mode [ 253.423269][ T51] Bluetooth: hci4: command tx timeout [ 253.914217][ T55] block nbd0: Possible stuck request ffff888025290000: control (read@0,1024B). Runtime 150 seconds [ 253.927080][ T55] block nbd0: Possible stuck request ffff8880252901c0: control (read@1024,1024B). Runtime 150 seconds [ 253.938792][ T55] block nbd0: Possible stuck request ffff888025290380: control (read@2048,1024B). Runtime 150 seconds [ 253.950587][ T55] block nbd0: Possible stuck request ffff888025290540: control (read@3072,1024B). Runtime 150 seconds [ 254.355137][ T13] team0 (unregistering): Port device team_slave_1 removed [ 254.376100][T10534] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1169'. [ 254.432777][ T13] team0 (unregistering): Port device team_slave_0 removed [ 254.529407][T10539] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1171'. [ 254.549787][T10539] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 254.927879][T10537] netlink: 'syz.0.1169': attribute type 1 has an invalid length. [ 254.944722][ T51] block nbd1: Receive control failed (result -32) [ 255.199633][T10546] syz2: rxe_newlink: already configured on bond_slave_1 [ 255.219273][T10311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 255.364513][T10311] 8021q: adding VLAN 0 to HW filter on device team0 [ 255.390890][T10550] x_tables: duplicate underflow at hook 1 [ 255.507913][T10554] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1176'. [ 255.541056][ T750] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.548281][ T750] bridge0: port 1(bridge_slave_0) entered forwarding state [ 255.578543][T10326] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 255.627204][ T750] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.634449][ T750] bridge0: port 2(bridge_slave_1) entered forwarding state [ 255.662611][T10326] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 255.730569][T10326] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 255.770636][T10326] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 255.782780][T10562] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1178'. [ 255.932339][T10563] bridge5: port 1(veth3) entered blocking state [ 255.944074][T10563] bridge5: port 1(veth3) entered disabled state [ 255.950604][T10563] veth3: entered allmulticast mode [ 255.961490][T10563] veth3: entered promiscuous mode [ 255.994797][T10562] bridge5: port 2(veth0_to_bond) entered blocking state [ 256.001900][T10562] bridge5: port 2(veth0_to_bond) entered disabled state [ 256.035128][T10562] veth0_to_bond: entered allmulticast mode [ 256.042872][T10562] veth0_to_bond: entered promiscuous mode [ 256.075506][T10544] wg1 speed is unknown, defaulting to 1000 [ 256.458561][T10588] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1182'. [ 256.464404][T10326] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.609189][T10326] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.667788][T10588] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1182'. [ 256.779601][ T750] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.786844][ T750] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.848698][T10594] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1183'. [ 256.860264][ T750] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.867478][ T750] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.971880][T10311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.172684][T10311] veth0_vlan: entered promiscuous mode [ 257.199293][T10311] veth1_vlan: entered promiscuous mode [ 257.224313][T10606] netlink: 'syz.0.1186': attribute type 2 has an invalid length. [ 257.317882][T10613] syz2: rxe_newlink: already configured on bond_slave_1 [ 257.376216][T10311] veth0_macvtap: entered promiscuous mode [ 257.376439][T10609] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1186'. [ 257.399653][T10311] veth1_macvtap: entered promiscuous mode [ 257.426609][T10609] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1186'. [ 257.459299][T10609] netlink: 31 bytes leftover after parsing attributes in process `syz.0.1186'. [ 257.467649][T10311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 257.518400][T10311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 257.560486][ T996] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.578873][ T750] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.613704][ T996] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.643802][ T6214] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.718650][T10326] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.977840][ T6216] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 258.023171][ T6216] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 258.375725][T10326] veth0_vlan: entered promiscuous mode [ 258.432221][T10326] veth1_vlan: entered promiscuous mode [ 258.445339][ T6229] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 258.476736][ T6229] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 258.583591][T10326] veth0_macvtap: entered promiscuous mode [ 258.607949][T10326] veth1_macvtap: entered promiscuous mode [ 258.812842][T10661] syzkaller0: entered promiscuous mode [ 258.822054][T10661] syzkaller0: entered allmulticast mode [ 258.855611][T10326] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 258.938943][T10326] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 260.633567][ T5858] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 260.650306][ T5858] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 260.664693][ T5858] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 260.679373][ T5858] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 260.687652][ T5858] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 260.950174][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 260.956637][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.284143][ T3506] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.305945][ T3506] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.389199][ T37] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.433794][ T3506] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.449588][ T3506] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.500397][T10679] tipc: Enabled bearer , priority 0 [ 261.582213][ T37] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.637114][T10680] tipc: Disabling bearer [ 261.652308][T10666] wg1 speed is unknown, defaulting to 1000 [ 261.677570][ T37] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.817773][ T37] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.856724][T10685] (unnamed net_device) (uninitialized): option arp_validate: invalid value (18446744073709551614) [ 262.002061][T10693] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 262.044150][T10693] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 262.113389][T10693] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 262.296703][ T750] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 262.322614][ T750] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 262.359619][T10673] wg1 speed is unknown, defaulting to 1000 [ 262.553862][ T6229] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 262.573792][ T6229] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 262.784350][ T5858] Bluetooth: hci3: command tx timeout [ 262.873003][T10707] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1205'. [ 262.882272][T10708] netlink: 596 bytes leftover after parsing attributes in process `syz.4.1205'. [ 262.891900][T10707] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1205'. [ 262.967649][T10711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1204'. [ 263.042369][ T37] bridge_slave_1: left allmulticast mode [ 263.058995][ T37] bridge_slave_1: left promiscuous mode [ 263.074992][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 263.114219][ T37] bridge_slave_0: left allmulticast mode [ 263.119924][ T37] bridge_slave_0: left promiscuous mode [ 263.130283][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 263.578047][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 263.592476][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 263.602830][ T37] bond0 (unregistering): Released all slaves [ 263.673033][T10714] vlan0: entered allmulticast mode [ 263.687134][T10714] veth1: entered allmulticast mode [ 264.189280][T10673] chnl_net:caif_netlink_parms(): no params data found [ 264.477680][ T37] hsr_slave_0: left promiscuous mode [ 264.486862][ T37] hsr_slave_1: left promiscuous mode [ 264.492818][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 264.500347][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 264.508595][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 264.516154][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 264.538848][ T37] veth1_macvtap: left promiscuous mode [ 264.545313][ T37] veth0_macvtap: left promiscuous mode [ 264.550982][ T37] veth1_vlan: left promiscuous mode [ 264.556434][ T37] veth0_vlan: left promiscuous mode [ 264.881235][ T5858] Bluetooth: hci3: command tx timeout [ 265.327892][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 265.337744][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 265.352991][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 265.361777][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 265.370372][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 265.462671][T10741] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 265.776117][ T37] team0 (unregistering): Port device team_slave_1 removed [ 265.814508][ T37] team0 (unregistering): Port device team_slave_0 removed [ 266.232757][T10673] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.245778][T10673] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.257288][T10673] bridge_slave_0: entered allmulticast mode [ 266.266973][T10673] bridge_slave_0: entered promiscuous mode [ 266.276594][T10673] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.284010][T10673] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.291406][T10673] bridge_slave_1: entered allmulticast mode [ 266.299904][T10673] bridge_slave_1: entered promiscuous mode [ 266.510679][T10673] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 266.546881][T10673] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 266.645861][T10673] team0: Port device team_slave_0 added [ 266.669931][T10673] team0: Port device team_slave_1 added [ 266.912678][T10779] tipc: Enabled bearer , priority 0 [ 266.954237][ T5858] Bluetooth: hci3: command tx timeout [ 266.977086][T10673] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 267.023370][T10673] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 267.125412][T10673] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 267.159447][T10673] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 267.192053][T10673] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 267.221629][T10791] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1225'. [ 267.226820][T10673] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 267.270702][T10783] syzkaller0: entered allmulticast mode [ 267.278385][T10755] wg1 speed is unknown, defaulting to 1000 [ 267.429263][ T5858] Bluetooth: hci4: command tx timeout [ 267.436614][T10673] hsr_slave_0: entered promiscuous mode [ 267.449533][T10673] hsr_slave_1: entered promiscuous mode [ 267.456373][T10673] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 267.464505][T10673] Cannot create hsr debugfs directory [ 267.575118][T10775] tipc: Disabling bearer [ 267.730708][ T37] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.824615][T10805] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1230'. [ 267.858439][T10805] nbd: must specify at least one socket [ 267.912702][ T37] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 268.023590][ T37] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 268.200541][ T37] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 268.752879][T10852] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1243'. [ 268.821229][T10755] chnl_net:caif_netlink_parms(): no params data found [ 268.992786][ T37] bridge_slave_1: left allmulticast mode [ 269.001233][ T37] bridge_slave_1: left promiscuous mode [ 269.008605][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 269.023659][ T5858] Bluetooth: hci3: command tx timeout [ 269.030921][ T37] bridge_slave_0: left allmulticast mode [ 269.039539][ T37] bridge_slave_0: left promiscuous mode [ 269.045640][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 269.366667][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 269.377758][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 269.389487][ T37] bond0 (unregistering): Released all slaves [ 269.503548][ T5858] Bluetooth: hci4: command tx timeout [ 269.507707][T10755] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.522090][T10755] bridge0: port 1(bridge_slave_0) entered disabled state [ 269.530762][T10755] bridge_slave_0: entered allmulticast mode [ 269.539428][T10755] bridge_slave_0: entered promiscuous mode [ 269.550772][T10755] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.558481][T10755] bridge0: port 2(bridge_slave_1) entered disabled state [ 269.566103][T10755] bridge_slave_1: entered allmulticast mode [ 269.574566][T10755] bridge_slave_1: entered promiscuous mode [ 269.657582][T10863] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1245'. [ 269.805455][T10755] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 269.848909][T10755] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 270.205628][T10755] team0: Port device team_slave_0 added [ 270.270002][T10755] team0: Port device team_slave_1 added [ 270.527324][T10755] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 270.546055][T10755] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 270.609083][T10755] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 270.659754][T10673] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 270.680043][ T37] hsr_slave_0: left promiscuous mode [ 270.687778][ T37] hsr_slave_1: left promiscuous mode [ 270.694624][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 270.702143][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 270.710418][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 270.719025][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 270.741301][ T37] veth1_macvtap: left promiscuous mode [ 270.747114][ T37] veth0_macvtap: left promiscuous mode [ 270.752730][ T37] veth1_vlan: left promiscuous mode [ 270.758394][ T37] veth0_vlan: left promiscuous mode [ 271.301264][ T37] team0 (unregistering): Port device team_slave_1 removed [ 271.357800][ T37] team0 (unregistering): Port device team_slave_0 removed [ 271.583332][ T5858] Bluetooth: hci4: command tx timeout [ 271.844137][T10755] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 271.851210][T10755] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 271.881880][T10755] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 271.917674][T10673] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 271.998099][T10673] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 272.129336][T10755] hsr_slave_0: entered promiscuous mode [ 272.173772][T10755] hsr_slave_1: entered promiscuous mode [ 272.190720][T10755] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 272.225158][T10755] Cannot create hsr debugfs directory [ 272.243320][T10673] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 273.078076][T10673] 8021q: adding VLAN 0 to HW filter on device bond0 [ 273.107943][T10950] netlink: 'syz.0.1268': attribute type 3 has an invalid length. [ 273.157089][T10673] 8021q: adding VLAN 0 to HW filter on device team0 [ 273.183360][T10956] netlink: 'syz.0.1268': attribute type 1 has an invalid length. [ 273.216712][ T6229] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.223925][ T6229] bridge0: port 1(bridge_slave_0) entered forwarding state [ 273.248398][ T6229] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.255673][ T6229] bridge0: port 2(bridge_slave_1) entered forwarding state [ 273.265764][T10956] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 273.663279][ T5858] Bluetooth: hci4: command tx timeout [ 274.002166][T10988] lo speed is unknown, defaulting to 1000 [ 274.091912][T10988] lo speed is unknown, defaulting to 1000 [ 274.150640][T10988] lo speed is unknown, defaulting to 1000 [ 274.159723][T10755] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 274.221627][T10988] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 274.226856][T10755] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 274.298896][T10755] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 274.332518][T10755] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 274.359668][T10988] lo speed is unknown, defaulting to 1000 [ 274.369084][T11001] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1284'. [ 274.390912][T10988] lo speed is unknown, defaulting to 1000 [ 274.418040][T10988] lo speed is unknown, defaulting to 1000 [ 274.454408][T10988] lo speed is unknown, defaulting to 1000 [ 274.460751][T10673] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 274.484593][T10988] lo speed is unknown, defaulting to 1000 [ 274.639699][T10673] veth0_vlan: entered promiscuous mode [ 274.659951][T10673] veth1_vlan: entered promiscuous mode [ 274.770283][T10755] 8021q: adding VLAN 0 to HW filter on device bond0 [ 274.798486][T11022] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1289'. [ 274.830883][T10673] veth0_macvtap: entered promiscuous mode [ 274.857487][T10673] veth1_macvtap: entered promiscuous mode [ 274.934822][T10755] 8021q: adding VLAN 0 to HW filter on device team0 [ 274.986312][T10673] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 275.012950][ T750] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.020166][ T750] bridge0: port 1(bridge_slave_0) entered forwarding state [ 275.068221][T10673] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 275.085580][T11033] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1292'. [ 275.113865][T11026] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1289'. [ 275.128585][T11031] tc_dump_action: action bad kind [ 275.145400][T11035] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1291'. [ 275.165220][ T750] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.172475][ T750] bridge0: port 2(bridge_slave_1) entered forwarding state [ 275.235522][ T750] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.291370][ T750] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.332580][ T750] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.397817][ T750] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.548484][T10755] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 275.632171][ T750] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 275.650947][ T750] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 275.719532][ T750] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 275.739925][ T750] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 275.755748][T11053] netlink: 'syz.4.1295': attribute type 1 has an invalid length. [ 275.814526][T11053] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1295'. [ 276.255540][T10755] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 276.314584][T11069] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.1299'. [ 276.337973][T11069] netlink: 'syz.1.1299': attribute type 10 has an invalid length. [ 276.381619][ T6220] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.424794][T11067] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 276.487984][T10755] veth0_vlan: entered promiscuous mode [ 276.522131][T10755] veth1_vlan: entered promiscuous mode [ 276.566887][ T6220] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.694541][ T6220] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.722831][T10755] veth0_macvtap: entered promiscuous mode [ 276.737637][T10755] veth1_macvtap: entered promiscuous mode [ 276.760078][T10755] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 276.777397][T10755] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 276.797257][ T3506] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.807262][ T3506] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.817147][ T3506] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.827279][ T3506] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.897884][ T3506] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 276.916993][ T3506] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 276.947528][ T6220] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.987865][ T3506] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 276.997218][ T3506] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 277.159665][ T6220] bridge_slave_1: left allmulticast mode [ 277.169958][ T6220] bridge_slave_1: left promiscuous mode [ 277.176547][ T6220] bridge0: port 2(bridge_slave_1) entered disabled state [ 277.187604][ T6220] bridge_slave_0: left allmulticast mode [ 277.194714][ T6220] bridge_slave_0: left promiscuous mode [ 277.200426][ T6220] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.700537][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 277.709767][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 277.734976][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 277.753614][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 277.761361][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 277.877784][ T6220] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 277.895466][ T6220] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 277.906692][ T6220] bond0 (unregistering): Released all slaves [ 278.278962][T11081] wg1 speed is unknown, defaulting to 1000 [ 278.288944][T11081] lo speed is unknown, defaulting to 1000 [ 278.682840][ T6220] hsr_slave_0: left promiscuous mode [ 278.710628][ T6220] hsr_slave_1: left promiscuous mode [ 278.738832][ T6220] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 278.762942][ T6220] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 278.781645][ T6220] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 278.803767][ T6220] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 278.807529][T11101] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1308'. [ 278.913551][ T6220] veth1_macvtap: left promiscuous mode [ 278.932717][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 278.941562][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 278.958161][ T6220] veth0_macvtap: left promiscuous mode [ 278.965444][ T6220] veth1_vlan: left promiscuous mode [ 278.970816][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 278.978259][ T6220] veth0_vlan: left promiscuous mode [ 279.000558][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 279.027125][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 279.361821][T11109] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 279.427977][T11109] netlink: 'syz.4.1311': attribute type 4 has an invalid length. [ 279.622574][T11114] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1313'. [ 279.678170][ T6220] team0 (unregistering): Port device team_slave_1 removed [ 279.727956][ T6220] team0 (unregistering): Port device team_slave_0 removed [ 279.827646][ T5858] Bluetooth: hci3: command tx timeout [ 280.173951][T11119] syzkaller0: tun_chr_ioctl cmd 1074812118 [ 280.508730][T11133] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1317'. [ 280.527359][T11130] batadv_slave_0: entered promiscuous mode [ 280.712717][T11081] chnl_net:caif_netlink_parms(): no params data found [ 280.781130][T11139] team0: left allmulticast mode [ 280.792250][T11139] team_slave_0: left allmulticast mode [ 280.804157][T11139] team_slave_1: left allmulticast mode [ 280.820245][T11139] team0: left promiscuous mode [ 280.835453][T11139] team_slave_0: left promiscuous mode [ 280.850445][T11139] team_slave_1: left promiscuous mode [ 280.873918][T11139] bridge0: port 3(team0) entered disabled state [ 280.897080][T11139] bridge_slave_0: left allmulticast mode [ 280.908175][T11139] bridge_slave_0: left promiscuous mode [ 280.917717][T11139] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.967324][T11139] bridge_slave_1: left allmulticast mode [ 280.989979][T11139] bridge_slave_1: left promiscuous mode [ 281.015736][T11139] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.061977][T11139] bond0: (slave bond_slave_0): Releasing backup interface [ 281.097717][T11139] bond0: (slave bond_slave_1): Releasing backup interface [ 281.108283][ T5858] Bluetooth: hci4: command tx timeout [ 281.122379][T11139] team0: Port device team_slave_0 removed [ 281.131531][T11139] team0: Port device team_slave_1 removed [ 281.182831][T11104] wg1 speed is unknown, defaulting to 1000 [ 281.236538][T11104] lo speed is unknown, defaulting to 1000 [ 281.599394][T11081] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.608766][T11081] bridge0: port 1(bridge_slave_0) entered disabled state [ 281.619998][T11081] bridge_slave_0: entered allmulticast mode [ 281.685528][T11081] bridge_slave_0: entered promiscuous mode [ 281.777646][ T6220] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 281.837418][T11081] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.848195][T11081] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.865788][T11081] bridge_slave_1: entered allmulticast mode [ 281.904155][ T5858] Bluetooth: hci3: command tx timeout [ 281.919011][T11081] bridge_slave_1: entered promiscuous mode [ 282.199563][ T6220] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.311192][T11081] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 282.367064][ T6220] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.390530][T11081] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 282.520445][ T6220] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.552592][T11081] team0: Port device team_slave_0 added [ 282.577391][T11081] team0: Port device team_slave_1 added [ 282.811355][T11188] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1329'. [ 282.876099][T11081] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 282.892990][T11081] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 282.922458][T11081] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 282.935901][T11081] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 282.943655][T11081] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 282.971681][T11081] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 282.991060][T11188] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 283.000742][T11192] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.1328'. [ 283.183271][ T51] Bluetooth: hci4: command tx timeout [ 283.227887][T11081] hsr_slave_0: entered promiscuous mode [ 283.244559][T11081] hsr_slave_1: entered promiscuous mode [ 283.251073][T11081] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 283.264159][T11081] Cannot create hsr debugfs directory [ 283.270110][T11104] chnl_net:caif_netlink_parms(): no params data found [ 283.483585][T11208] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1336'. [ 283.483600][T11209] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1336'. [ 283.484070][ T6220] bridge_slave_1: left allmulticast mode [ 283.509179][ T6220] bridge_slave_1: left promiscuous mode [ 283.518462][ T6220] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.528722][ T6220] bridge_slave_0: left allmulticast mode [ 283.534922][ T6220] bridge_slave_0: left promiscuous mode [ 283.540678][ T6220] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.917012][ T6220] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 283.929312][ T6220] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 283.939980][ T6220] bond0 (unregistering): Released all slaves [ 283.987678][ T51] Bluetooth: hci3: command tx timeout [ 283.994174][ T55] block nbd0: Possible stuck request ffff888025290000: control (read@0,1024B). Runtime 180 seconds [ 284.004997][ T55] block nbd0: Possible stuck request ffff8880252901c0: control (read@1024,1024B). Runtime 180 seconds [ 284.016067][ T55] block nbd0: Possible stuck request ffff888025290380: control (read@2048,1024B). Runtime 180 seconds [ 284.027756][ T55] block nbd0: Possible stuck request ffff888025290540: control (read@3072,1024B). Runtime 180 seconds [ 284.279756][T11104] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.323483][T11104] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.331055][T11104] bridge_slave_0: entered allmulticast mode [ 284.339004][T11104] bridge_slave_0: entered promiscuous mode [ 284.415338][T11232] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1341'. [ 284.430079][T11232] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1341'. [ 284.500438][T11104] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.508227][T11104] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.515880][T11104] bridge_slave_1: entered allmulticast mode [ 284.523798][T11104] bridge_slave_1: entered promiscuous mode [ 284.647926][T11239] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1343'. [ 284.651253][T11104] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 284.711802][T11237] tipc: Enabled bearer , priority 0 [ 284.825164][T11245] netlink: 'syz.0.1345': attribute type 2 has an invalid length. [ 284.835971][T11245] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1345'. [ 284.854013][T11104] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 284.955800][T11240] syzkaller0: entered promiscuous mode [ 284.961356][T11240] syzkaller0: entered allmulticast mode [ 285.094757][T11254] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1347'. [ 285.110842][T11254] netlink: 108 bytes leftover after parsing attributes in process `syz.4.1347'. [ 285.121381][T11254] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1347'. [ 285.265421][ T51] Bluetooth: hci4: command 0x040f tx timeout [ 285.827130][ T44] tipc: Node number set to 1029095031 [ 286.067083][ T51] Bluetooth: hci3: command tx timeout [ 286.695783][T11251] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000035: 0000 [#1] SMP KASAN PTI [ 286.707747][T11251] KASAN: null-ptr-deref in range [0x00000000000001a8-0x00000000000001af] [ 286.716297][T11251] CPU: 1 UID: 0 PID: 11251 Comm: syz.1.1342 Not tainted 6.16.0-rc4-syzkaller-01139-gea988b450690 #0 PREEMPT(full) [ 286.728392][T11251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 286.738453][T11251] RIP: 0010:htb_qlen_notify+0x31/0xc0 [ 286.743843][T11251] Code: 41 56 41 55 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 cd 57 3e f8 49 8d 9e a8 01 00 00 49 89 dd 49 c1 ed 03 <43> 0f b6 44 25 00 84 c0 75 4d 8b 2b 31 ff 89 ee e8 ea 5b 3e f8 85 [ 286.763542][T11251] RSP: 0018:ffffc9000217f0f0 EFLAGS: 00010206 [ 286.769627][T11251] RAX: ffffffff89820833 RBX: 00000000000001a8 RCX: 0000000000080000 [ 286.777598][T11251] RDX: ffffc900105f6000 RSI: 00000000000003e9 RDI: 00000000000003ea [ 286.785572][T11251] RBP: dffffc0000000000 R08: ffff88801c7a3c00 R09: 0000000000000002 [ 286.793547][T11251] R10: 00000000ffffffff R11: ffffffff89820810 R12: dffffc0000000000 [ 286.801522][T11251] R13: 0000000000000035 R14: 0000000000000000 R15: ffff88807e93e000 [ 286.809497][T11251] FS: 00007fb1c71d36c0(0000) GS:ffff888125d14000(0000) knlGS:0000000000000000 [ 286.818432][T11251] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.825034][T11251] CR2: 00007f6c1110689a CR3: 0000000077b08000 CR4: 00000000003526f0 [ 286.833021][T11251] Call Trace: [ 286.836305][T11251] [ 286.839241][T11251] qdisc_tree_reduce_backlog+0x299/0x480 [ 286.844891][T11251] ? qdisc_tree_reduce_backlog+0x3c/0x480 [ 286.850646][T11251] hhf_change+0x764/0xad0 [ 286.854994][T11251] ? __pfx_hhf_change+0x10/0x10 [ 286.859850][T11251] ? qdisc_get_stab+0x556/0x710 [ 286.864712][T11251] ? __pfx_qdisc_get_stab+0x10/0x10 [ 286.869913][T11251] ? qdisc_alloc+0x7a1/0xaa0 [ 286.874593][T11251] ? __pfx_hhf_init+0x10/0x10 [ 286.879275][T11251] hhf_init+0x213/0x950 [ 286.883444][T11251] ? __pfx_hhf_init+0x10/0x10 [ 286.888123][T11251] qdisc_create+0x7a9/0xea0 [ 286.892639][T11251] tc_modify_qdisc+0x1426/0x2010 [ 286.897586][T11251] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 286.902885][T11251] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 286.908171][T11251] rtnetlink_rcv_msg+0x779/0xb70 [ 286.913121][T11251] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 286.918254][T11251] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 286.923726][T11251] netlink_rcv_skb+0x205/0x470 [ 286.928501][T11251] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 286.933966][T11251] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 286.939266][T11251] ? netlink_deliver_tap+0x2e/0x1b0 [ 286.944473][T11251] ? netlink_deliver_tap+0x2e/0x1b0 [ 286.949680][T11251] netlink_unicast+0x758/0x8d0 [ 286.954454][T11251] netlink_sendmsg+0x805/0xb30 [ 286.959245][T11251] ? __pfx_netlink_sendmsg+0x10/0x10 [ 286.964539][T11251] ? aa_sock_msg_perm+0x94/0x160 [ 286.969491][T11251] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 286.974774][T11251] ? __pfx_netlink_sendmsg+0x10/0x10 [ 286.980065][T11251] __sock_sendmsg+0x219/0x270 [ 286.984776][T11251] ____sys_sendmsg+0x505/0x830 [ 286.989559][T11251] ? __pfx_____sys_sendmsg+0x10/0x10 [ 286.994864][T11251] ? import_iovec+0x74/0xa0 [ 286.999398][T11251] ___sys_sendmsg+0x21f/0x2a0 [ 287.004077][T11251] ? __pfx____sys_sendmsg+0x10/0x10 [ 287.009596][T11251] ? __fget_files+0x2a/0x420 [ 287.014226][T11251] ? __fget_files+0x3a0/0x420 [ 287.018932][T11251] __x64_sys_sendmsg+0x19b/0x260 [ 287.023885][T11251] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 287.029365][T11251] ? do_user_addr_fault+0xc8a/0x1390 [ 287.034660][T11251] ? do_syscall_64+0xbe/0x3b0 [ 287.039351][T11251] do_syscall_64+0xfa/0x3b0 [ 287.043953][T11251] ? lockdep_hardirqs_on+0x9c/0x150 [ 287.049160][T11251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.055232][T11251] ? clear_bhb_loop+0x60/0xb0 [ 287.059919][T11251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.065812][T11251] RIP: 0033:0x7fb1c638e929 [ 287.070231][T11251] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 287.089850][T11251] RSP: 002b:00007fb1c71d3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 287.098272][T11251] RAX: ffffffffffffffda RBX: 00007fb1c65b6240 RCX: 00007fb1c638e929 [ 287.106335][T11251] RDX: 000000002400c810 RSI: 0000200000000200 RDI: 000000000000000c [ 287.114307][T11251] RBP: 00007fb1c6410b39 R08: 0000000000000000 R09: 0000000000000000 [ 287.122276][T11251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 287.130251][T11251] R13: 0000000000000001 R14: 00007fb1c65b6240 R15: 00007ffe573f0b98 [ 287.138238][T11251] [ 287.141275][T11251] Modules linked in: [ 287.145328][T11251] ---[ end trace 0000000000000000 ]--- [ 287.150814][T11251] RIP: 0010:htb_qlen_notify+0x31/0xc0 [ 287.156275][T11251] Code: 41 56 41 55 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 cd 57 3e f8 49 8d 9e a8 01 00 00 49 89 dd 49 c1 ed 03 <43> 0f b6 44 25 00 84 c0 75 4d 8b 2b 31 ff 89 ee e8 ea 5b 3e f8 85 [ 287.175943][T11251] RSP: 0018:ffffc9000217f0f0 EFLAGS: 00010206 [ 287.182016][T11251] RAX: ffffffff89820833 RBX: 00000000000001a8 RCX: 0000000000080000 [ 287.190023][T11251] RDX: ffffc900105f6000 RSI: 00000000000003e9 RDI: 00000000000003ea [ 287.198045][T11251] RBP: dffffc0000000000 R08: ffff88801c7a3c00 R09: 0000000000000002 [ 287.206101][T11251] R10: 00000000ffffffff R11: ffffffff89820810 R12: dffffc0000000000 [ 287.214149][T11251] R13: 0000000000000035 R14: 0000000000000000 R15: ffff88807e93e000 [ 287.222129][T11251] FS: 00007fb1c71d36c0(0000) GS:ffff888125d14000(0000) knlGS:0000000000000000 [ 287.231118][T11251] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 287.237743][T11251] CR2: 00007f6c1110689a CR3: 0000000077b08000 CR4: 00000000003526f0 [ 287.245755][T11251] Kernel panic - not syncing: Fatal exception in interrupt [ 287.253340][T11251] Kernel Offset: disabled [ 287.257671][T11251] Rebooting in 86400 seconds..