last executing test programs: 3.076180409s ago: executing program 4 (id=4282): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) clock_gettime(0xe2d1b348b6c14161, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=ANY=[@ANYBLOB="6c0100001000130700000000fcdbdf25fe8000001900000000070000000000aaac1414bb0000000000000000000015a3d1d6000400000000000000091d000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000fe320000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff080000000000000001000000000000000900000000000000ffffff7f0000000043050000000000000400000000000000ffffffffffffff7ffcffffffffffffffe2eb0000000000000200000000000000000000002cbd7000000000000a00040058000000000000001c00040007004e244e200000e000000200000000000000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060"], 0x16c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 2.970136394s ago: executing program 1 (id=4284): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x200400c0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a010400000000000000000200000038000480340001800900010068617368000000002400028008000540000000070800074000000001080005400000532808000340000000900900010073797a30000000000900020073797a3200000000050007"], 0x94}}, 0x50) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES64=r2, @ANYBLOB="0000000000000000000000000000000000000600", @ANYRES32=r1, @ANYRES64=r3, @ANYRESOCT=r1], 0x50) close(0x3) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\n\x00\x00'], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r3, @ANYRES16=r0, @ANYRES64=r1, @ANYBLOB="0000000000000000b7080000810000087b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x10000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) (async) sendmsg$unix(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x4000) (async) pselect6(0x40, &(0x7f0000000280)={0x1, 0x7f, 0x0, 0x3, 0x820, 0x3, 0x400, 0x1}, &(0x7f00000002c0)={0x4, 0x0, 0x5, 0x4, 0x6, 0x2, 0x6, 0x5}, &(0x7f0000000300)={0xffffffffffffffff, 0x7, 0x7, 0x8000000000000000, 0x8, 0x1, 0x4, 0x74a5}, &(0x7f0000000380), &(0x7f0000000580)={&(0x7f00000004c0)={[0x6]}, 0x8}) (async) r7 = socket$kcm(0x29, 0x5, 0x0) recvmsg$kcm(r7, &(0x7f0000000680)={&(0x7f00000005c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000640)=""/12, 0xc}, {&(0x7f0000000dc0)=""/181, 0xb5}, {&(0x7f0000000a00)=""/218, 0xda}, {&(0x7f0000000b40)=""/252, 0xfc}, {&(0x7f0000000c40)=""/104, 0x68}], 0x5}, 0x2060) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) (async) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000240)) (async) unshare(0x2a060400) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x13, 0x4, &(0x7f0000000d40)=ANY=[@ANYBLOB="18000000030000001f000000feffff108500000007000000953ceb569d26b9798a06a75848f547b775ad77c4a607bf12d7027d05bae98db70b431221a926b8b59098800a10ae27c4a4f1d40fa74ee192dbb1d3fe"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r9, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, 0x0}}, 0x40) (async) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r11, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r11, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000100)={r10, 0x0, 0x0}, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000940)=ANY=[@ANYBLOB="1d159e15d4c0c863e2d5b10b91cd3c00ffff", @ANYRESHEX=r4, @ANYBLOB="000229bd7000fddbdf250600000005002e0000000000adff0600", @ANYRES32=r8, @ANYBLOB="080032000600000008003a008207000005002d0041000000"], 0x3c}, 0x1, 0x0, 0x0, 0x880}, 0x30000000) (async) socket$inet(0xa, 0x801, 0x84) (async) r12 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$inet6_int(r12, 0x29, 0x12, 0x0, &(0x7f00000000c0)) 2.856827235s ago: executing program 4 (id=4286): r0 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c40)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000005000000030000000100000f05000000000000000100000005000000004f0030"], &(0x7f00000006c0)=""/262, 0x35, 0x106, 0x9}, 0x28) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x1032, 0xffffffffffffffff, 0x21d67000) pselect6(0x40, &(0x7f0000000180)={0x1, 0x40, 0x3, 0x3, 0x7def1099, 0x8, 0x5, 0x7}, 0x0, &(0x7f0000001380)={0x80000000, 0x8, 0x401, 0xfffffffffffffffa, 0x3, 0x9, 0xfffffffffffffff9, 0x9}, &(0x7f00000013c0)={0x77359400}, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c2200001500010000000000fbdbdf250a00000004000000140001"], 0x225c}, 0x1, 0x0, 0x0, 0x20004855}, 0x0) splice(r3, 0x0, r5, 0x0, 0x10d00, 0xf) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) recvmsg(r0, &(0x7f0000000680)={&(0x7f00000000c0)=@ethernet={0x0, @dev}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000240)=""/182, 0xb6}, {&(0x7f0000000500)=""/168, 0xa8}], 0x2, &(0x7f0000000640)=""/62, 0x3e}, 0x40) r6 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/cgroup\x00') ioctl$NILFS_IOCTL_GET_CPSTAT(r5, 0x80186e83, &(0x7f0000000380)) ioctl$BTRFS_IOC_SYNC(r6, 0x9408, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0xa, 0x3, 0x2, 0x3, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x15, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000009}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x61800, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r9, r8}, 0xc) r10 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r10, &(0x7f0000004800)=[{0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000001180)="937ed53af62c83ae406275c8e57c8f3f7be606", 0x13}], 0x1, &(0x7f00000023c0)=[@assoc={0x18, 0x117, 0x4, 0x3}], 0x18, 0x840}], 0x1, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) 2.705658727s ago: executing program 1 (id=4289): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x24, 0x2, 0x1, 0x3, 0x0, 0x0, {0x2, 0x0, 0x4}, [@CTA_TUPLE_REPLY={0x4}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x222}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x44008000}, 0x40008d2) 2.546847901s ago: executing program 1 (id=4292): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[], 0x10448) unshare(0x8000400) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x1, 0x0, &(0x7f00000012c0)) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x403, 0x1, 0x0, {0x0, 0x0, 0x4, r3, 0x300}, [@IFLA_MASTER={0x8, 0xa, r3}]}, 0x28}, 0x1, 0x0, 0x0, 0x14}, 0x8044) 2.039534s ago: executing program 4 (id=4295): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x17, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x43}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0xcb}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [@printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x35e}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x500}}}, &(0x7f0000000080)='GPL\x00', 0x3, 0xff8, &(0x7f0000000780)=""/4088, 0x41000, 0x41, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="54040000160001000000000000000000fc000000000000000000000000000001ac1414bb0000000000000000000000000000000000000000000080a000000000", @ANYRES64=r1, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffff7f0000010000000033000000fe8000000000000000000000000000aa0700000000000000000000000000000000000000000000000100000000000000fffffffffffffffff1ffffffffffffff03000000000000000000000000000000000000000000000000020000000000000100000000000000feffffffffffffff000000000600000096070000000000000735000000000302be0000000000000000000000b1a001004400050000000000000000000000000000000001000004d6330000000a000000ffffffff000000000000000000000000013500000102060010000000040000001000000008001800ff0f0000e40006"], 0x454}, 0x1, 0x0, 0x0, 0x4005}, 0x0) 1.596617457s ago: executing program 1 (id=4297): r0 = socket(0x10, 0x803, 0x0) r1 = accept4$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x2711, @my=0x0}, 0x10, 0x80800) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) bind$inet(r2, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f00000002c0)=0x9, 0x4) bind$inet(r3, &(0x7f0000000000)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000004c0)={0x1, &(0x7f0000000480)=[{0x401, 0x0, 0x2, 0x26}]}, 0x10) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01002659dbd185aa14857000000008000300", @ANYRES32=r9], 0x30}, 0x1, 0x0, 0x0, 0x4040010}, 0x804) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2f8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x110, 0x60030000, {0x0, 0xff000000}, [@common=@hbh={{0x48}, {0x6, 0x7, 0x0, [0x4, 0x5, 0x1, 0x1ff, 0x3, 0x3, 0x219, 0xf, 0x3, 0x6, 0x4, 0x0, 0x5, 0x4, 0x9, 0xa], 0xc}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @inet=@rpfilter={{0x28}, {0x1c}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@delpolicy={0x64, 0x14, 0x211, 0x0, 0x0, {{@in=@broadcast, @in6=@private2}, 0x6e6bc0}, [@XFRMA_IF_ID={0x8}, @policy_type={0xa}]}, 0x64}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x34, r5, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x65}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0xfffffff5, {0x0, 0x0, 0x4a00, 0x0, 0x2844a}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000500)={@empty, @multicast2, 0x0, "c184521fb3e4f96cfcdc53f44251a92857879e6360a1f76114b99e82e12262bb", 0x400, 0x3, 0x1ff, 0x7fffffff}, 0x3c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r4, {0x6}}}, 0x24}}, 0x0) 1.588028339s ago: executing program 0 (id=4298): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) unshare(0x20000400) (async, rerun: 32) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newlink={0x3c, 0x29, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300, 0x8042}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x4}}}, @IFLA_LINK={0x8}]}, 0x3c}}, 0x0) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)={@ifindex, r1, 0x11, 0x0, 0x0, @void, @value=0x0}, 0x20) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x48, 0x10, 0x44b, 0x0, 0x1, {0x7a, 0x0, 0x0, 0x0, 0x9c12}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @IFLA_BR_GROUP_FWD_MASK={0x6}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 1.520941294s ago: executing program 2 (id=4299): r0 = socket(0x0, 0x5, 0x80001) sendmsg$NFT_BATCH(r0, 0x0, 0x24000840) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9, 0x1}, 0x20) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@dev={0xfe, 0x80, '\x00', 0xa}, 0x8000000, 0x2, 0x2, 0xc, 0xfffe, 0xffff}, 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(0x0, r0) sendmsg$NL80211_CMD_SET_QOS_MAP(r2, 0x0, 0x880) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) connect$inet(r4, &(0x7f0000000200)={0x2, 0x4e22, @remote}, 0xa) setsockopt$IP_VS_SO_SET_STOPDAEMON(r4, 0x0, 0x48c, &(0x7f00000002c0)={0x1, 'vxcan1\x00', 0x1}, 0x18) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@mcast1, 0x8000000, 0x2, 0x0, 0x2, 0x4, 0x3}, 0x20) close(0x3) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x7a, &(0x7f0000000340)={r7, @in6={{0xa, 0x3, 0x3, @mcast1, 0x2}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r0, &(0x7f00000032c0), 0x0, 0x4010) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000240)=ANY=[@ANYRES8=r3, @ANYBLOB="010fde62c8"], 0xc) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r8, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x1, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5", 0x0, 0x0, 0x0, 0xfffffffc}, 0x3c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$MRT_DEL_MFC_PROXY(r8, 0x0, 0xd3, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) accept$unix(r0, 0x0, 0x0) 1.512470822s ago: executing program 4 (id=4300): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000dc0)=@delchain={0x24, 0x2e, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x6, 0xffff}, {0xffff, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000080)) ioctl$PPPIOCSMRU1(r1, 0x40047452, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0200000080000000000000000000000000dfffffb79bb088ca951bc02bf962ff6a6be042cfa1c8acca1b9e8b8579158125c3c2cb052f8c4c5efb70caf6528ab595f2f0166bb33d445fcda3b767052405da021415272cc9bc062931d96c2c07a0ce3127399a82d00f8542282628c959c6a356b90806cf9829bfbf8965e2f39322eab06bb0e780ff80b92b2f1ad31c3483e5ab044a5c7ec2a9d2a6ef6116ee2bed3c90eff68d6445fddeca646d2f5d4074a60000000000000000", @ANYRESOCT=r0, @ANYRESOCT, @ANYRES32=0x0, @ANYRESDEC=r0, @ANYRESDEC=r1], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000a, 0xc3072, 0xffffffffffffffff, 0x2fd15000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x2000) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$inet(r5, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x48c0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000340)={r2, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x10, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x792786e3}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000280)='GPL\x00', 0x6, 0xe, &(0x7f00000002c0)=""/14, 0x40f00, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x4000000c, 0x7f, 0x8}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000380)=[r2, r2, r2, r6], &(0x7f00000003c0)=[{0x5, 0x1, 0x9, 0x6}], 0x10, 0x5}, 0x94) 1.471039668s ago: executing program 0 (id=4301): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async, rerun: 32) bpf$MAP_CREATE(0x15, &(0x7f00000002c0)=@bloom_filter, 0x48) (rerun: 32) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x5}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}, 0x1, 0x0, 0x0, 0x4044050}, 0x50091) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r6) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r7) (async, rerun: 32) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) bpf$BPF_PROG_QUERY(0x10, 0x0, 0xffffffffffffff58) (async) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c000080080003400000000214000000110001"], 0xb0}, 0x1, 0x0, 0x0, 0x14}, 0x0) (async) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}}, 0x20000001) (async) setsockopt$netlink_NETLINK_RX_RING(r1, 0x10e, 0x6, &(0x7f0000000000)={0x6, 0x5, 0xf4c, 0x6}, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r9, 0x401c5820, &(0x7f0000000040)={0x8000, 0x7, 0x9, 0xfbffffff, 0xf}) recvmsg$can_bcm(r9, &(0x7f0000002640)={&(0x7f00000003c0)=@in={0x2, 0x0, @dev}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000440)=""/188, 0xbc}, {&(0x7f0000000640)=""/253, 0xfd}, {&(0x7f0000000940)=""/210, 0xd2}, {&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000002300)=""/171, 0xab}, {&(0x7f00000023c0)=""/162, 0xa2}, {&(0x7f0000002480)=""/21, 0x15}, {&(0x7f00000024c0)=""/3, 0x3}], 0x8, &(0x7f0000002580)=""/174, 0xae}, 0x40010100) (async) r10 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) 1.282839424s ago: executing program 2 (id=4302): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000008000000180100002520732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000f98500000006000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x47, 0xd, &(0x7f0000000000)="0000bfffffffa000edc037530304ed5c4476777e614107004eda646a521a527c1ac6dd6d80adf9d7a3cc635d4f4f177b0b06965629f9436fa403e3e9769e12940253709c1fbada", &(0x7f0000000180)=""/13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.275027092s ago: executing program 1 (id=4303): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x400, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x4890) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r2, 0x4058587a, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r4, 0x0, 0x48a, &(0x7f0000000700)={0x7fff, 0x0, 0x2}, 0xc) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) recvmmsg(r3, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x40000000000018c, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000007c0000007c00000002000000000000000000000e0000000000000000000000000600000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80c20000000000000000000000900000000000000000000000900000200000000000000000902"], 0x0, 0x96}, 0x28) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x700}, 0x10}, 0x94) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) unshare(0x28000600) close(0x3) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x288840, 0x0) connect$unix(r8, 0x0, 0x0) 1.27345173s ago: executing program 3 (id=4304): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x9d741df904aad753, 0x0, 0x0, {{@in6=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@local, 0x0, 0x6c}, @in6=@rand_addr=' \x01\x00', {}, {}, {}, 0x0, 0x0, 0xa, 0x2}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 1.171828605s ago: executing program 0 (id=4305): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_genetlink_get_family_id$tipc(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x30, r0, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x14, 0x18, {0x7, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}}, 0x24008820) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x10000800, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000400)=[@sack_perm, @mss={0x2, 0x9}, @sack_perm], 0x3) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb9b19052bdd50caa}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_ECN={0x8, 0x6, 0x1}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f0000000480)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a48010000060a0b04000000000000000002000000300004802c0001800b0001006e756d67656e00001c0002800800034000000001080001400000000a08000240000000000900010073797a30000000000900020073797a3200000000eb0007"], 0x170}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000440)={0x0, 0x1, 0x6, r3, 0x1}, 0xc) r6 = accept$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@private1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@initdev}}, &(0x7f0000000200)=0xe8) sendmsg$nl_generic(r5, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000002000010025c77000fcdbdf25601800000800a500", @ANYRES32=r7], 0x1c}, 0x1, 0x0, 0x0, 0x20000851}, 0x24040004) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(r6, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x2c, r8, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x40}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8811}, 0x3000c804) r9 = socket(0x400000000010, 0x3, 0x0) r10 = accept$unix(r9, &(0x7f00000004c0), &(0x7f0000000540)=0x6e) sendto(r10, &(0x7f0000000580)="fcad5aacdb3cefe0956805a951b4a68e79a1", 0x12, 0x40080, &(0x7f0000000600)=@l2tp6={0xa, 0x0, 0xd36, @mcast2, 0x6, 0x4}, 0x80) sendmsg$nl_route_sched(r9, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd22, 0x6000000, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x7, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) 1.170740685s ago: executing program 2 (id=4306): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe0, 0x2}, {0xfff2, 0x10}, {0xd, 0x1a}}, [@TCA_RATE={0x6, 0x5, {0xb0}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffe, 0xffffffffffffffff, 0x4}, 0x38) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r1) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r2 = socket(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x10, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000ff0300000000000008000000b7080000000000007b8af8ff00000000b7080000050000007b8af0ff00000000bfa10000ffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a5"], 0x0, 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000500)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d00108025b57efaa223b473fe7783bc4a506cf756740574b89d316af9b5963870ef3391f3ac176f88d6e1db9b2bb2e5c90fa4eb2f71ebaede447dc8f6f61c6615fcf740adda4853b2d23adb370000001e0106"], 0x184}}, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) ioctl$SIOCSIFHWADDR(r1, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0xb3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}]}], {0x14}}, 0xcc}}, 0x24000000) (fail_nth: 4) 1.144443568s ago: executing program 3 (id=4307): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r0) (async) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x4000042, 0x82, 0x1}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r3, &(0x7f0000000500)={&(0x7f0000000000)=@id={0x1e, 0x3, 0x2, {0x4e21, 0x2}}, 0x10, 0x0}, 0x80) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYRES8=r0, @ANYRES16=r1, @ANYRES32=r1], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x4040090) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) r5 = socket$kcm(0x29, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) (async) r7 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r7, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) (async) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000040)={r7, r6}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r10 = socket$kcm(0x29, 0x5, 0x0) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r11, &(0x7f0000000000), 0xffffff6a) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r9) (async) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000b4f0eb6cf772000000000000000600000c850000006100000085000000070000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r12, 0x0, 0x6, 0x8, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendfile(r10, r11, 0x0, 0xffffffff000) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYRESDEC=r4, @ANYRES16=r13, @ANYBLOB="7961fdffffff0004000000000000000099006c910000e02425a0af74e42b92d4c3b9adf5bfc424a4484b7b9ce94379d9edc4229361d1c68a489b6c9b349923dd4979a8cd2d50803d4a17fd197be907317cc24664b3fa328d7c5359c8037e1e9dc55703cd4c0e83cd20bc50285d697570b3828de9c44e6886c73ff36721fc1db017c42ac6b892ac1d"], 0x20}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) (async) sendmsg$NL80211_CMD_RELOAD_REGDB(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r13, 0x20, 0x70bd2d, 0x25dddbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) (async) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) socket$kcm(0x29, 0x5, 0x0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x2}) 1.040442576s ago: executing program 3 (id=4308): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000740)={0xffffffffffffffff, &(0x7f0000000640)='\x00', 0x8000, &(0x7f0000000680)={@align=0x4, {0x2, 0x87a8, 0xe, 0xeb7}}, 0x3, &(0x7f00000006c0), &(0x7f0000000700)=0x10}) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000780)={{0xffffffffffffffff, &(0x7f0000000080)='\x00', 0x4c000, &(0x7f00000000c0)={@_ha_fsid={[0x9, 0xa27]}, {0x1, 0x3, 0x7, 0x60070080}}, 0x80000001, &(0x7f0000000100)={@_ha_fsid}, &(0x7f00000001c0)=0x7ff}, 0x80000000000012c, &(0x7f00000003c0)=[{0x2, 0x7, &(0x7f0000000200)='GPL\x00', &(0x7f0000000240)="98f3191b0e26f80b102efc314deac41b3800f105bfbe356272edb5510ca74ca1a91c63f629e6cc066c6ba227819e2b23d4000cdc15f221e7d80c751e14f1a76fa8531c18f35e11b747c5087b326455672f11a1a969158ef5a9b3588b001ba05dbc", 0x61}, {0x3, 0x9, &(0x7f0000000500)='GPL\x00\x1e\xb0\x9a,\xcab\xda\xc8\xb5-\"`\x8f_)8\xd3+\xe3\xa8\xa8\x14N\x9c$\xbb\x19\x12\x9e\x11\x8a\xa8rKi\xe6\xa6\x12\x9d\x17\x14\b\x8c\x91\xee\x91\x8d5W\xe4\xb5\xaa\\\xde\x17?R\x1f\xf0\xf35\x97\x11\x16\xe4$\xf8\xcd\n\xf2\xb6\x8bi\xf7\xc6\xd2\xece;C\xfac\x95\x06z4_\xde6>PcD\x8fN\x0e\xfa\x02~\xf3\'+\x87\xcck\x9a\x186\xd1k\xdf', &(0x7f0000000400)="c047179905b07beac08a5fa0bc363bd49d73887e7de380dbf9c046604299c500c122eafca064c57dc27d8dc5c6053b8d", 0x30, 0x4}]}) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000480)=0x1, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) setsockopt$MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000100)={{0xa, 0x4e21, 0xee37, @empty, 0xab2}, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x7}, 0x1, {[0x9, 0x3, 0x400000, 0x1, 0x6, 0xb56, 0x401]}}, 0x5c) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x50, &(0x7f0000000100), 0x48) unshare(0x20040600) unshare(0xa020480) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000ed0759cb47cd90df41fa7a40c72a22dcc53a83731c39b01fceb7"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000000c0)={0x0, 0x3}, 0x8}, 0x94) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r5, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001200)=[{}], 0x8, 0x0, 0x0, 0x0, 0x37, 0x0, 0x8, 0x0, 0x0}}, 0x10) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$inet_pktinfo(r6, 0x0, 0x8, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2000}) r7 = socket$kcm(0x2, 0xa, 0x2) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCOUTQNSD(r8, 0x894b, &(0x7f00000004c0)) socketpair$unix(0x1, 0x1, 0x0, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), r9) sendmsg$IEEE802154_ADD_IFACE(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000000000220000000a0001007770616e3000000005002000000004000500200000000000050020000000000009001f"], 0x44}, 0x1, 0x0, 0x0, 0x4044880}, 0x40040) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="680000000206010300000000000000000500000a12000300686173683a6e65742c706f727400000016000300686173683a6e65742c706f72742c6e6574000000050005000200000005000400000000578dfeec0388dc15c3000c00078005001400040000000c000780060004404e230000"], 0x68}, 0x1, 0x0, 0x0, 0x20044040}, 0x40800) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="0000888eaaaae500000000fc2f9078ac1e0001e000000180008100000c907841400000"], 0x32) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000580)=@generic={&(0x7f0000000340)='./file0\x00', 0x0, 0x10}, 0x18) syz_emit_ethernet(0x4e, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004b0000400000000000059078ac1414000a010100441405030000000000000000ffffffff00000000890200000000c40077e62bda7189d21034960e259d1c93", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c20fff790780000"], 0x0) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000000000000000000008500000022000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000040)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r11, 0x0, 0xe, 0x0, &(0x7f0000000000)="00000000000000000000512288fb", 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x50) 979.992791ms ago: executing program 0 (id=4309): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0xf98, @local, 0x10000}}, 0x5, 0x8, 0x6, 0x8, 0x90, 0x3, 0x1}, &(0x7f00000000c0)=0x9c) ioctl$XFS_IOC_FSCOUNTS(r0, 0x80205871, &(0x7f0000000100)) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x3d, 0x10, 0x70bd25, 0x25dfdbfe, {0x12}, [@typed={0x14, 0x12c, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @typed={0x8, 0x17, 0x0, 0x0, @fd=r0}]}, 0x30}, 0x1, 0x0, 0x0, 0x48840}, 0x400d0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r2) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x64, r3, 0x100, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x985}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xd}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x39}], @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x8008}, 0x0) r4 = accept$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r4, 0xc0709411, &(0x7f00000003c0)={{0x0, 0x3, 0x1, 0x1, 0xba, 0xffffffffffffffff, 0x7, 0xd4ae8a9, 0x6, 0x6, 0x9, 0xff, 0x1, 0xe, 0x8001}, 0x40, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000480), 0x49c200, 0x0) ioctl$PPPIOCBRIDGECHAN(r5, 0x40047435, &(0x7f00000004c0)=0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000540)=0x0, &(0x7f0000000580)=0x4) sendmsg$nl_route(r6, &(0x7f0000000680)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)=@mpls_delroute={0x50, 0x19, 0x2, 0x70bd2a, 0x25dfdbfd, {0x1c, 0x20, 0x80, 0x0, 0x0, 0x0, 0xc8, 0x2}, [@RTA_DST={0x8, 0x1, {0x1}}, @RTA_DST={0x8, 0x1, {0x6, 0x0, 0x1}}, @RTA_VIA={0x14, 0x12, {0x2, "504347bf66b3d13d6ce02294274b"}}, @RTA_OIF={0x8, 0x4, r7}, @RTA_DST={0x8, 0x1, {0x7f}}]}, 0x50}}, 0x20040040) close(r2) sendmsg$NL80211_CMD_GET_SURVEY(r4, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, r3, 0x400, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x898) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000007c0)={r1, 0xb}, 0x8) ioctl$PPPIOCGNPMODE(r5, 0xc008744c, &(0x7f0000000800)={0x2b}) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000880), r2) sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000a00)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x600000}, 0xc, &(0x7f00000009c0)={&(0x7f00000008c0)={0xd8, r8, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x7408f7e699683259, 0x1e}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x200}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fffffff}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfff7}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x35}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x20040804}, 0x40) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r9, 0x84, 0x13, &(0x7f0000000a40)={r1, 0x7}, &(0x7f0000000a80)=0x8) sendmsg$sock(r6, &(0x7f0000000dc0)={&(0x7f0000000ac0)=@llc={0x1a, 0x337, 0x3, 0x4, 0x5, 0x39, @local}, 0x80, &(0x7f0000000d80)=[{&(0x7f0000000b40)="99e0e7e3dc6729eae8d8f87ef72e9ca99fc07db5ebaed1e7ffded33fc5d9c1d91a6823f7940e432a6fb65f89f2262acfde2de7b53c95b1161af8fc3a47225310e988e493c51e1d00e2d3315565a96e5eee86d0d6edab7f272c64b09b44b34f90bd611658f450a4dd316965b62fcef1b36973fd6faa96b6cad9746da2400cd62573d5713f22e86325d3705ec42d4b7602284b295beeaa81", 0x97}, {&(0x7f0000000c00)="93ba7f1804f8d98430e3d893d13c01c9fc6da5e6c36a9d1aa65ceed159f966a9198fd6ecf97fc662053037c36a877f8f68c407d452b97f3fb1ea1c271c", 0x3d}, {&(0x7f0000000c40)="81502ff72270687f510e6e1a14531b1b0c201dca28c8e1a4e9cbc452dc23428709af2dfb53ff6c81ddca97e10458c099cf5297b92652b75e455d8772c58d19ba38ee3abd4997d888a9d3b89b69cf6d8a06147c29e0d0c1559c1afd0a3bfb27c7df69a15afc6aeab0ab0f0062932b8073b64d3a531cfdd0e366", 0x79}, {&(0x7f0000000cc0)="c656dc2292a7882fb3b6f067d2e88c5f297b179672f6d82aeedd4a4febc398b7228ec2b9bf2f8ca7875d4620891c3ad11a0d2f0b3aa23028289343b23ce8c9b8d06b3440286a57c4d2fd0f2625be53e192560493814cc9460573c3ae3657a5d4b6cd092ba0a9cd197fa2f8a7228b6160c3a57550c27b876f7af265219d03f096560ca4d6a1579549ed2e4efc83", 0x8d}], 0x4}, 0x1) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000e00)={0xffffffffffffffff}) sendmsg$TCPDIAG_GETSOCK(r10, &(0x7f0000000f80)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000f40)={&(0x7f0000000ec0)={0x4c, 0x12, 0x400, 0x70bd27, 0x25dfdbfd, {0x9, 0x2, 0x3, 0xfb, {0x4e24, 0x4e20, [0x1, 0x3, 0xfff, 0x8], [0x1000, 0xb, 0x7, 0x3], 0x0, [0x6, 0x2]}, 0x8, 0x5}}, 0x4c}, 0x1, 0x0, 0x0, 0x41}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000fc0), 0x8400, 0x0) ioctl$TUNATTACHFILTER(r11, 0x401054d5, &(0x7f0000001040)={0x8, &(0x7f0000001000)=[{0xfff8, 0x8, 0x2, 0x8}, {0x7, 0x7, 0xfb, 0x1de}, {0x1, 0x83, 0xc, 0x1}, {0x7, 0x2, 0x0, 0x8}, {0x4, 0x3, 0x6, 0x2}, {0x1, 0x3, 0x5, 0x5}, {0x8, 0x6, 0x4, 0x5ce}, {0x40, 0x5, 0x6, 0xb2344d7d}]}) r12 = syz_genetlink_get_family_id$tipc(&(0x7f00000010c0), r10) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000001180)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001140)={&(0x7f0000001100)={0x34, r12, 0x800, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x18, 0x17, {0xb, 0x0, @l2={'eth', 0x3a, 'rose0\x00'}}}}, ["", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) sendmsg$NFNL_MSG_CTHELPER_GET(r10, &(0x7f0000001280)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001240)={&(0x7f0000001200)={0x24, 0x1, 0x9, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x7}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4000091) 763.748923ms ago: executing program 2 (id=4310): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0xf69, 0x0, 0x2, 0x2, 0x1}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000fcdbdf2512000000180001801400020076657468300000000000000008000000080009"], 0x3c}, 0x1, 0x0, 0x0, 0x400c000}, 0x2004c0a0) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414003400080004"], 0x2c}}, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff61a4f0ff000000002d040000000000003d400300000000006504000001ed000079130000000000006c440000000000007a0ab0fe000000007b13d00000000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af05000000f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a715bc5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128c4e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e655400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d0800af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d390dd65be2467b373eafd9aa58f2077184b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c5da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b93d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6ffc3a15d96c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7cd86975023cb08cc7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c5538a294270a1ad10c80fef7c24c87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead35a655e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f05beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba5823a34a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d0a874c74b777df005c55fc30511d00000000c85265b2bd83d64a532869d708000000000000007baa5b6a682b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a56edbd287eba77f35c35d91f3c62a0ca74836a640224de85f2b4a5fee500bbc584328a6a7a4628c4378c9b71dff64075b74a6520adb187b40d2cccbcb08c0634ee74658d3e23bf511c8b0bf1b69d2b3782b3f481c314e7bd4615dbbf24c06ac95bd639e68d0e6aa7f0d07bf69a93365f803f0144af37236ea133c2255b0613bf8ba1d538e06c2411e8d70053b712084fd0e313de9bb19266e49a3a2190cb039c6f89610acd896319b9c8d1b8aac2eaa5a4f8be7419a09e3fb5be3be2fcdadd2299839cc40e684e6e2b4e1385fde7a0babcb0be672110268a34dad364fddee69e564119cebb6940c6356ff83ca527c573d700000000000000c6299263e6d9097f225de969485bce3d7dc471c0669bb6a467cf0de54dfcc1857048fe22a19dbb1b3cb9babaa839f1f6e817a62d95a5b971ff96a5c66c338c6f2a2da4644519f40761402e9c81013d76c7152c95ba5efa24ce1930f23a2277f057ffb6b0144f3b434a2adc456ef4d2fbdf7c6238c2bb00ffcf2d23d68cb9b027f3b225ec4e09b089f7956b66c5692b46ea03abb6a404c8ccceaa4ba4161409fcb54b86eaca26b2a0c4b81f7b71cbfcef"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 630.055355ms ago: executing program 0 (id=4311): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x60000000000000}, @NFTA_SET_ELEM_KEY={0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x79, 0x11, 0xc8}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x70) 531.438933ms ago: executing program 3 (id=4312): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x2, &(0x7f0000000200)=[{&(0x7f00000000c0)="1400000035000b63d25a80648c2594f90324fc60", 0x38}], 0x1}, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4820, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r3 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r3, &(0x7f0000000180)={0x2, 0x0, @broadcast, 0x2}, 0x10) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r5) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r5) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r8, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000400)="606f3af9", 0x4}], 0x1, &(0x7f0000000a80)=ANY=[@ANYBLOB="480000000000000029000000370000002b0500000000000007280000000308480400030000000000000008000000000000000104000000000000080000000000000004010300000014000000000000002900000043000000080000000000000050"], 0xb0}}], 0x1, 0x4000801) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x2c, &(0x7f00000001c0)=[@in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e24, 0x40, @loopback, 0xa7}]}, &(0x7f0000000500)=0x10) shutdown(r8, 0x1) getsockopt$bt_hci(r8, 0x84, 0x6c, &(0x7f0000003140)=""/4095, &(0x7f0000000000)=0xfff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000005c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r5, &(0x7f0000000680)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x28, r7, 0x200, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x1, 0x1d}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x200080c5}, 0x20000004) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000240)={0x0, 0x300, &(0x7f00000001c0)={&(0x7f0000000000)={0x40, r6, 0x7, 0x2, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x4060850}, 0x400d4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r0, 0x0, 0x0}, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r12, @ANYBLOB="0c000280060012"], 0x24}}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x30001148}, 0xc, &(0x7f0000000540)={&(0x7f0000000b00)={0x1f4, r6, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x88, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0xc}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7c8dad273ffabc41}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7db98a29b044d846}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0xbc, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x4}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0xffffffffffffff9c, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8}]}]}, @ETHTOOL_A_STRSET_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x28, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x38, 0x2, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x40}, 0x84) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xd, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0x8, 0xfff8, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 490.321669ms ago: executing program 2 (id=4313): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@ipv6_getaddrlabel={0x1c, 0x4a, 0x1, 0x70bd2a}, 0x1c}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000200)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r4}, &(0x7f0000000180)=0x20000, &(0x7f00000001c0)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r4}, &(0x7f0000000500)=0x2000000, &(0x7f0000000540)=r3}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r4, &(0x7f0000000100)="d0af02", &(0x7f0000000180)=""/238}, 0x20) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000206010200000000000000000a0000050e0003006269746d61703a697000000005000400020000000900020073797a30000000001c0007800c00038008000100e00000010900018008000140640100fe05000500020000000500010006"], 0x64}}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x10, 0x3}]}}]}, 0x38}}, 0x20000010) 473.562875ms ago: executing program 3 (id=4314): bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000}, {{}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8, 0x9, 0x20}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="03800000000000001c0012800b00010067726574617000000c00028008000100", @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x7fff, '\x00', r2, 0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="3800000048009d0300000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="00000000080002000000000014000100ff"], 0x38}}, 0x0) 416.206128ms ago: executing program 4 (id=4315): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0xc) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket(0x848000000015, 0x805, 0x0) write(r1, &(0x7f0000000240)="14000000140005b7ffccca38b9000000060860eb", 0x14) r2 = socket(0x1d, 0x4, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r9, &(0x7f0000000080)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r12 = socket(0x400000000010, 0x3, 0x0) r13 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, 0x0, 0x4000) sendmsg$nl_route_sched(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001e80)=@newtfilter={0x119c, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r14, {0x0, 0x2}, {0x0, 0x10}, {0x7, 0x10}}, [@filter_kind_options=@f_matchall={{0xd}, {0x1168, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_ACT={0x270, 0x2, [@m_ct={0x84, 0xe, 0x0, 0x0, {{0x7}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CT_NAT_IPV6_MAX={0x14, 0xc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_CT_LABELS_MASK={0x14, 0x8, "0b5b7ce397ef4137bf8341a04a63cb2c"}]}, {0x31, 0x6, "a7075697340c8a7eef13f32549fc9fa8d1ad29bde7ab96de6ba3d5f980fed190345b6dede70749daa3ed5b58fa"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_simple={0x5c, 0xe, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0xda9f, 0x8, 0x4, 0x36, 0x7}}]}, {0x15, 0x6, "d6f8d945fb6e64b9fcc373f4996c2f3f97"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_connmark={0x60, 0x2, 0x0, 0x0, {{0xd}, {0x4}, {0x2e, 0x6, "4ae8e5ca1b8c12792598a40b3a995105cdd7155ccbbceb0fd3da358d5e347beb9f7c63193a22b7e74191"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0x12c, 0x17, 0x0, 0x0, {{0xd}, {0xc8, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x5, 0x10000000, 0x7ff, 0x5}, 0x1}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0x4, 0x40000001, 0xf8f5, 0x6c72}, 0xf7}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffff, 0x7, 0x2, 0x0, 0x9}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2c, 0x8, 0x3, 0x3a00, 0x755d096e}, 0x8}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfdfd0864, 0x5, 0x6, 0x8, 0x1}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xdf4f, 0x40010000, 0x3, 0x7, 0xd}, 0x8}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0x5, 0x3, 0x1407, 0xfff}, 0x5}}]}, {0x38, 0x6, "403ff6b1f7514498d71238b913518ab5c9911fbb2a178c9a7f8c5eb1c2ed0f1913f84a067434cc5b0c87397380a4ce5b92b44e36"}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}, @TCA_MATCHALL_ACT={0xee4, 0x2, [@m_mpls={0xa90, 0x4, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_MPLS_PROTO={0x6, 0x4, 0x8100}, @TCA_MPLS_PROTO={0x6, 0x4, 0x4305}, @TCA_MPLS_TC={0x5, 0x6, 0x4}]}, {0xa4c, 0x6, "e8d4fbe45fbe25d09365988c74422d17e41dc4f2dd6c153f04c532202e9c1131cb30d2382a13f01c39b199f1f58daf08764969c4053cb4eb54526d50aac6b1a690434962331ad1a4794ec4457e1cb0ab9b581dbe3ca0606080096dd554f8c0c5a4137aabba0af40f177a26d2e47d56e2799c99cff42642035d7350b19fac35830568e6e8816f052eeddcf569ff04a2ca070660a876e576db362d24d9c4c7df2f1d09f65d6faf500ab1ea5bd8aa65aae21d0724f0ac745f29d3127dcca7e4df0f1cb9f8d89325c85e03d3c8711b92130d7609ea9d70d25d2b4ff05e0bbf0e77cd50af56f5656f8af3401a33da3d78bf59a8c795a21af07297ac7ca7bf6e97d4a26e6f435f3e627aa484458004c889345414c57b3d8a3c9d55ce3d088c4674b61e66229353dceec4821bff86d3d0b97b2f34f17b64d1edd587f5d71caf2a104446dc0800f0ff7d27f95c7f0da7816f2f30a0aaf3e2db6a58c787764741323533d24610d4b236f6acf9c50d348c6cc209596ee7bb15933e56e0bef12bf5c35e5c5628bd25aeb263e84666bdef637fd4ec757ab75f372d1a461767a7f046f3b4cd33eac33177351064033ae8ef11e8dddad87a247d2a2acabbd744246b00a706f75e3053b4098423f22e012a0638453a6c0956b2f6db74381eff0692d85b05e25a9e2eece2de92c16dc8bed909cba40ee10f62df1c9c7e3335781174c41066ee53807802da6b953b75aa15ae6f2543e53c57ce2397f85546a0dcac75434ad1f85ea2eccc1423ad7ffcb92e1d2076c5ca1ddefaed454f69d793d8e5a52574d7d7e0444aaea6d3aec072943f8d0389eb4047efee8061dbf1dba27886b5ad6669e8e018049b8e52a1013aec2d1f03bc84604d18f00b02b21f4c35b1bff72e62287ef3d4894020e629835a909158e221827267d39f91822aea674f3d99d40e992a307b7db8c3199251febfc0662bec6e62a460698c07826d189571e50ca8bd440aa9a37fecf5cf37351fdad2526af6507dfee871faca22a82fc7274fa152dba6e57abe72723c9b784b7a670cdcfcfbd75fa8ac62a48f9558c3099da4f5e3b3ce92833eff18583d8c4bce3ee7626d4d6f7511d170879df387e0f56548bc927a160923f45810c7fb2a1d1da5a4b074e65fdce406d5acd66984f60baa4baa8c28df853c986d8e51e3abbff3cbd4f2198062ec9731880bdf50c0c420581f11e74c7120bfe2b55f31dfa03d6c7f26be07b975ef9d3cf5dd80d9188f3e56082a35ac49303a7eb33a835fdfa0e3cf50b145cbfe1ba3ae27c505a5f1d3fe0b4f67ad070d31c6b943dba08181a81161acbca77b8f095a611b27aba6f5fcaac64636ae6c1fa49677a77961bab963c58f36f340342a0613021166a70a62758b0098c47e60baafda54112e2078d50c180e8e0d91b55b7ad2ef3829d174c8929192ceb4cc43ef8b2cdc9625d506ca69270cd78ce5f59cac6d5cb9239583685707a6820bcd6df4756c6f02c43ba677aad2236673c3cbc051762d4b0b07a370633c1dac3688d0ec41378234c28eb4fc4663d36925b357cdee674bfa4cabed61def46bdc49b729e7514017a98be64be6fc39cb6dcd800c90565c17b1d9f72a35e6de482c9b02518b6d4e4029c2f2a387978bf885254aac71144d1979a180d2c8b734bcb5f6d6b9a3d6fce8f9d56cd954b245934bdd6b37f34d78b6a8c33d7b735c4a8ae861690de578ea7365b7b5fe48f63796f366396af17ff1ae67b27c13d90599764e2d21a35ca8fae88c52868d34e6d01b91f0a69fe22c16adf4a3b04a633d5b55a7621c2bdf8bf54fa8fc4364c5c75252f8f9a03ba694ec95689ea8431f60da0d197f4929ff464fec48aef3cdb88731daf9ed021eeaf25edd6acce6e4d63fd222c5b84f69b03a0fe89f88a67feeebca48faa8325f2f95ee9927c457e67806e307c94cd981ea512d6664528a3738301ddcce4996279ef822b19f467e6d2cdb618288ff489716b44bb52778d42147538c82f8a181612e6f7323ecff2c779a9242d7a2114e2a32aeacbaa7ca852b91bc8208aece7638a63a0785f3d9252d9d750a64a4332adc58b22f2e15daa3deb9dfdc7048ef1bdffd83b5e051e690ce8d874d40c12813839b2bfea5e9eb115cb4bdd4e92794f81fbf005721ae92f8786032f21f833ff8b3d1a9e65a89942531f3759e08124edeab343aec117754a339616f8d9888a666c0df3c0b930fc95961a6e4f010005ab3743013486053efb955434487c99e774dbccdc547700c8a45bcf0ef4d6030576eaae4832a481271fc6f12807d98fdc7ec22eb5c7185bffccb224f9f12ba94ae42752e57ade68afad6f28e40d79fe79cb68b9c0b672575dbedf618feffc8f54bcb08e88ce297c02e1b4585847138b981716ea365f2a8e57bb328bdfe66acfd55691c1899f9a60752b7e70a86285f5166f85d89e752b110da240b29d74077322540bb33b5c9e1070d04d8c59828080b4a41a64d4bc3dea2438a1766197fd2660cd58497e844774669bdda13e9798ae0fd4d9bf6bbe850f71a6b4c2ba6c63dfcee77eb0049608e1dc710988e3d00876a7b5cc3241fad52c82c52eb30990681ffc211583fd1eb73458bdd33663f5b3e3e21fd101d2afcd5b3da7ded3c136019b9451730e9e3723b14bdd5a9fa4c45f5c24c824e36dad3d34555d6c23764d276929d0392b6d7f2d923673fea832aad2c3addd841bb7d44f5957dc78e7abf1ad08deabaa17efbe8d2f25cbfc435ea21c58145b57c43f874821f67ae09304fcd6ce1ebe0a00391ff196c3d612b2ea0052ff9d6d7536d46005df9928af0172862f6a8e88d9755ac99f1f88e4751e78b59c8777bbd566f7e6af159dc2e4b2c511a21aa8dac6f16c06fb0ddceba24aaa8f021e4b536073244a3ec42cb954f9696f128595636f4d6fe40dc291d4709c1350b6b7026cbcf9e30787668c1a5c9786aad4977865b5a46d9fffe3959fbe0727ed9c7aa1245ac833e76d45f57e792f03b2983d23641bc11744caa68ab53dd202e32e359b2f8e8d9cf3dfcd039efc81f99555743a0f8b68823eb4a27e88f3831c5fd5a1df95ee2cfc26b01a37dc9e6ce733aad86ed52085504de98e54ed30bd30289b847daa78766c56cf55c3719b0b4834a511cefef9aff6e4187f41bd6c08aaee8ca34cd0eccfc7416be15375fb1cb415a9ade3b4b05ab1b2c8a58cf841930eec84a925f732aa2bdd10fcce5855f50e7534f134283a6e252152b1f7521b3d09d8ad3a21bfc4fd50869542b91f677221054ee774ed14fa12ceaab3ffab2a0d6bef5438e51b3c0dc28af50b74e2971e002ad3e91b0e1fe8467117f836c996b62a073b994b82ca8a60ab7a141c37161faf25140d47f97dd95c8b6bc3d1c31fb7b6ac6098120d23878fac443c4d4f87e84e66c2fd2d09df9323a5d5bc3e0d27d051f20bfd3a0641cd53575b4777ad4bfd13846fd1d2e519eb4ba36b08d80b030262ab278ce83fe6f3351da9272623b0f1e331b43fd5e0a906bd90180b231e113fcf9780d9d9e3d2674d24186ddcadd0e255c257b683760c4a4ef4e3a265521e2db786d9578b67d0783ef10c1081f5effd84bbf55354c01f2268b8fc46b8caaba4a71acd494c9bfc79e57d43592ce7f52039d096bbf83bcffe1d522d6918dbd251828404dc44fa13e95a18ae43dc9eacac839b49e2b1ce8096d7519a7dffe9f10fc3aca24b94e07517def596b5bb2b8c6bc7cc11d47"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ctinfo={0x58, 0x1f, 0x0, 0x0, {{0xb}, {0x4}, {0x2a, 0x6, "431dc1b6cc9f717811f17633e5ab3c0ba1493d3a991550283157065bdc025fddd9dfafd67bc7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ctinfo={0xac, 0x15, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x8}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x4}]}, {0x68, 0x6, "662da470aaeca983c8b8773502d0f0f139ea0152876c3236dda4a375a5617d97ac9fd939a9466550a03f6fed7f7eb0cc24bfeadd55bb95373a809e1b9b54e8df5a68f95e3deefb613bb7ce5b3cbbcf7241beaa3b50db698075a4ea59467e46056d855254"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_ctinfo={0xe4, 0x20, 0x0, 0x0, {{0xb}, {0x4}, {0xb8, 0x6, "50f82238c250f8cf7c3d80a58af478a308abf27e0f55dcbcf3fc098b57b43e61e4b232808e176245977340f1ee4fe5af853370d257324bc4d10aee6d45604338c6e23e2f6f732dc9e1c97f5f00bd389ea9446ba4d854d0566e7c9b21ebf5ca38d84b7e49db1cc88894f441117e916ea3a5ad98a28f25de39e2c9268bd0f6b194c42273a8715aeb38490cc1dd9d411fc5fb14eed4f3ded016c99380ac46f2379a9aba0581c3a103eb41d082492877efa22d94a23a"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_tunnel_key={0xec, 0x1d, 0x0, 0x0, {{0xf}, {0x14, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}, @TCA_TUNNEL_KEY_NO_CSUM={0x5}]}, {0xa9, 0x6, "7a5205bbca3eea54750e56337ce98d5172976e6c8545bc31def6694b67eb59748b82968e4efd47cd9379ee27f631caaa666a53e91c18f7f58159fe812ff0af7288aa96f2100b8aadfa12f14082698d76d7b2842790416d68c804e1c08f2e5e9362908bee5e245d19b981e5c1dfb9d50cfcbd81b1966dbb26ef1867fd996cb36183a64f3fb05d5e46bbb3ecc72b8df7a41fec0e965892c4269818b22d866f306e2fd83ac4bf"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_nat={0x84, 0x19, 0x0, 0x0, {{0x8}, {0x4}, {0x5a, 0x6, "d07ae0299f73e3779bf498142d73f127d08fa389a3153914e8733202fe8875a893b71e7b29a648edc77daa039d49f4c0ca71280a33133ffe3b5e32e8d1d3f28604dc08f5d41075dee3c7d363e3000000000000000000"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_simple={0x5c, 0xd, 0x0, 0x0, {{0xb}, {0x30, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0xc3, 0x200, 0x0, 0x9, 0x81}}, @TCA_DEF_DATA={0x11, 0x3, 'NLBL_CIPSOv4\x00'}]}, {0x4}, {0xc}, {0xc}}}, @m_skbmod={0x9c, 0xb, 0x0, 0x0, {{0xb}, {0x70, 0x2, 0x0, 0x1, [@TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x4}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x0, 0x2, 0x3, 0x80000000, 0x5}, 0x10}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @TCA_SKBMOD_SMAC={0xa, 0x4, @remote}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x6}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x4}, @TCA_SKBMOD_DMAC={0xa, 0x3, @random="b36692d5b092"}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x119c}, 0x1, 0x0, 0x0, 0x24000850}, 0x20084084) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000130001000400"/20, @ANYRES32=0x0, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) r15 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r15, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x7, 0x5d8, 0x5, 0x6, 0x0, 0x800, 0x800000}, 0x1c) 402.333194ms ago: executing program 0 (id=4316): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a010800000000000000000200000908000240000000030900010073797a310000000014000000110001"], 0x50}, 0x1, 0x0, 0x0, 0x24000144}, 0x2000) (async, rerun: 32) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0xffffffff, 0xe, 0x0, &(0x7f00000000c0)="05004013ffffffffa000c4353512", 0x0, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000140)=r1, 0x4) close(r0) 266.95248ms ago: executing program 3 (id=4317): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400}) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'rose0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000011000100000002000006000000000000", @ANYRES32=r3], 0x20}}, 0x4000) 266.126921ms ago: executing program 2 (id=4318): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0) sendmsg$DEVLINK_CMD_SB_POOL_GET(r3, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x40, r4, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x3}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000040}, 0x8081) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='pids.current\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000000), 0xffffff6a) r6 = socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$MRT_DEL_VIF(r5, 0x0, 0xcb, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xe0}}, 0x0) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_MSG_GETCHAIN(r7, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="20000000040a010100000000000000000a0000010900030073797a320000000083df0a63f183422e4215036c08a6377775327d731a22565a505990290b084f38d7af564b530c79f51a3b1c74ad86292d882c"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) socket$tipc(0x1e, 0x2, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) sendfile(r0, r5, 0x0, 0x20000000002) 239.22001ms ago: executing program 1 (id=4319): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r0, 0x0, 0x64, 0x4008084, &(0x7f0000000140)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1f, 0x1a0, 0x0, 0x1000, 0x0, 0x1}, 0x50) r1 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x4c, 0x2c, 0xd09, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa, 0x7}, {}, {0x1c, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}, @TCA_FLOWER_KEY_SCTP_SRC={0x6}]}}]}, 0x4c}}, 0x24004000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) accept4(r4, 0x0, 0x0, 0x0) unshare(0x22020600) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000400)={&(0x7f000000c300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELSETELEM={0x14, 0xe, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8}}, @NFT_MSG_NEWFLOWTABLE={0x60, 0x16, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'netdevsim0\x00'}]}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x9c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfa, {0x0, 0x0, 0x0, r9, {0xfff2, 0x2}, {0x5, 0x1}, {0x7, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0x40, 0xf9}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000850}, 0x200c4810) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r10, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="02ffffffffff"}) socket$inet_tcp(0x2, 0x1, 0x0) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) 0s ago: executing program 4 (id=4320): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe0, 0x2}, {0xfff2, 0x10}, {0xd, 0x1a}}, [@TCA_RATE={0x6, 0x5, {0xb0}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffe, 0xffffffffffffffff, 0x4}, 0x38) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000580)="580000001400192340834b80040d8c560a067fbc45ff810500000000070058000b480400945f640094272d7061d328b92d0000000000008000f0fffeffe809000000fff5dd00000010000100030808004149004001040800", 0x58}], 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r2) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r3 = socket(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x10, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000ff0300000000000008000000b7080000000000007b8af8ff00000000b7080000050000007b8af0ff00000000bfa10000ffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a5"], 0x0, 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000500)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d00108025b57efaa223b473fe7783bc4a506cf756740574b89d316af9b5963870ef3391f3ac176f88d6e1db9b2bb2e5c90fa4eb2f71ebaede447dc8f6f61c6615fcf740adda4853b2d23adb370000001e0106"], 0x184}}, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) ioctl$SIOCSIFHWADDR(r2, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0xb3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}]}], {0x14}}, 0xcc}}, 0x24000000) kernel console output (not intermixed with test programs): : 24 bytes leftover after parsing attributes in process `syz.3.3116'. [ 436.340149][T18594] netlink: 252 bytes leftover after parsing attributes in process `syz.3.3116'. [ 436.350064][T18598] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3117'. [ 436.367014][T18357] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 436.485460][T18357] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 436.566671][T18602] syzkaller0: entered promiscuous mode [ 436.582202][T18602] syzkaller0: entered allmulticast mode [ 436.728173][T18357] team0: Port device team_slave_0 added [ 436.907929][T18612] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3119'. [ 436.944341][T18612] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3119'. [ 436.965680][T18357] team0: Port device team_slave_1 added [ 437.194697][T17388] hsr_slave_0: left promiscuous mode [ 437.213517][T17388] hsr_slave_1: left promiscuous mode [ 437.507620][T17388] team0 (unregistering): Port device team_slave_1 removed [ 437.527451][T17388] team0 (unregistering): Port device team_slave_0 removed [ 437.727378][T18605] lo speed is unknown, defaulting to 1000 [ 437.728823][T18357] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 437.740834][T18357] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 437.767293][T18357] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 437.791309][T18633] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3122'. [ 437.802925][T18633] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 437.822994][ T5285] 8021q: adding VLAN 0 to HW filter on device eth2 [ 437.845178][T18357] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 437.858775][T18357] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 437.946636][T18357] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 438.264900][T18357] hsr_slave_0: entered promiscuous mode [ 438.284287][T18357] hsr_slave_1: entered promiscuous mode [ 438.298169][T18357] debugfs: 'hsr0' already exists in 'hsr' [ 438.311662][T18357] Cannot create hsr debugfs directory [ 438.474989][T17388] IPVS: stop unused estimator thread 0... [ 439.554847][T18704] tc_dump_action: action bad kind [ 439.703565][T18713] netlink: 'syz.3.3134': attribute type 1 has an invalid length. [ 439.857349][T18724] netlink: 'syz.0.3135': attribute type 1 has an invalid length. [ 439.873981][T18713] bond9: entered promiscuous mode [ 439.885758][T18713] 8021q: adding VLAN 0 to HW filter on device bond9 [ 439.978631][T18724] bond3: entered promiscuous mode [ 439.993814][T18724] 8021q: adding VLAN 0 to HW filter on device bond3 [ 440.156208][T18724] bond3: (slave bridge1): making interface the new active one [ 440.169430][T18724] bridge1: entered promiscuous mode [ 440.177536][T18724] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 440.208842][ T5627] block nbd0: Receive control failed (result -32) [ 440.503844][T18755] tipc: Enabled bearer , priority 0 [ 440.578945][T18749] tipc: Disabling bearer [ 440.681811][T18357] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 440.724646][T18357] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 440.751691][T18357] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 440.763103][T18768] __nla_validate_parse: 3 callbacks suppressed [ 440.763119][T18768] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3144'. [ 440.789072][T18357] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 440.814336][T18357] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 440.866498][T18357] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 440.897359][T18357] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 440.926865][T18357] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 441.242199][T18792] nbd: socks must be embedded in a SOCK_ITEM attr [ 441.346557][T18792] block nbd3: shutting down sockets [ 441.365275][T18357] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.479373][T18801] tipc: Enabled bearer , priority 0 [ 441.522802][T18357] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.548737][T18802] syzkaller0: entered promiscuous mode [ 441.566080][T18802] syzkaller0: entered allmulticast mode [ 441.575805][T18798] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3147'. [ 441.653766][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.660972][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 441.702408][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.709666][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 441.760579][T18815] tipc: Resetting bearer [ 441.813055][T18815] tipc: Disabling bearer [ 442.327958][T18839] tipc: Enabled bearer , priority 0 [ 442.808872][T18864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3162'. [ 442.950545][T18877] syzkaller0: entered promiscuous mode [ 442.969608][T18877] syzkaller0: entered allmulticast mode [ 442.989011][T18881] netlink: 'syz.3.3162': attribute type 1 has an invalid length. [ 443.118859][T18357] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 443.239180][T18889] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3167'. [ 443.721021][T18912] can: request_module (can-proto-0) failed. [ 443.843558][T18357] veth0_vlan: entered promiscuous mode [ 443.913854][T18357] veth1_vlan: entered promiscuous mode [ 444.008970][T18933] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3174'. [ 444.067911][T18357] veth0_macvtap: entered promiscuous mode [ 444.116657][T18357] veth1_macvtap: entered promiscuous mode [ 444.224773][T18357] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.286493][T18357] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.306546][T18940] syzkaller0: entered promiscuous mode [ 444.315170][T18940] syzkaller0: entered allmulticast mode [ 444.433544][T18941] syzkaller0: entered promiscuous mode [ 444.439218][T18941] syzkaller0: entered allmulticast mode [ 444.483236][ T6313] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.510906][T18956] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3179'. [ 444.521096][ T6313] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.532618][ T6313] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.548807][T18956] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3179'. [ 444.571619][ T6313] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.608320][T18958] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 444.797728][T18969] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3183'. [ 444.831997][ T6314] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.857385][ T6314] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 444.896954][T18963] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3181'. [ 444.918572][ T6314] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.937652][ T6314] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.012333][T18973] can: request_module (can-proto-0) failed. [ 445.347258][T18988] dvmrp8: entered allmulticast mode [ 445.422716][ T5641] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 445.444363][ T5641] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 445.452587][ T5641] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 445.474624][ T5641] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 445.485822][ T5641] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 445.538623][T18993] Can't find ip_set type [ 445.562796][T18992] Can't find ip_set type [ 445.805372][T19016] netlink: 'syz.3.3196': attribute type 1 has an invalid length. [ 445.982459][T19016] bond10: entered promiscuous mode [ 445.988170][T19016] 8021q: adding VLAN 0 to HW filter on device bond10 [ 446.055102][T19030] team0: entered promiscuous mode [ 446.063134][T19030] team_slave_0: entered promiscuous mode [ 446.082901][T19030] team_slave_1: entered promiscuous mode [ 446.099354][T19030] team0: entered allmulticast mode [ 446.117160][T19030] team_slave_0: entered allmulticast mode [ 446.135287][T19030] team_slave_1: entered allmulticast mode [ 446.157647][T19030] team0: Cannot enslave team device to itself [ 446.239656][T19036] tipc: Enabled bearer , priority 0 [ 446.266869][T19026] lo speed is unknown, defaulting to 1000 [ 446.275692][T19036] syzkaller0: entered promiscuous mode [ 446.293733][T19036] syzkaller0: entered allmulticast mode [ 446.346392][T19036] tipc: Resetting bearer [ 446.389655][T19051] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3203'. [ 446.415628][T19034] tipc: Resetting bearer [ 446.493217][T19034] tipc: Disabling bearer [ 446.706395][T18989] lo speed is unknown, defaulting to 1000 [ 446.717976][T19038] dummy0 speed is unknown, defaulting to 1000 [ 447.329596][T19038] dummy0 speed is unknown, defaulting to 1000 [ 447.369253][T19038] dummy0 speed is unknown, defaulting to 1000 [ 447.561034][ T5641] Bluetooth: hci4: command tx timeout [ 448.464110][T19113] netlink: 'syz.0.3210': attribute type 4 has an invalid length. [ 448.542211][T19038] infiniband syz1: set active [ 448.543979][T18989] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.554552][T18989] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.558876][T19038] infiniband syz1: added dummy0 [ 448.567239][T18989] bridge_slave_0: entered allmulticast mode [ 448.576142][T18989] bridge_slave_0: entered promiscuous mode [ 448.585553][T18989] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.592955][T18989] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.600762][T18989] bridge_slave_1: entered allmulticast mode [ 448.610880][T18989] bridge_slave_1: entered promiscuous mode [ 448.615702][T19038] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 448.632852][ T5752] dummy0 speed is unknown, defaulting to 1000 [ 448.676514][T19038] infiniband syz1: Couldn't open port 1 [ 448.699497][T18989] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.717711][T19038] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 448.750909][T18989] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.761109][T19038] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 448.810534][T19038] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 448.848231][T18989] team0: Port device team_slave_0 added [ 448.875301][T18989] team0: Port device team_slave_1 added [ 448.902637][T19038] RDS/IB: syz1: added [ 448.921209][T19038] smc: adding ib device syz1 with port count 1 [ 448.950372][T19038] smc: ib device syz1 port 1 has no pnetid [ 448.972969][ T5751] dummy0 speed is unknown, defaulting to 1000 [ 448.984276][T18989] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 449.000215][T18989] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 449.053755][T18989] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 449.068019][T19038] dummy0 speed is unknown, defaulting to 1000 [ 449.076984][T18989] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 449.092677][T18989] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 449.149619][T18989] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 449.315756][T18989] hsr_slave_0: entered promiscuous mode [ 449.340210][T18989] hsr_slave_1: entered promiscuous mode [ 449.367122][T18989] debugfs: 'hsr0' already exists in 'hsr' [ 449.378736][T18989] Cannot create hsr debugfs directory [ 449.435410][T19132] bond3: left promiscuous mode [ 449.441726][T19132] bridge1: left promiscuous mode [ 449.456811][T19134] RDS: rds_bind could not find a transport for ::ffff:172.30.0.5, load rds_tcp or rds_rdma? [ 449.643997][ T5641] Bluetooth: hci4: command tx timeout [ 449.777524][T19074] Set syz1 is full, maxelem 65536 reached [ 449.839352][T19038] dummy0 speed is unknown, defaulting to 1000 [ 450.053542][T19145] 8021q: adding VLAN 0 to HW filter on device bond0 [ 450.065104][T19145] 8021q: adding VLAN 0 to HW filter on device team0 [ 450.098877][T19145] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 450.180272][T19145] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 450.195676][T19145] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 450.216478][T19145] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 450.234555][T19145] veth1_vlan: left promiscuous mode [ 450.241357][T19145] veth0_vlan: left promiscuous mode [ 450.248314][T19145] veth0_vlan: entered promiscuous mode [ 450.256899][T19145] veth1_vlan: entered promiscuous mode [ 450.268820][T19145] veth1_macvtap: left promiscuous mode [ 450.276341][T19145] veth0_macvtap: left promiscuous mode [ 450.283524][T19145] veth0_macvtap: entered promiscuous mode [ 450.291572][T19145] veth1_macvtap: entered promiscuous mode [ 450.306158][T19145] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 450.317158][T19145] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 450.330726][T19145] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 450.339241][T19145] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 450.351744][T19145] 8021q: adding VLAN 0 to HW filter on device bond1 [ 450.364911][T19145] 8021q: adding VLAN 0 to HW filter on device bond2 [ 450.373713][T19145] 8021q: adding VLAN 0 to HW filter on device bond3 [ 450.383289][T19145] mac80211_hwsim hwsim13 wlan0: entered promiscuous mode [ 450.408152][ T6313] bridge0: port 1(bridge_slave_0) entered blocking state [ 450.415344][ T6313] bridge0: port 1(bridge_slave_0) entered forwarding state [ 450.441788][ T6313] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.448991][ T6313] bridge0: port 2(bridge_slave_1) entered forwarding state [ 450.496957][T19155] netlink: 'syz.3.3221': attribute type 1 has an invalid length. [ 450.507897][T19155] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3221'. [ 450.551989][ T6314] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.569962][ T6314] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.591791][T19038] dummy0 speed is unknown, defaulting to 1000 [ 450.718745][ T6314] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.744437][ T6314] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.851006][T19165] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3223'. [ 451.058015][T19161] bridge0: port 3(bond0) entered disabled state [ 451.093652][T19161] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.122686][T19161] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.157904][T19038] dummy0 speed is unknown, defaulting to 1000 [ 451.342119][T19172] can: request_module (can-proto-0) failed. [ 451.361201][T18989] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 451.373571][T18989] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 451.394474][T18989] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 451.409301][T18989] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 451.426591][T18989] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 451.439629][T18989] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 451.456492][T18989] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 451.469215][T18989] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 451.493386][T19038] dummy0 speed is unknown, defaulting to 1000 [ 451.656561][T19183] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3227'. [ 451.706493][T18989] 8021q: adding VLAN 0 to HW filter on device bond0 [ 451.720095][ T5641] Bluetooth: hci4: command tx timeout [ 451.753344][T18989] 8021q: adding VLAN 0 to HW filter on device team0 [ 451.788362][T17388] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.795587][T17388] bridge0: port 1(bridge_slave_0) entered forwarding state [ 451.844071][T19038] dummy0 speed is unknown, defaulting to 1000 [ 451.867742][T17388] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.874931][T17388] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.277885][T19211] netlink: 'syz.0.3233': attribute type 1 has an invalid length. [ 452.286234][T19211] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3233'. [ 452.301277][T19204] nbd12: detected capacity change from 0 to 63 [ 452.313386][T19211] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3233'. [ 452.339584][T19199] team0: left promiscuous mode [ 452.356824][T19199] team_slave_0: left promiscuous mode [ 452.372620][T19199] team_slave_1: left promiscuous mode [ 452.397541][T19199] 8021q: adding VLAN 0 to HW filter on device team0 [ 452.491173][T19038] dummy0 speed is unknown, defaulting to 1000 [ 452.517837][ T5641] block nbd12: Receive control failed (result -104) [ 452.804622][T19222] can: request_module (can-proto-0) failed. [ 453.127416][T18989] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 453.357982][T18989] veth0_vlan: entered promiscuous mode [ 453.409643][T19242] ip6tnl1: entered allmulticast mode [ 453.443808][T19242] netlink: 'syz.0.3241': attribute type 22 has an invalid length. [ 453.457186][T18989] veth1_vlan: entered promiscuous mode [ 453.471094][T19242] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3241'. [ 453.552395][T19242] netlink: 'syz.0.3241': attribute type 22 has an invalid length. [ 453.566330][ T6103] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.585856][T19242] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3241'. [ 453.607603][ T6103] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.637652][ T6103] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.667788][ T6103] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.725327][T18989] veth0_macvtap: entered promiscuous mode [ 453.768573][T18989] veth1_macvtap: entered promiscuous mode [ 453.798827][T19253] can: request_module (can-proto-4) failed. [ 453.810136][ T5641] Bluetooth: hci4: command tx timeout [ 453.858339][T18989] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 453.914178][T18989] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 453.956351][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.990619][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.011906][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.025681][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.153152][T19276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3251'. [ 454.351768][ T6313] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 454.390690][ T6313] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.432706][ T6313] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 454.444428][ T6313] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.471886][T19287] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3256'. [ 454.497335][T19287] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3256'. [ 454.575145][T19287] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3256'. [ 454.588157][T19287] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3256'. [ 454.629496][T19292] netlink: 'syz.0.3258': attribute type 32 has an invalid length. [ 454.742669][T19292] bond4: option coupled_control: invalid value (17) [ 454.753070][T19292] bond4 (unregistering): Released all slaves [ 454.847090][T19306] RDS: rds_bind could not find a transport for ::ffff:10.1.1.3, load rds_tcp or rds_rdma? [ 455.044596][T19319] netlink: 'syz.2.3264': attribute type 1 has an invalid length. [ 455.599084][T19345] netlink: 'syz.1.3272': attribute type 29 has an invalid length. [ 455.811615][ T5627] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 455.823639][ T5627] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 455.838963][ T5627] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 455.847507][ T5627] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 455.857905][ T5627] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 455.912488][T19354] xfrm1: entered allmulticast mode [ 456.232813][T19368] netlink: 'syz.1.3278': attribute type 1 has an invalid length. [ 456.444771][T19380] netlink: 'syz.2.3281': attribute type 1 has an invalid length. [ 456.471281][T19377] netlink: 'syz.4.3279': attribute type 1 has an invalid length. [ 456.509228][T19368] syzkaller0: entered promiscuous mode [ 456.515079][T19368] syzkaller0: entered allmulticast mode [ 456.562221][T19377] bond1: entered promiscuous mode [ 456.567822][T19377] 8021q: adding VLAN 0 to HW filter on device bond1 [ 456.636152][ T36] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 456.667614][ T36] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.746596][T19395] __nla_validate_parse: 3 callbacks suppressed [ 456.746613][T19395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3284'. [ 456.763650][T19395] netlink: 312 bytes leftover after parsing attributes in process `syz.0.3284'. [ 456.783421][T19395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3284'. [ 456.876190][T19372] veth3: entered promiscuous mode [ 456.894639][T19372] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 456.941051][T19377] veth5: entered promiscuous mode [ 456.952760][T19377] bond1: (slave veth5): Enslaving as a backup interface with a down link [ 457.965474][ T5641] Bluetooth: hci3: command tx timeout [ 459.004873][ T36] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.015875][ T36] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.093751][T19410] bond4: option arp_all_targets: invalid value (3) [ 459.132827][T19410] bond4 (unregistering): Released all slaves [ 459.226035][T19417] bond1: Unable to set down delay as MII monitoring is disabled [ 459.248594][T19417] bond1 (unregistering): Released all slaves [ 459.322650][ T36] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.352625][ T36] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.371143][T19420] sctp: [Deprecated]: syz.4.3290 (pid 19420) Use of int in max_burst socket option. [ 459.371143][T19420] Use struct sctp_assoc_value instead [ 459.388464][T19350] lo speed is unknown, defaulting to 1000 [ 459.466059][ T36] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.498562][ T36] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.660961][T19429] netlink: 'syz.1.3288': attribute type 1 has an invalid length. [ 459.721111][T19429] netlink: 'syz.1.3288': attribute type 2 has an invalid length. [ 459.995551][T19420] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3290'. [ 460.048073][ T5641] Bluetooth: hci3: command tx timeout [ 460.059430][T19350] dummy0 speed is unknown, defaulting to 1000 [ 460.778376][T19457] can: request_module (can-proto-0) failed. [ 461.022346][T19471] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3300'. [ 461.748273][ T36] bond0: left allmulticast mode [ 461.754282][ T36] bond_slave_0: left allmulticast mode [ 461.770282][ T36] bond0: left promiscuous mode [ 461.776402][ T36] bond_slave_0: left promiscuous mode [ 461.786174][T19479] netlink: 'syz.1.3300': attribute type 1 has an invalid length. [ 461.796206][ T36] bridge0: port 3(bond0) entered disabled state [ 461.811632][ T36] bridge_slave_1: left allmulticast mode [ 461.821405][ T36] bridge_slave_1: left promiscuous mode [ 461.829605][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 461.843442][ T36] bridge_slave_0: left allmulticast mode [ 461.849247][ T36] bridge_slave_0: left promiscuous mode [ 461.855289][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.872916][ T36] dvmrp0: left allmulticast mode [ 461.877949][ T36] dvmrp8: left allmulticast mode [ 461.955476][T19499] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3303'. [ 462.028681][ T36] bond2 (unregistering): (slave ip6gretap0): Releasing active interface [ 462.127014][ T5641] Bluetooth: hci3: command tx timeout [ 462.133023][ T36] bond7 (unregistering): (slave erspan1): Releasing active interface [ 462.141350][ T36] erspan1 (unregistering): left promiscuous mode [ 462.277438][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 462.288103][ T36] bond0 (unregistering): Released all slaves [ 462.298783][ T36] bond1 (unregistering): Released all slaves [ 462.319450][ T36] bond2 (unregistering): Released all slaves [ 462.338721][ T36] bond3 (unregistering): Released all slaves [ 462.352658][ T36] bond4 (unregistering): Released all slaves [ 462.367407][ T36] bond5 (unregistering): Released all slaves [ 462.382851][ T36] bond6 (unregistering): Released all slaves [ 462.399388][ T36] bond7 (unregistering): Released all slaves [ 462.428944][ T36] bond8 (unregistering): Released all slaves [ 462.444209][ T36] bond9 (unregistering): Released all slaves [ 462.457788][ T36] bond10 (unregistering): Released all slaves [ 462.483164][ T5285] 8021q: adding VLAN 0 to HW filter on device eth1 [ 462.728299][ T36] tipc: Disabling bearer [ 462.761244][ T36] tipc: Left network mode [ 462.775137][T19507] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3305'. [ 462.911007][T19507] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3305'. [ 463.006543][T19507] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 463.032969][T19507] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3305'. [ 463.652221][T19542] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3311'. [ 463.660441][T19529] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3308'. [ 464.055840][T19554] can: request_module (can-proto-0) failed. [ 464.057220][ T5285] 8021q: adding VLAN 0 to HW filter on device eth2 [ 464.200852][ T5627] Bluetooth: hci3: command tx timeout [ 464.422382][T19350] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.460213][T19350] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.467798][T19350] bridge_slave_0: entered allmulticast mode [ 464.487501][T19572] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3316'. [ 464.534045][T19350] bridge_slave_0: entered promiscuous mode [ 464.550598][T19350] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.567173][T19350] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.588898][T19350] bridge_slave_1: entered allmulticast mode [ 464.619319][T19350] bridge_slave_1: entered promiscuous mode [ 464.668415][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 464.677724][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 464.715931][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 464.724564][T19580] netlink: 'syz.4.3319': attribute type 1 has an invalid length. [ 464.761032][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 464.772537][T19583] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3320'. [ 464.853965][ T36] veth1_vlan: left promiscuous mode [ 464.878356][ T36] veth0_vlan: left promiscuous mode [ 465.414496][ T36] team0 (unregistering): Port device team_slave_1 removed [ 465.597584][T19585] tipc: Started in network mode [ 465.602663][T19585] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 465.611507][T19585] tipc: Enabled bearer , priority 30 [ 465.623520][ T5285] 8021q: adding VLAN 0 to HW filter on device eth3 [ 465.683254][T19350] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 465.745336][T19350] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 465.817830][T19622] can: request_module (can-proto-0) failed. [ 465.891672][T19350] team0: Port device team_slave_0 added [ 465.957366][T19350] team0: Port device team_slave_1 added [ 466.157789][T19350] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 466.177523][T19350] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 466.252361][T19350] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 466.282676][ T5627] Bluetooth: hci3: command 0x0405 tx timeout [ 466.337073][T19350] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 466.348841][T19350] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 466.376100][T19350] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 466.541176][T19350] hsr_slave_0: entered promiscuous mode [ 466.559278][T19656] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3335'. [ 466.564336][T19350] hsr_slave_1: entered promiscuous mode [ 466.615490][T19350] debugfs: 'hsr0' already exists in 'hsr' [ 466.628513][T19350] Cannot create hsr debugfs directory [ 466.646222][ T36] IPVS: stop unused estimator thread 0... [ 466.707007][ T5751] tipc: Node number set to 10005162 [ 467.304549][T19686] syz_tun: entered allmulticast mode [ 467.455269][ T5285] 8021q: adding VLAN 0 to HW filter on device eth4 [ 467.517359][T19685] syz_tun: left allmulticast mode [ 467.781694][T19697] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3345'. [ 467.883110][T19710] netlink: 'syz.0.3347': attribute type 1 has an invalid length. [ 467.897957][T19708] netlink: 'syz.0.3347': attribute type 1 has an invalid length. [ 468.596422][T19742] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 469.055270][T19767] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3363'. [ 469.214453][T19761] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3362'. [ 469.448771][T19776] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 469.467804][T19776] syzkaller1: linktype set to 780 [ 469.508342][T19350] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 469.538179][T19350] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 469.571466][T19350] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 469.613878][T19350] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 469.648275][T19350] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 469.712065][T19350] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 469.728624][T19350] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 469.760473][T19350] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 469.891648][T19803] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3368'. [ 470.064579][T19807] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3369'. [ 470.088336][T19350] 8021q: adding VLAN 0 to HW filter on device bond0 [ 470.185274][T19350] 8021q: adding VLAN 0 to HW filter on device team0 [ 470.238056][T17391] bridge0: port 1(bridge_slave_0) entered blocking state [ 470.245298][T17391] bridge0: port 1(bridge_slave_0) entered forwarding state [ 470.318096][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.325319][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 470.711416][T19830] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 470.764964][T19830] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 471.231995][T19854] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3375'. [ 472.792846][T19350] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 472.846667][T19901] x_tables: duplicate underflow at hook 1 [ 472.982766][T19909] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3386'. [ 472.982835][T19903] syzkaller0: entered promiscuous mode [ 472.992535][T19909] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3386'. [ 473.020840][T19903] syzkaller0: entered allmulticast mode [ 473.117508][T19350] veth0_vlan: entered promiscuous mode [ 473.155835][T19350] veth1_vlan: entered promiscuous mode [ 473.172365][T19909] syzkaller0: entered promiscuous mode [ 473.182885][T19909] syzkaller0: entered allmulticast mode [ 473.385106][T19909] tipc: Enabled bearer , priority 0 [ 473.431620][T19908] tipc: Resetting bearer [ 473.513039][T19908] tipc: Disabling bearer [ 473.562752][T19350] veth0_macvtap: entered promiscuous mode [ 473.577190][T19927] block nbd1: must specify backend [ 473.608231][T19350] veth1_macvtap: entered promiscuous mode [ 473.743281][T19350] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 473.792429][T19350] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 473.867340][T17388] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.913983][T17388] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.954958][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 473.994009][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 474.015994][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 474.029435][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 474.056498][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 474.096680][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 474.116537][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 474.145437][T19927] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3389'. [ 474.293067][T19927] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.300775][T19927] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.575229][T19927] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 474.615009][T19927] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 474.726892][T19741] Set syz1 is full, maxelem 65536 reached [ 474.904990][T19971] netlink: 'syz.0.3396': attribute type 1 has an invalid length. [ 475.008246][T19971] bond4: entered promiscuous mode [ 475.038209][T19971] 8021q: adding VLAN 0 to HW filter on device bond4 [ 475.043189][T19981] siw: device registration error -23 [ 475.052185][T19944] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 475.062060][T17388] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.079759][T17388] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.096872][T19944] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 475.111781][T18303] dummy0 speed is unknown, defaulting to 1000 [ 475.124825][T18303] syz1: Port: 1 Link DOWN [ 475.128091][T19944] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 475.167094][T17388] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.179211][ T24] dummy0 speed is unknown, defaulting to 1000 [ 475.179235][T17388] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.235134][T19976] bond4: (slave bridge2): making interface the new active one [ 475.242913][T19976] bridge2: entered promiscuous mode [ 475.251693][T19976] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 475.287683][T17388] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.357161][T17388] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.625990][ T6106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.649546][ T6106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.726196][T19996] IPVS: Error connecting to the multicast addr [ 475.747097][ T6106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.765498][ T6106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 476.597699][T20043] tipc: Started in network mode [ 476.605968][T20043] tipc: Node identity ee1a7c8a0c84, cluster identity 4711 [ 476.616377][T20043] tipc: Enabled bearer , priority 0 [ 476.777513][T20043] syzkaller0: entered promiscuous mode [ 476.796809][T20043] syzkaller0: entered allmulticast mode [ 476.812278][T20043] tipc: Resetting bearer [ 476.841418][T20062] sctp: [Deprecated]: syz.0.3418 (pid 20062) Use of int in max_burst socket option. [ 476.841418][T20062] Use struct sctp_assoc_value instead [ 476.900549][T20041] tipc: Resetting bearer [ 479.132652][T20041] tipc: Disabling bearer [ 479.194500][ T5751] tipc: Node number set to 3802037386 [ 479.226433][T20087] __nla_validate_parse: 149 callbacks suppressed [ 479.226453][T20087] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3426'. [ 479.515957][T20100] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3431'. [ 479.866435][T20124] netlink: 'syz.3.3437': attribute type 1 has an invalid length. [ 480.038361][T20132] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3437'. [ 480.429751][T20150] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3444'. [ 480.439421][T20150] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3444'. [ 480.455832][T20150] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 480.610447][ T9] IPVS: starting estimator thread 0... [ 480.667043][T20161] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3446'. [ 480.710277][T20157] IPVS: using max 26 ests per chain, 62400 per kthread [ 480.731554][T20159] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3445'. [ 480.909593][T20168] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 480.936173][T20168] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3449'. [ 481.177811][T20179] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3452'. [ 481.348584][T20183] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3455'. [ 481.382974][T20188] netlink: 'syz.2.3456': attribute type 13 has an invalid length. [ 481.604855][T20197] veth0_to_batadv: entered promiscuous mode [ 481.628229][T20197] veth0_to_batadv: entered allmulticast mode [ 481.924765][T20212] netlink: 'syz.3.3463': attribute type 1 has an invalid length. [ 482.611387][T20246] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 482.644647][T20248] netlink: 'syz.0.3474': attribute type 13 has an invalid length. [ 482.657956][T20248] netlink: 'syz.0.3474': attribute type 17 has an invalid length. [ 482.715128][T20244] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.722701][T20244] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.844377][ T1649] block nbd12: Possible stuck request ffff888026ebe000: control (read@0,1024B). Runtime 30 seconds [ 482.855288][ T1649] block nbd12: Possible stuck request ffff888026ebe1c0: control (read@1024,1024B). Runtime 30 seconds [ 482.866943][ T1649] block nbd12: Possible stuck request ffff888026ebe380: control (read@2048,1024B). Runtime 30 seconds [ 482.870746][T20244] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 482.878108][ T1649] block nbd12: Possible stuck request ffff888026ebe540: control (read@3072,1024B). Runtime 30 seconds [ 483.038275][T20248] 8021q: adding VLAN 0 to HW filter on device bond0 [ 483.046451][T20248] 8021q: adding VLAN 0 to HW filter on device team0 [ 483.056870][T20248] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 483.093742][T20248] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 483.105845][T20248] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 483.116851][T20248] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 483.138140][T20248] veth1_vlan: left promiscuous mode [ 483.144568][T20248] veth0_vlan: left promiscuous mode [ 483.151553][T20248] veth0_vlan: entered promiscuous mode [ 483.158934][T20248] veth1_vlan: entered promiscuous mode [ 483.169458][T20248] veth1_macvtap: left promiscuous mode [ 483.176431][T20248] veth0_macvtap: left promiscuous mode [ 483.183035][T20248] veth0_macvtap: entered promiscuous mode [ 483.196440][T20248] veth1_macvtap: entered promiscuous mode [ 483.206543][T20248] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 483.214532][T20248] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 483.226742][T20248] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 483.237592][T20248] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 483.248695][T20248] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 483.260314][T20248] mac80211_hwsim hwsim13 wlan0: left promiscuous mode [ 483.269744][T20248] 8021q: adding VLAN 0 to HW filter on device bond1 [ 483.281439][T20248] 8021q: adding VLAN 0 to HW filter on device bond2 [ 483.291015][T20248] 8021q: adding VLAN 0 to HW filter on device bond3 [ 483.300433][T20248] mac80211_hwsim hwsim13 wlan0: entered promiscuous mode [ 483.315155][T20248] ip6tnl1: left allmulticast mode [ 483.323834][T20248] xfrm1: left allmulticast mode [ 483.334384][T20248] bond4: left promiscuous mode [ 483.339205][T20248] bridge2: left promiscuous mode [ 483.345819][T20248] 8021q: adding VLAN 0 to HW filter on device bond4 [ 483.417778][T20269] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 483.492096][T20269] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 483.567718][ T6313] bridge0: port 1(bridge_slave_0) entered blocking state [ 483.574927][ T6313] bridge0: port 1(bridge_slave_0) entered forwarding state [ 483.585109][T20277] netlink: ct family unspecified [ 483.587176][ T6313] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.590344][T20277] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 483.597265][ T6313] bridge0: port 2(bridge_slave_1) entered forwarding state [ 483.948050][T20275] syzkaller0: entered promiscuous mode [ 483.959659][T20275] syzkaller0: entered allmulticast mode [ 486.124173][ T36] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 486.136984][ T36] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 486.163070][ T6313] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 486.200439][ T1020] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 486.240550][T20314] netlink: 'syz.2.3492': attribute type 1 has an invalid length. [ 486.253895][T20315] __nla_validate_parse: 5 callbacks suppressed [ 486.253911][T20315] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3493'. [ 486.333331][T20324] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3496'. [ 486.361596][T20314] bond1: entered promiscuous mode [ 486.375791][T20314] 8021q: adding VLAN 0 to HW filter on device bond1 [ 486.514205][T20315] team0: Port device team_slave_0 removed [ 486.553082][T20314] xt_TPROXY: Can be used only with -p tcp or -p udp [ 486.568610][T20333] netlink: 'syz.1.3499': attribute type 1 has an invalid length. [ 486.665687][T20333] 8021q: adding VLAN 0 to HW filter on device bond1 [ 486.709413][T20328] gretap0: entered promiscuous mode [ 486.731591][T20328] macsec1: entered allmulticast mode [ 486.745469][T20328] gretap0: entered allmulticast mode [ 486.814559][T20328] gretap0: left allmulticast mode [ 486.839101][T20328] gretap0: left promiscuous mode [ 486.949373][T20314] bond0: Caught tx_queue_len zero misconfig [ 487.076281][T20336] bond1: (slave veth3): Enslaving as an active interface with a down link [ 487.252663][T20333] 8021q: adding VLAN 0 to HW filter on device bond0 [ 487.276744][T20333] 8021q: adding VLAN 0 to HW filter on device team0 [ 487.304645][T20333] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 487.333435][T20363] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3505'. [ 487.379429][T20333] veth0_to_batadv: left promiscuous mode [ 487.400019][T20333] veth0_to_batadv: left allmulticast mode [ 487.418481][T20333] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 487.432030][T20333] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 487.446396][T20333] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 487.456941][T20333] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 487.474746][T20333] veth1_vlan: left promiscuous mode [ 487.481716][T20333] veth0_vlan: left promiscuous mode [ 487.488877][T20333] veth0_vlan: entered promiscuous mode [ 487.497760][T20333] veth1_vlan: entered promiscuous mode [ 487.510721][T20333] veth1_macvtap: left promiscuous mode [ 487.517487][T20333] veth0_macvtap: left promiscuous mode [ 487.524894][T20333] veth0_macvtap: entered promiscuous mode [ 487.534455][T20333] veth1_macvtap: entered promiscuous mode [ 487.553133][T20333] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 487.563411][T20333] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 487.573524][T20333] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 487.582584][T20333] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 487.605619][T20338] vlan2: entered allmulticast mode [ 487.611511][T20338] bond1: entered allmulticast mode [ 487.627271][T20343] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 487.637186][T20343] bond1: (slave batadv1): making interface the new active one [ 487.652543][T20343] batadv1: entered promiscuous mode [ 487.658239][T20343] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 487.703483][T20345] bridge1: entered promiscuous mode [ 487.727294][T20345] bridge1: entered allmulticast mode [ 487.748386][T20345] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 487.782336][ T6313] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.789573][ T6313] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.813453][ T6313] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.820704][ T6313] bridge0: port 2(bridge_slave_1) entered forwarding state [ 487.986668][ T5784] dummy0 speed is unknown, defaulting to 1000 [ 488.002911][ T5784] syz1: Port: 1 Link ACTIVE [ 488.075463][T17391] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.094226][T17391] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.132501][ T5784] dummy0 speed is unknown, defaulting to 1000 [ 488.138733][T17391] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.164314][T17391] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.244617][T20382] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3512'. [ 488.298962][T17391] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 488.336148][T20382] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.344906][T20382] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.748451][T20416] erspan1: entered allmulticast mode [ 488.876347][T20424] sctp: [Deprecated]: syz.4.3520 (pid 20424) Use of int in max_burst socket option. [ 488.876347][T20424] Use struct sctp_assoc_value instead [ 489.537893][T20436] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3524'. [ 489.591973][T20436] netlink: 'syz.1.3524': attribute type 2 has an invalid length. [ 489.613206][T20436] netlink: 'syz.1.3524': attribute type 5 has an invalid length. [ 489.733006][ T30] audit: type=1107 audit(1782476188.145:15): pid=20446 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Õ/a‹fŸÑüýâCšÈiDø#ÑS«ô>K´ZL³Xw¦¿pîg8bmòZ´RÐ7û°`Ša‘WüT‘u®ay.3:IÂý{P¿£æ«ÅÈ‹xNÿ]UòËBÅBGá¯=õ¼1ÝÑèÀjWÌ ™ŽHÿþhäÔ [ 489.733006][ T30] ¯'dÙ§' [ 489.771585][T20445] sock: sock_set_timeout: `syz.0.3527' (pid 20445) tries to set negative timeout [ 489.815583][T20447] sctp: [Deprecated]: syz.4.3528 (pid 20447) Use of int in maxseg socket option. [ 489.815583][T20447] Use struct sctp_assoc_value instead [ 489.942376][T20451] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3529'. [ 490.439723][T20472] IPv6: NLM_F_CREATE should be specified when creating new route [ 490.453516][T20472] netlink: 49 bytes leftover after parsing attributes in process `syz.1.3537'. [ 490.464011][T20472] netlink: 140 bytes leftover after parsing attributes in process `syz.1.3537'. [ 490.514104][T20472] netlink: 49 bytes leftover after parsing attributes in process `syz.1.3537'. [ 490.525532][T20476] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3537'. [ 491.526305][T20503] __nla_validate_parse: 3 callbacks suppressed [ 491.526323][T20503] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3546'. [ 491.571231][T20503] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3546'. [ 491.619155][T20503] geneve2: entered promiscuous mode [ 491.826525][T20515] netlink: 'syz.4.3551': attribute type 1 has an invalid length. [ 491.851974][T20515] netlink: 'syz.4.3551': attribute type 2 has an invalid length. [ 492.023130][T20520] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 492.033566][T20515] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 492.088653][T20526] rdma_rxe: rxe_newlink: failed to add lo [ 492.155913][T20515] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 492.456878][T20548] syzkaller0: entered promiscuous mode [ 492.483714][T20548] syzkaller0: entered allmulticast mode [ 492.529673][T20562] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3560'. [ 492.576690][T20562] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3560'. [ 492.627988][T20565] IPVS: set_ctl: invalid protocol: 46 172.30.0.5:20002 [ 493.818166][T20590] netlink: 'syz.0.3567': attribute type 1 has an invalid length. [ 494.128693][T20593] netlink: 'syz.0.3567': attribute type 10 has an invalid length. [ 494.137003][T20593] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3567'. [ 495.065938][T20590] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 495.178827][T20602] Bluetooth: MGMT ver 1.23 [ 495.229167][T20593] dummy0: entered promiscuous mode [ 495.238054][T20606] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3570'. [ 495.539187][T20627] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3574'. [ 495.565613][T20628] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3577'. [ 495.691691][T20628] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 495.726077][T20628] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 495.741288][T20628] bond0 (unregistering): Released all slaves [ 495.825448][T20644] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3579'. [ 495.832194][T20643] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3581'. [ 496.244396][T20667] dvmrp0: entered allmulticast mode [ 496.263184][T20664] lo speed is unknown, defaulting to 1000 [ 496.404941][T20674] xt_l2tp: v2 sid > 0xffff: 8388608 [ 496.426024][T20676] xt_l2tp: v2 sid > 0xffff: 8388608 [ 496.676789][T20681] bond2: Unable to set up delay as MII monitoring is disabled [ 496.695058][T20681] bond2 (unregistering): Released all slaves [ 496.735766][T20685] __nla_validate_parse: 3 callbacks suppressed [ 496.735785][T20685] netlink: 160 bytes leftover after parsing attributes in process `syz.2.3596'. [ 496.752608][T20664] dummy0 speed is unknown, defaulting to 1000 [ 497.015975][T20692] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3598'. [ 497.061030][T20694] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3599'. [ 497.103496][T20694] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3599'. [ 498.072991][T20720] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.3608'. [ 498.113157][T20722] netlink: 'syz.0.3609': attribute type 1 has an invalid length. [ 498.122080][T20723] netlink: 'syz.0.3609': attribute type 1 has an invalid length. [ 498.386669][T20612] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 498.606238][T20734] atomic_op ffff88804c111198 conn xmit_atomic 0000000000000000 [ 498.718789][T20739] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3615'. [ 498.816989][T20743] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3617'. [ 498.833401][T20394] batadv1: left promiscuous mode [ 498.850757][T20743] netlink: 'syz.4.3617': attribute type 1 has an invalid length. [ 498.917755][T20746] lo speed is unknown, defaulting to 1000 [ 498.994785][T20750] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3618'. [ 499.285202][T20763] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3620'. [ 499.449980][T20765] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3620'. [ 499.600265][T20746] dummy0 speed is unknown, defaulting to 1000 [ 499.601205][T20748] lo speed is unknown, defaulting to 1000 [ 500.178660][T20776] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 500.199534][T20776] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 500.476329][T20776] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 500.487196][T20776] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 500.596606][T20776] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 500.610336][T20776] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 500.656126][T20766] lo speed is unknown, defaulting to 1000 [ 500.662159][T20748] dummy0 speed is unknown, defaulting to 1000 [ 500.700614][T20776] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 500.708105][T20776] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 500.822076][T20776] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 500.835600][T20776] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 501.264746][T20798] lo speed is unknown, defaulting to 1000 [ 501.296055][T20766] dummy0 speed is unknown, defaulting to 1000 [ 501.879104][T20830] __nla_validate_parse: 4 callbacks suppressed [ 501.879122][T20830] netlink: 424 bytes leftover after parsing attributes in process `syz.0.3638'. [ 501.946572][T20830] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3638'. [ 501.965070][T20835] xt_socket: unknown flags 0x4 [ 502.007575][T20798] dummy0 speed is unknown, defaulting to 1000 [ 502.805506][T20852] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3643'. [ 504.467266][T20861] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3646'. [ 504.499163][T20860] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 504.696555][T20861] lo speed is unknown, defaulting to 1000 [ 504.975325][T20874] tipc: Enabling of bearer rejected, failed to enable media [ 505.097709][T20884] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3652'. [ 505.470771][T20861] dummy0 speed is unknown, defaulting to 1000 [ 505.656549][T20899] batadv_slave_1: entered promiscuous mode [ 505.662684][T20899] batadv_slave_1: entered allmulticast mode [ 506.421506][T20926] syzkaller0: entered promiscuous mode [ 506.452562][T20926] syzkaller0: entered allmulticast mode [ 506.576109][T20845] Set syz1 is full, maxelem 65536 reached [ 507.586971][T20958] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3676'. [ 507.752332][T20966] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3677'. [ 507.789143][T20966] 8021q: adding VLAN 0 to HW filter on device bond2 [ 507.806077][T20966] bond2: entered promiscuous mode [ 507.811454][T20966] bond2: entered allmulticast mode [ 507.818719][T20966] 8021q: adding VLAN 0 to HW filter on device bond2 [ 507.849127][T20966] team0: Port device bond2 added [ 507.886542][T20966] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3677'. [ 508.388488][T20986] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 508.388488][T20986] Please contact the netfilter-devel mailing list or update your nftables rules. [ 508.425913][T20988] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3684'. [ 508.740221][T20999] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3688'. [ 508.823501][T21003] syzkaller0: entered promiscuous mode [ 508.829200][T21003] syzkaller0: entered allmulticast mode [ 509.046359][T21009] syzkaller0: entered promiscuous mode [ 509.052304][T21009] syzkaller0: entered allmulticast mode [ 509.233987][T21011] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3693'. [ 510.049606][T21051] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3705'. [ 510.208551][T21057] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 510.465099][T21067] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3711'. [ 510.474456][T21067] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3711'. [ 510.675727][T21076] bridge0: port 3(vlan2) entered blocking state [ 510.707653][T21076] bridge0: port 3(vlan2) entered disabled state [ 510.746935][T21076] vlan2: entered allmulticast mode [ 510.777052][T21076] geneve0: entered allmulticast mode [ 510.800795][T21096] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3714'. [ 510.825046][T21076] vlan2: entered promiscuous mode [ 510.841616][T21076] geneve0: entered promiscuous mode [ 511.335850][T21113] xt_TCPMSS: Only works on TCP SYN packets [ 511.473104][T21118] bond3: option lacp_rate: invalid value (3) [ 511.483688][T21118] bond3 (unregistering): Released all slaves [ 511.531817][T21113] bridge_slave_1: left allmulticast mode [ 511.543479][T21113] bridge_slave_1: left promiscuous mode [ 511.549431][T21113] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.588945][T21113] bridge_slave_0: left allmulticast mode [ 511.601103][T21125] netlink: 'syz.1.3722': attribute type 13 has an invalid length. [ 511.602961][T21113] bridge_slave_0: left promiscuous mode [ 511.620328][T21113] bridge0: port 1(bridge_slave_0) entered disabled state [ 511.641613][T21125] netlink: 'syz.1.3722': attribute type 17 has an invalid length. [ 511.966789][T21125] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.974057][T21125] bridge0: port 2(bridge_slave_1) entered listening state [ 511.981506][T21125] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.988671][T21125] bridge0: port 1(bridge_slave_0) entered listening state [ 512.111335][T21125] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 512.616131][T21162] syzkaller0: entered promiscuous mode [ 512.640293][T21162] syzkaller0: entered allmulticast mode [ 512.705946][T21164] __nla_validate_parse: 1 callbacks suppressed [ 512.705964][T21164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3738'. [ 512.933280][ T1649] block nbd12: Possible stuck request ffff888026ebe000: control (read@0,1024B). Runtime 60 seconds [ 512.944316][ T1649] block nbd12: Possible stuck request ffff888026ebe1c0: control (read@1024,1024B). Runtime 60 seconds [ 512.955558][ T1649] block nbd12: Possible stuck request ffff888026ebe380: control (read@2048,1024B). Runtime 60 seconds [ 512.967200][ T1649] block nbd12: Possible stuck request ffff888026ebe540: control (read@3072,1024B). Runtime 60 seconds [ 513.114314][T21178] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3743'. [ 513.132110][T21178] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 513.154598][T21178] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 513.315077][T21190] macsec0: entered promiscuous mode [ 513.340973][T21190] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3747'. [ 513.383182][T21192] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3748'. [ 513.386511][T21190] veth1_macvtap: left promiscuous mode [ 513.423573][T21190] macsec0 (unregistering): left promiscuous mode [ 513.618394][T21202] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3751'. [ 513.792942][T21205] macsec1: entered promiscuous mode [ 513.933017][T21211] syzkaller0: entered promiscuous mode [ 513.947485][T21211] syzkaller0: entered allmulticast mode [ 514.356941][T21220] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3758'. [ 514.383293][T21220] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3758'. [ 514.410083][T21220] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3758'. [ 514.534381][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.562690][T21226] Bluetooth: MGMT ver 1.23 [ 514.843718][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.013477][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.078509][T21236] tipc: Enabled bearer , priority 0 [ 515.236064][T21240] syzkaller0: entered promiscuous mode [ 515.250282][T21240] syzkaller0: entered allmulticast mode [ 515.251528][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.263099][T21240] tipc: Resetting bearer [ 515.420641][T21254] can: request_module (can-proto-0) failed. [ 515.455035][T17385] tipc: Resetting bearer [ 515.465942][T21227] tipc: Resetting bearer [ 515.482121][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.578642][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.595029][T21267] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3767'. [ 516.281428][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.351978][T21279] netlink: 'syz.3.3769': attribute type 1 has an invalid length. [ 516.613787][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.649563][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.937953][T21227] tipc: Disabling bearer [ 517.968243][T21279] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 518.192727][T21297] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3774'. [ 518.696316][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.235456][T21354] syzkaller0: entered promiscuous mode [ 519.250976][T21354] syzkaller0: entered allmulticast mode [ 519.294023][T21358] : option downdelay: invalid value (18446744073709547007) [ 519.311668][T21358] : option downdelay: allowed values 0 - 2147483647 [ 519.323374][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.359499][T21358]  (unregistering): Released all slaves [ 519.399530][T21372] netlink: 'syz.3.3794': attribute type 58 has an invalid length. [ 519.437255][T21372] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3794'. [ 519.679770][T21383] netlink: 'syz.4.3795': attribute type 4 has an invalid length. [ 519.703590][T21383] netlink: 'syz.4.3795': attribute type 4 has an invalid length. [ 519.732802][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 520.771800][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.802869][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.362063][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.710252][ T4990] udevd[4990]: worker [5646] /devices/virtual/block/nbd12 is taking a long time [ 522.843400][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.883897][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.926335][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.083623][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.410181][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.963402][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.001671][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 527.009511][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 527.018377][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 528.042849][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 528.440155][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 529.083896][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.122874][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 531.163290][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 531.485981][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.204335][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.243319][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.284015][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.530189][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.680724][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.324621][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.363217][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.403062][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.570185][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.444114][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.482873][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 540.523003][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 540.610218][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 541.563224][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 542.361313][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 542.368544][ C0] bridge0: topology change detected, propagating [ 542.376277][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 542.383608][ C0] bridge0: topology change detected, propagating [ 542.603319][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.001989][ T1649] block nbd12: Possible stuck request ffff888026ebe000: control (read@0,1024B). Runtime 90 seconds [ 543.012787][ T1649] block nbd12: Possible stuck request ffff888026ebe1c0: control (read@1024,1024B). Runtime 90 seconds [ 543.024718][ T1649] block nbd12: Possible stuck request ffff888026ebe380: control (read@2048,1024B). Runtime 90 seconds [ 543.035984][ T1649] block nbd12: Possible stuck request ffff888026ebe540: control (read@3072,1024B). Runtime 90 seconds [ 543.645043][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.653479][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 544.281844][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 544.683206][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 545.723372][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 546.680179][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 546.763877][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 547.802862][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 548.843293][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.720253][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 549.883192][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 550.934873][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.961965][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 552.601983][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 553.000175][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 553.880536][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.044341][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.083288][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.651737][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.120174][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 557.163034][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 558.203652][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 558.680950][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 559.240346][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 560.285204][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.322809][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.720632][ T5726] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.360330][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.843667][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.852302][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 563.403009][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 564.440277][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.483703][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.890287][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 566.523037][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 567.562041][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 567.970373][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 568.002776][T20392] pimreg: left allmulticast mode [ 568.070752][T20392] bond4 (unregistering): (slave ip6gre1): Releasing backup interface [ 568.287878][T20392] bond5 (unregistering): (slave gretap2): Releasing active interface [ 568.320520][T20392] bond7 (unregistering): (slave ipip1): Releasing backup interface [ 568.328447][T20392] ipip1 (unregistering): left promiscuous mode [ 568.357236][T20392] bond2 (unregistering): (slave geneve3): Releasing active interface [ 568.435679][T20392] bond1 (unregistering): Released all slaves [ 568.448689][T20392] bond2 (unregistering): Released all slaves [ 568.465227][T20392] bond0 (unregistering): Released all slaves [ 568.484315][T20392] bond3 (unregistering): Released all slaves [ 568.498591][T20392] bond4 (unregistering): Released all slaves [ 568.515040][T20392] bond5 (unregistering): Released all slaves [ 568.531904][T20392] bond6 (unregistering): (slave veth5): Releasing backup interface [ 568.539915][T20392] veth5: left promiscuous mode [ 568.546534][T20392] bond6 (unregistering): Released all slaves [ 568.563350][T20392] bond7 (unregistering): Released all slaves [ 568.579447][T20392] bond8 (unregistering): Released all slaves [ 568.594289][T20392] bond9 (unregistering): Released all slaves [ 568.605891][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 568.613164][T20392] bond10 (unregistering): Released all slaves [ 568.629931][T20392] bond11 (unregistering): (slave veth7): Releasing backup interface [ 568.637992][T20392] veth7: left promiscuous mode [ 568.644227][T20392] bond11 (unregistering): Released all slaves [ 568.789623][T20392] : left promiscuous mode [ 568.927650][T20392] tipc: Left network mode [ 568.930085][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 569.403236][T20392] hsr_slave_0: left promiscuous mode [ 569.409576][T20392] hsr_slave_1: left promiscuous mode [ 569.645251][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 569.919311][T20392] IPVS: stop unused estimator thread 0... [ 570.683573][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.724622][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.960236][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.441033][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.773204][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.100195][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.108442][ T1649] block nbd12: Possible stuck request ffff888026ebe000: control (read@0,1024B). Runtime 120 seconds [ 573.119599][ T1649] block nbd12: Possible stuck request ffff888026ebe1c0: control (read@1024,1024B). Runtime 120 seconds [ 573.130779][ T1649] block nbd12: Possible stuck request ffff888026ebe380: control (read@2048,1024B). Runtime 120 seconds [ 573.142027][ T1649] block nbd12: Possible stuck request ffff888026ebe540: control (read@3072,1024B). Runtime 120 seconds [ 573.803666][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.842971][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 575.001480][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 575.882621][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 576.922942][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 577.963922][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.041773][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.003126][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 580.043020][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.080100][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.088566][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 582.123049][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 582.682408][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.160503][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.323857][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.334311][T17385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.345186][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.356932][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.243931][ T5752] net_ratelimit: 2 callbacks suppressed [ 585.244016][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.280780][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.359366][T21422] sctp: [Deprecated]: syz.2.3803 (pid 21422) Use of int in maxseg socket option. [ 586.359366][T21422] Use struct sctp_assoc_value instead [ 587.160223][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 587.325187][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 588.365783][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 588.564267][T21443] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3810'. [ 588.572955][T21439] syzkaller0: entered promiscuous mode [ 588.581849][T21439] syzkaller0: entered allmulticast mode [ 588.626193][T21445] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3811'. [ 588.721670][T21446] netlink: 272 bytes leftover after parsing attributes in process `syz.2.3810'. [ 588.756365][T21443] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3810'. [ 588.800962][T21452] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 588.815573][T21452] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 588.902052][T21455] lo speed is unknown, defaulting to 1000 [ 588.908229][T21458] netlink: 'syz.2.3816': attribute type 1 has an invalid length. [ 588.958223][T21459] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 588.998458][T21458] 8021q: adding VLAN 0 to HW filter on device bond2 [ 589.072878][T21462] bond2: (slave geneve2): making interface the new active one [ 589.101168][T21462] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 589.255339][ T24] IPVS: starting estimator thread 0... [ 589.344195][T21478] netlink: 'syz.3.3819': attribute type 6 has an invalid length. [ 589.359958][T21475] IPVS: using max 31 ests per chain, 74400 per kthread [ 589.360447][T21478] netlink: 'syz.3.3819': attribute type 28 has an invalid length. [ 589.408543][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.415529][T21478] netlink: 'syz.3.3819': attribute type 3 has an invalid length. [ 589.442784][T21478] netlink: 'syz.3.3819': attribute type 27 has an invalid length. [ 589.682258][T21482] netlink: 'syz.0.3822': attribute type 1 has an invalid length. [ 589.739135][T21455] dummy0 speed is unknown, defaulting to 1000 [ 589.833786][T21482] 8021q: adding VLAN 0 to HW filter on device bond6 [ 589.996912][T21483] bond6: (slave veth7): Enslaving as an active interface with a down link [ 590.034787][T21486] dummy0: left promiscuous mode [ 590.073652][T21493] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3825'. [ 590.109547][T21486] batadv_slave_1: left promiscuous mode [ 590.127781][T21486] batadv_slave_1: left allmulticast mode [ 590.144810][T21486] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 590.192632][T21482] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 590.201972][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.218326][T21482] bond6: (slave batadv1): making interface the new active one [ 590.229514][T21482] batadv1: entered promiscuous mode [ 590.235744][T21482] bond6: (slave batadv1): Enslaving as an active interface with an up link [ 590.349659][T21508] x_tables: duplicate entry at hook 1 [ 590.459347][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.816631][T21522] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3831'. [ 590.826272][T21522] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3831'. [ 590.861208][T21524] syzkaller0: entered promiscuous mode [ 590.872064][T21524] syzkaller0: entered allmulticast mode [ 590.901023][T21524] tipc: Enabled bearer , priority 0 [ 590.951442][T21523] tipc: Resetting bearer [ 590.976234][T21523] tipc: Disabling bearer [ 591.145821][T21528] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3834'. [ 591.262658][T21538] netlink: 'syz.4.3838': attribute type 3 has an invalid length. [ 591.337725][T21543] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3840'. [ 591.397486][T21546] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3841'. [ 591.406951][T21546] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 591.485738][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.913298][T21577] xt_recent: hitcount (4294967294) is larger than allowed maximum (65535) [ 592.488112][T21603] can: request_module (can-proto-0) failed. [ 592.521873][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.543774][T21603] batman_adv: batadv0: Adding interface: dummy0 [ 592.563679][T21603] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 592.621827][T21611] can: request_module (can-proto-0) failed. [ 592.635461][T21603] batman_adv: batadv0: Interface activated: dummy0 [ 592.658591][ T5752] dummy0 speed is unknown, defaulting to 1000 [ 592.678599][T21609] batadv0: mtu less than device minimum [ 592.699493][T21609] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 592.711280][T21609] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 592.723043][T21609] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 592.734804][T21609] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 592.746475][T21609] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 592.758181][T21609] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 592.843503][T21611] FAULT_INJECTION: forcing a failure. [ 592.843503][T21611] name failslab, interval 1, probability 0, space 0, times 0 [ 592.865118][T21611] CPU: 1 UID: 0 PID: 21611 Comm: syz.2.3859 Not tainted syzkaller #0 PREEMPT(full) [ 592.865145][T21611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 592.865163][T21611] Call Trace: [ 592.865170][T21611] [ 592.865178][T21611] dump_stack_lvl+0xe8/0x150 [ 592.865210][T21611] should_fail_ex+0x40c/0x560 [ 592.865237][T21611] should_failslab+0xa8/0x100 [ 592.865260][T21611] __kmalloc_noprof+0xfe/0x720 [ 592.865284][T21611] ? rcu_is_watching+0x15/0xb0 [ 592.865337][T21611] ? tomoyo_realpath_from_path+0xef/0x640 [ 592.865450][T21611] ? tomoyo_realpath_from_path+0xef/0x640 [ 592.865481][T21611] tomoyo_realpath_from_path+0xef/0x640 [ 592.865514][T21611] ? tomoyo_path_number_perm+0x219/0x5f0 [ 592.865535][T21611] tomoyo_path_number_perm+0x246/0x5f0 [ 592.865556][T21611] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 592.865576][T21611] ? __lock_acquire+0x683/0x2cf0 [ 592.865612][T21611] ? hook_file_ioctl+0x1f0/0x5f0 [ 592.865719][T21611] ? __fget_files+0x2a/0x420 [ 592.865741][T21611] ? __fget_files+0x2a/0x420 [ 592.865758][T21611] ? __fget_files+0x3a2/0x420 [ 592.865775][T21611] ? __fget_files+0x2a/0x420 [ 592.865797][T21611] security_file_ioctl+0xc3/0x2a0 [ 592.865844][T21611] __se_sys_ioctl+0x47/0x170 [ 592.865868][T21611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.865890][T21611] do_syscall_64+0x174/0x580 [ 592.865907][T21611] ? trace_irq_disable+0x3b/0x140 [ 592.865925][T21611] ? clear_bhb_loop+0x40/0x90 [ 592.865968][T21611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.865987][T21611] RIP: 0033:0x7f4b5d19ce59 [ 592.866005][T21611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 592.866022][T21611] RSP: 002b:00007f4b5df9e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 592.866043][T21611] RAX: ffffffffffffffda RBX: 00007f4b5d415fa0 RCX: 00007f4b5d19ce59 [ 592.866057][T21611] RDX: 0000200000000080 RSI: 0000000000008922 RDI: 0000000000000010 [ 592.866069][T21611] RBP: 00007f4b5df9e090 R08: 0000000000000000 R09: 0000000000000000 [ 592.866080][T21611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 592.866091][T21611] R13: 00007f4b5d416038 R14: 00007f4b5d415fa0 R15: 00007fff956c65f8 [ 592.866122][T21611] [ 592.866580][T21611] ERROR: Out of memory at tomoyo_realpath_from_path. [ 593.608508][T21636] veth9: entered allmulticast mode [ 593.924533][T21665] FAULT_INJECTION: forcing a failure. [ 593.924533][T21665] name failslab, interval 1, probability 0, space 0, times 0 [ 593.941472][T21665] CPU: 1 UID: 0 PID: 21665 Comm: syz.4.3875 Not tainted syzkaller #0 PREEMPT(full) [ 593.941499][T21665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 593.941510][T21665] Call Trace: [ 593.941517][T21665] [ 593.941525][T21665] dump_stack_lvl+0xe8/0x150 [ 593.941555][T21665] should_fail_ex+0x40c/0x560 [ 593.941585][T21665] should_failslab+0xa8/0x100 [ 593.941608][T21665] __kmalloc_noprof+0xfe/0x720 [ 593.941637][T21665] ? tomoyo_encode+0x2ad/0x570 [ 593.941660][T21665] ? tomoyo_encode+0x2ad/0x570 [ 593.941690][T21665] tomoyo_encode+0x2ad/0x570 [ 593.941725][T21665] tomoyo_realpath_from_path+0x5fa/0x640 [ 593.941762][T21665] ? tomoyo_path_number_perm+0x219/0x5f0 [ 593.941783][T21665] tomoyo_path_number_perm+0x246/0x5f0 [ 593.941806][T21665] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 593.941826][T21665] ? __lock_acquire+0x683/0x2cf0 [ 593.941861][T21665] ? hook_file_ioctl+0x1f0/0x5f0 [ 593.941898][T21665] ? __fget_files+0x2a/0x420 [ 593.941918][T21665] ? __fget_files+0x2a/0x420 [ 593.941935][T21665] ? __fget_files+0x3a2/0x420 [ 593.941951][T21665] ? __fget_files+0x2a/0x420 [ 593.941974][T21665] security_file_ioctl+0xc3/0x2a0 [ 593.941994][T21665] __se_sys_ioctl+0x47/0x170 [ 593.942018][T21665] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.942039][T21665] do_syscall_64+0x174/0x580 [ 593.942056][T21665] ? trace_irq_disable+0x3b/0x140 [ 593.942074][T21665] ? clear_bhb_loop+0x40/0x90 [ 593.942098][T21665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.942117][T21665] RIP: 0033:0x7f24dc79ce59 [ 593.942135][T21665] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.942151][T21665] RSP: 002b:00007f24dd6c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 593.942170][T21665] RAX: ffffffffffffffda RBX: 00007f24dca16090 RCX: 00007f24dc79ce59 [ 593.942184][T21665] RDX: 0000200000000080 RSI: 0000000000008922 RDI: 0000000000000010 [ 593.942196][T21665] RBP: 00007f24dd6c2090 R08: 0000000000000000 R09: 0000000000000000 [ 593.942207][T21665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 593.942218][T21665] R13: 00007f24dca16128 R14: 00007f24dca16090 R15: 00007ffd5bdb84a8 [ 593.942250][T21665] [ 593.942278][T21665] ERROR: Out of memory at tomoyo_realpath_from_path. [ 593.970267][T21661] can: request_module (can-proto-0) failed. [ 594.671543][T21707] __nla_validate_parse: 7 callbacks suppressed [ 594.671561][T21707] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3885'. [ 594.733556][T21704] lo speed is unknown, defaulting to 1000 [ 594.769105][T21711] tipc: Enabled bearer , priority 0 [ 594.812365][T21711] syzkaller0: entered promiscuous mode [ 594.831322][T21711] syzkaller0: entered allmulticast mode [ 594.853576][T21711] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 594.914708][T21717] tipc: Resetting bearer [ 595.281540][T21704] dummy0 speed is unknown, defaulting to 1000 [ 595.528919][T21713] tipc: Resetting bearer [ 595.551439][T21725] can: request_module (can-proto-0) failed. [ 595.589372][T21713] tipc: Disabling bearer [ 595.657248][ T5752] net_ratelimit: 18 callbacks suppressed [ 595.657268][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.289994][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.636556][T21763] syzkaller1: entered promiscuous mode [ 596.642761][T21763] syzkaller1: entered allmulticast mode [ 596.654134][T21765] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3899'. [ 596.663404][T21765] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 596.685499][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.713067][T21765] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 596.754964][T21766] netlink: 1444 bytes leftover after parsing attributes in process `syz.2.3899'. [ 597.385020][T21774] bond8: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 597.517747][T21774] bond8 (unregistering): Released all slaves [ 597.544933][T21777] netlink: 'syz.4.3903': attribute type 29 has an invalid length. [ 597.568746][T21787] netlink: 'syz.2.3902': attribute type 32 has an invalid length. [ 597.584613][T21787] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3902'. [ 597.727915][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.912767][T21784] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 598.027200][T21784] tipc: Resetting bearer [ 598.111017][T21784] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 598.172522][T21784] bond1: left promiscuous mode [ 598.189917][T21784] bridge1: left promiscuous mode [ 598.198899][T21784] vlan2: left allmulticast mode [ 598.212044][T21784] bond1: left allmulticast mode [ 598.222178][T21784] bridge1: left allmulticast mode [ 598.251796][T21785] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 598.287496][T21798] netlink: 'syz.4.3908': attribute type 3 has an invalid length. [ 598.297535][T21787] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 598.302534][T20394] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.333940][T20394] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.360970][T20394] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.380221][T20394] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.440204][T20394] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.468717][T20394] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.511563][T20394] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.535913][T20394] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.562614][T21803] can: request_module (can-proto-0) failed. [ 598.599404][T21810] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3912'. [ 598.655087][T21812] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3913'. [ 598.767909][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.771700][T21817] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3913'. [ 598.916730][T21812] 8021q: adding VLAN 0 to HW filter on device bond8 [ 598.957691][T21818] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 598.976618][T21812] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3913'. [ 599.041527][T21826] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3916'. [ 599.058150][T21818] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 599.166665][T21826] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 599.278468][T21834] can: request_module (can-proto-0) failed. [ 599.322872][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 599.387308][T21843] sctp: [Deprecated]: syz.3.3920 (pid 21843) Use of int in max_burst socket option deprecated. [ 599.387308][T21843] Use struct sctp_assoc_value instead [ 599.404047][T21840] sctp: [Deprecated]: syz.3.3920 (pid 21840) Use of int in max_burst socket option deprecated. [ 599.404047][T21840] Use struct sctp_assoc_value instead [ 599.607527][T21859] batman_adv: batadv0: Interface deactivated: dummy0 [ 599.620718][T21859] batman_adv: batadv0: Removing interface: dummy0 [ 599.683566][T21859] bridge_slave_0: left allmulticast mode [ 599.701385][T21859] bridge_slave_0: left promiscuous mode [ 599.712676][T21859] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.724891][T21859] bridge_slave_1: left allmulticast mode [ 599.744384][T21859] bridge_slave_1: left promiscuous mode [ 599.774040][T21859] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.809120][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 599.822792][T21859] bond0: (slave bond_slave_0): Releasing backup interface [ 599.835749][T21859] bond0: (slave bond_slave_1): Releasing backup interface [ 599.857135][T21859] team0: Port device team_slave_0 removed [ 599.881896][T21859] team0: Port device team_slave_1 removed [ 599.901667][T21859] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.920411][T21859] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 599.936760][T21859] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 599.951837][T21859] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 599.962486][T21859] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 599.981652][ T5752] dummy0 speed is unknown, defaulting to 1000 [ 600.000694][T21861] smc: net device wlan0 applied user defined pnetid SYZ0 [ 600.094292][T21874] team0: Port device xfrm0 added [ 600.198161][T21886] lo speed is unknown, defaulting to 1000 [ 600.485870][T21908] can: request_module (can-proto-0) failed. [ 600.849226][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 600.865926][T21926] can: request_module (can-proto-0) failed. [ 600.945429][T21886] dummy0 speed is unknown, defaulting to 1000 [ 601.064388][T21936] netlink: 316 bytes leftover after parsing attributes in process `syz.4.3946'. [ 601.077994][T21937] netlink: 596 bytes leftover after parsing attributes in process `syz.0.3945'. [ 601.108597][T21941] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 601.173813][T21939] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3947'. [ 601.374664][T21951] netlink: 'syz.4.3949': attribute type 30 has an invalid length. [ 601.410837][T20394] batadv1: left promiscuous mode [ 601.903375][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.054487][T21970] can: request_module (can-proto-0) failed. [ 602.270288][T21980] tun0: tun_chr_ioctl cmd 1074025681 [ 602.293057][T21991] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3963'. [ 602.325235][T21980] veth1_to_bond: entered promiscuous mode [ 602.363375][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.382522][T21982] veth1_to_bond: entered allmulticast mode [ 602.401690][T21980] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3960'. [ 602.491894][T21980] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3960'. [ 602.522268][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.563373][T22002] netlink: 'syz.1.3965': attribute type 7 has an invalid length. [ 602.607647][T21980] veth1_to_bond (unregistering): left promiscuous mode [ 602.633433][T21980] veth1_to_bond (unregistering): left allmulticast mode [ 602.633648][T21999] netlink: 'syz.1.3965': attribute type 7 has an invalid length. [ 602.660469][T21980] bond0: (slave bond_slave_1): Releasing backup interface [ 602.688033][T21991] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3963'. [ 602.690486][T22006] sctp: [Deprecated]: syz.1.3965 (pid 22006) Use of int in maxseg socket option. [ 602.690486][T22006] Use struct sctp_assoc_value instead [ 602.784298][ T1020] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.807256][ T1020] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.842987][ T1020] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.861357][ T1020] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.920056][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.172580][ T1649] block nbd12: Possible stuck request ffff888026ebe000: control (read@0,1024B). Runtime 150 seconds [ 603.183901][ T1649] block nbd12: Possible stuck request ffff888026ebe1c0: control (read@1024,1024B). Runtime 150 seconds [ 603.195397][ T1649] block nbd12: Possible stuck request ffff888026ebe380: control (read@2048,1024B). Runtime 150 seconds [ 603.206979][ T1649] block nbd12: Possible stuck request ffff888026ebe540: control (read@3072,1024B). Runtime 150 seconds [ 603.238260][T22026] netlink: 'syz.0.3971': attribute type 14 has an invalid length. [ 603.295169][T22034] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3973'. [ 603.298715][T22025] netlink: 'syz.3.3970': attribute type 1 has an invalid length. [ 603.460070][T22037] can: request_module (can-proto-0) failed. [ 603.752489][T22062] xt_addrtype: ipv6 does not support BROADCAST matching [ 603.970158][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.040724][T22075] IPVS: set_ctl: invalid protocol: 43 255.255.255.255:20001 [ 604.072754][T22076] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3985'. [ 604.113212][T22076] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3985'. [ 604.263587][T22083] vlan2: left allmulticast mode [ 604.281237][T22083] geneve0: left allmulticast mode [ 604.301235][T22083] vlan2: left promiscuous mode [ 604.331973][T22083] geneve0: left promiscuous mode [ 604.361895][T22083] bridge0: port 3(vlan2) entered disabled state [ 604.394240][T22083] bridge_slave_1: left allmulticast mode [ 604.416945][T22083] bridge_slave_1: left promiscuous mode [ 604.436248][T22083] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.467015][T22083] bridge_slave_0: left allmulticast mode [ 604.480462][T22083] bridge_slave_0: left promiscuous mode [ 604.489359][T22083] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.953267][T22121] lo speed is unknown, defaulting to 1000 [ 605.011324][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.213395][T22156] netlink: 'syz.2.4005': attribute type 1 has an invalid length. [ 605.392041][T22121] dummy0 speed is unknown, defaulting to 1000 [ 605.393057][T22146] lo speed is unknown, defaulting to 1000 [ 605.411358][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.967646][T22146] dummy0 speed is unknown, defaulting to 1000 [ 605.992923][T22188] netlink: 'syz.2.4013': attribute type 1 has an invalid length. [ 606.040248][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.071003][T22188] bond3: entered promiscuous mode [ 606.084054][T22188] 8021q: adding VLAN 0 to HW filter on device bond3 [ 606.165701][T22188] 8021q: adding VLAN 0 to HW filter on device bond3 [ 606.183103][T22188] bond3: (slave xfrm1): The slave device specified does not support setting the MAC address [ 606.211244][T22188] bond3: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 606.237849][T22188] bond3: (slave xfrm1): making interface the new active one [ 606.255644][T22188] xfrm1: entered promiscuous mode [ 606.271620][T22188] xfrm1: left promiscuous mode [ 606.494360][T22195] __nla_validate_parse: 11 callbacks suppressed [ 606.494380][T22195] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4015'. [ 607.097055][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.137644][T22228] IPv6: NLM_F_CREATE should be specified when creating new route [ 607.431382][T22227] macsec1: entered promiscuous mode [ 607.767719][ T5784] IPVS: starting estimator thread 0... [ 607.869987][T22244] IPVS: using max 55 ests per chain, 132000 per kthread [ 608.125221][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.446023][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.588165][T22275] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4033'. [ 608.765544][T22283] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4033'. [ 608.798222][T22283] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4033'. [ 608.808482][T22267] 8021q: adding VLAN 0 to HW filter on device bond0 [ 608.845127][T22267] 8021q: adding VLAN 0 to HW filter on device team0 [ 608.858027][T22267] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 608.952979][T22267] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 608.990321][T22267] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 609.018337][T22267] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 609.036379][T22299] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4041'. [ 609.047409][T22267] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 609.164957][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.177615][T22290] lo speed is unknown, defaulting to 1000 [ 609.284412][T22307] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4043'. [ 609.361609][T22313] netlink: 'syz.0.4045': attribute type 5 has an invalid length. [ 609.716354][T22336] IPVS: set_ctl: invalid protocol: 55 10.1.1.1:20001 [ 609.729169][T22338] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4052'. [ 609.785007][T22290] dummy0 speed is unknown, defaulting to 1000 [ 609.807094][T22341] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4055'. [ 609.818675][T22341] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 609.845864][T22338] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4052'. [ 609.879646][T22341] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4055'. [ 609.924605][T22341] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 609.951840][T22339] lo speed is unknown, defaulting to 1000 [ 610.024316][T22347] bond2: option xmit_hash_policy: invalid value (10) [ 610.039479][T22347] bond2 (unregistering): Released all slaves [ 610.206355][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.216422][T17385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.275867][T22361] bond0: option arp_interval: mode dependency failed, not supported in mode balance-alb(6) [ 610.380210][T22361] IPVS: ip_vs_add_dest(): server weight less than zero [ 610.723578][T22339] dummy0 speed is unknown, defaulting to 1000 [ 611.268870][ T9] net_ratelimit: 2 callbacks suppressed [ 611.268888][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.437361][T22403] geneve3: entered promiscuous mode [ 611.480296][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.511850][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.520661][T17385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.535251][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.551602][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.972143][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.991524][T20394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.132676][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.310163][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.888031][T22450] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 612.908580][T22450] syzkaller1: linktype set to 1 [ 613.078672][T22460] xt_l2tp: missing protocol rule (udp|l2tpip) [ 614.174934][T22519] __nla_validate_parse: 5 callbacks suppressed [ 614.174954][T22519] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4099'. [ 614.592471][T22547] xt_recent: hitcount (4294967294) is larger than allowed maximum (65535) [ 614.601516][T22535] bond2: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 614.630301][T22535] bond2 (unregistering): Released all slaves [ 614.853137][T22566] netlink: 'syz.3.4108': attribute type 8 has an invalid length. [ 614.862168][T22564] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4107'. [ 614.911643][T22568] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4108'. [ 615.145151][ T5719] dummy0 speed is unknown, defaulting to 1000 [ 615.151497][ T5719] syz1: Port: 1 Link DOWN [ 615.196061][T20394] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 615.227140][T20394] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.272624][T20394] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 615.298002][T20394] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.322320][ T5719] dummy0 speed is unknown, defaulting to 1000 [ 615.372043][T20394] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 615.395239][T20394] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.404742][T20394] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 615.414115][T20394] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.535042][T22581] lo speed is unknown, defaulting to 1000 [ 615.667311][T22595] tipc: Started in network mode [ 615.674154][T22595] tipc: Node identity 0a1146e46c5d, cluster identity 4711 [ 615.692335][T22595] tipc: Enabled bearer , priority 0 [ 615.762055][T22602] Bluetooth: MGMT ver 1.23 [ 615.781470][T22595] syzkaller0: entered promiscuous mode [ 615.787121][T22595] syzkaller0: entered allmulticast mode [ 615.794938][T22595] tipc: Resetting bearer [ 615.852942][T22602] bond4: Removing last arp target with arp_interval on [ 615.868927][T22595] tipc: Resetting bearer [ 616.930619][ C1] net_ratelimit: 11 callbacks suppressed [ 616.930633][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.002580][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.258584][ T6106] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.268494][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.277751][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 618.045734][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 618.276046][T22595] tipc: Disabling bearer [ 618.285159][T22581] dummy0 speed is unknown, defaulting to 1000 [ 618.300944][T18303] tipc: Node number set to 1716274916 [ 618.406260][ T30] audit: type=1800 audit(1782476316.825:16): pid=22622 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4125" name="blkio.bfq.time_recursive" dev="tmpfs" ino=673 res=0 errno=0 [ 618.429757][T22622] xt_recent: hitcount (4294967294) is larger than allowed maximum (65535) [ 618.466363][T22621] syzkaller0: entered promiscuous mode [ 618.482202][T22621] syzkaller0: entered allmulticast mode [ 618.534427][T22621] netlink: 256 bytes leftover after parsing attributes in process `syz.2.4126'. [ 618.819366][T22640] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4131'. [ 618.847079][T22641] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4129'. [ 619.091047][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.112131][T22638] lo speed is unknown, defaulting to 1000 [ 619.234938][T22657] netlink: 'syz.2.4135': attribute type 13 has an invalid length. [ 619.595112][T22638] dummy0 speed is unknown, defaulting to 1000 [ 619.755980][T22681] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4141'. [ 620.029387][T22686] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 620.122904][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.367254][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.663889][T22705] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4149'. [ 620.918151][T22715] netlink: 204 bytes leftover after parsing attributes in process `syz.2.4150'. [ 620.928050][T22715] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4150'. [ 621.167960][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 622.205228][ T9] net_ratelimit: 1 callbacks suppressed [ 622.205246][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 622.848117][T22699] IPv6: sit2: Disabled Multicast RS [ 622.975728][T22725] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4152'. [ 623.006191][T20392] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.021500][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.031568][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.203546][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 623.242941][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.247072][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 623.290218][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 623.305355][T22738] netlink: 'syz.0.4155': attribute type 4 has an invalid length. [ 623.324536][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 623.371360][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 623.379588][T22741] netlink: 'syz.0.4155': attribute type 4 has an invalid length. [ 623.393862][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 623.410412][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 623.422284][T22740] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.432645][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.440239][T22731] netlink: 'syz.3.4153': attribute type 1 has an invalid length. [ 624.285570][T18303] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.342011][T20394] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 624.368488][T22761] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 624.750821][T22783] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4169'. [ 624.795647][T22786] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4167'. [ 624.860194][T22788] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4166'. [ 624.920209][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.940595][T22779] bridge0: port 2(bridge_slave_1) entered disabled state [ 624.948197][T22779] bridge0: port 1(bridge_slave_0) entered disabled state [ 625.244456][T22800] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.4171'. [ 625.339562][ T808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.397035][T22804] netlink: 100 bytes leftover after parsing attributes in process `syz.3.4172'. [ 625.422313][T22779] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 625.519482][T22804] xt_CT: No such helper "netbios-ns" [ 625.698992][T22779] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 625.898437][T22779] veth9: left allmulticast mode [ 625.953487][T22786] bond10: option coupled_control: invalid value (71) [ 625.962395][T22786] bond10 (unregistering): Released all slaves [ 625.981528][T22801] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.4171'. [ 625.999478][T17385] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.045396][T17385] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.068619][T17385] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.085336][T17385] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.120330][T17385] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.145722][T17385] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.169569][T17385] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.200851][T17385] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.246949][T22814] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 626.311528][T22821] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4177'. [ 626.328218][T22821] hsr_slave_0: left promiscuous mode [ 626.341287][T22821] hsr_slave_1: left promiscuous mode [ 626.443951][T22829] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4177'. [ 626.464264][T22838] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 626.581847][T20392] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 626.851573][T22856] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4183'. [ 626.874349][T22848] 8021q: adding VLAN 0 to HW filter on device bond3 [ 627.020862][T22866] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 627.131992][T22866] bond2: Unable to set peer notification delay as MII monitoring is disabled [ 627.152984][T22866] bond2 (unregistering): Released all slaves [ 627.400340][ T5752] net_ratelimit: 3 callbacks suppressed [ 627.400358][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 627.772078][T22910] syzkaller0: entered promiscuous mode [ 627.778603][T22910] syzkaller0: entered allmulticast mode [ 627.864443][T22903] geneve0: entered promiscuous mode [ 627.871400][T22903] macvlan2: entered promiscuous mode [ 628.092635][T22928] syzkaller0: entered promiscuous mode [ 628.105384][T22928] syzkaller0: entered allmulticast mode [ 628.450205][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.481696][T22951] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4215'. [ 628.547563][T22954] gtp0: entered promiscuous mode [ 628.553823][T22954] gtp0: entered allmulticast mode [ 628.587877][T22951] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4215'. [ 628.760569][T20392] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.769529][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.784286][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.837609][T22970] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 628.871679][T22970] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 629.066423][T22981] lo speed is unknown, defaulting to 1000 [ 629.365642][T22981] dummy0 speed is unknown, defaulting to 1000 [ 629.480346][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.819085][T23015] __nla_validate_parse: 1 callbacks suppressed [ 629.819103][T23015] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4233'. [ 629.874505][T23015] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4233'. [ 629.896548][T23019] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4235'. [ 629.908914][T23019] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4235'. [ 629.992711][T23023] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4235'. [ 630.282890][T23034] can: request_module (can-proto-0) failed. [ 630.316898][T19282] dummy0 speed is unknown, defaulting to 1000 [ 630.328253][T19282] syz1: Port: 1 Link ACTIVE [ 630.341028][T23039] xt_recent: hitcount (4294967294) is larger than allowed maximum (65535) [ 630.354678][ T9] dummy0 speed is unknown, defaulting to 1000 [ 630.376701][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 630.520199][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.533003][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.902931][T23062] smc: ib device syz0 ibport 1 applied user defined pnetid SYZ2 [ 631.457493][T23083] x_tables: duplicate underflow at hook 1 [ 631.534757][T23088] netlink: 14 bytes leftover after parsing attributes in process `syz.3.4253'. [ 631.592623][T23089] x_tables: duplicate underflow at hook 3 [ 631.626832][T23088] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 631.659289][T23088] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 631.689325][T23088] bond0 (unregistering): Released all slaves [ 631.739471][T23096] tipc: Enabled bearer , priority 0 [ 631.747940][T23096] syzkaller0: entered promiscuous mode [ 631.757357][T23096] syzkaller0: entered allmulticast mode [ 631.808031][T23096] tipc: Resetting bearer [ 631.827400][T23095] tipc: Resetting bearer [ 631.887172][T23095] tipc: Disabling bearer [ 632.311097][T23115] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4261'. [ 632.340781][T23115] validate_nla: 31 callbacks suppressed [ 632.340888][T23115] netlink: 'syz.1.4261': attribute type 12 has an invalid length. [ 632.434789][ T87] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 632.451994][ T87] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 632.487164][ T87] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 632.522652][ T87] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 632.537671][T23122] net_ratelimit: 3 callbacks suppressed [ 632.537688][T23122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.553598][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.600159][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.654361][T23125] veth1: entered promiscuous mode [ 632.665254][T23125] macsec1: entered promiscuous mode [ 632.677124][T23125] macsec1: entered allmulticast mode [ 632.691366][T23125] veth1: entered allmulticast mode [ 632.723381][T23125] veth1: left allmulticast mode [ 632.734689][T23125] veth1: left promiscuous mode [ 632.787676][T23133] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4265'. [ 632.938875][T23049] Set syz1 is full, maxelem 65536 reached [ 633.199405][T23161] netlink: 'syz.1.4272': attribute type 9 has an invalid length. [ 633.240500][ T1649] block nbd12: Possible stuck request ffff888026ebe000: control (read@0,1024B). Runtime 180 seconds [ 633.253418][ T1649] block nbd12: Possible stuck request ffff888026ebe1c0: control (read@1024,1024B). Runtime 180 seconds [ 633.267576][ T1649] block nbd12: Possible stuck request ffff888026ebe380: control (read@2048,1024B). Runtime 180 seconds [ 633.280371][ T1649] block nbd12: Possible stuck request ffff888026ebe540: control (read@3072,1024B). Runtime 180 seconds [ 633.573898][T23168] "syz.0.4275" (23168) uses obsolete ecb(arc4) skcipher [ 633.609347][T23188] xt_recent: hitcount (4294967294) is larger than allowed maximum (65535) [ 633.642883][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.202697][T23222] netlink: 'syz.3.4290': attribute type 1 has an invalid length. [ 634.211708][T23222] netlink: 'syz.3.4290': attribute type 2 has an invalid length. [ 634.907807][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.915967][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.924435][T17385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.934169][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.946962][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.071562][T23236] netlink: 860 bytes leftover after parsing attributes in process `syz.4.4295'. [ 635.198236][T23248] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4297'. [ 635.261624][T23248] 8021q: adding VLAN 0 to HW filter on device bond3 [ 635.291632][T23248] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4297'. [ 635.326976][T23237] xt_recent: hitcount (4294967294) is larger than allowed maximum (65535) [ 635.596092][T23273] FAULT_INJECTION: forcing a failure. [ 635.596092][T23273] name failslab, interval 1, probability 0, space 0, times 0 [ 635.639910][T23273] CPU: 0 UID: 0 PID: 23273 Comm: syz.2.4306 Not tainted syzkaller #0 PREEMPT(full) [ 635.639938][T23273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 635.639949][T23273] Call Trace: [ 635.639957][T23273] [ 635.639964][T23273] dump_stack_lvl+0xe8/0x150 [ 635.639995][T23273] should_fail_ex+0x40c/0x560 [ 635.640030][T23273] should_failslab+0xa8/0x100 [ 635.640052][T23273] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 635.640078][T23273] ? skb_clone+0x212/0x3a0 [ 635.640183][T23273] ? skb_clone+0x212/0x3a0 [ 635.640207][T23273] skb_clone+0x212/0x3a0 [ 635.640234][T23273] __netlink_deliver_tap+0x413/0x860 [ 635.640268][T23273] ? netlink_deliver_tap+0x2e/0x1b0 [ 635.640295][T23273] netlink_deliver_tap+0x19c/0x1b0 [ 635.640319][T23273] netlink_unicast+0x77f/0x940 [ 635.640349][T23273] netlink_sendmsg+0x813/0xb40 [ 635.640381][T23273] ? __pfx_netlink_sendmsg+0x10/0x10 [ 635.640411][T23273] ? aa_sock_msg_perm+0xf1/0x1b0 [ 635.640440][T23273] ? __pfx_netlink_sendmsg+0x10/0x10 [ 635.640460][T23273] sock_sendmsg_nosec+0x13a/0x180 [ 635.640490][T23273] ____sys_sendmsg+0x54e/0x850 [ 635.640517][T23273] ? __pfx_____sys_sendmsg+0x10/0x10 [ 635.640546][T23273] ? import_iovec+0x73/0xa0 [ 635.640570][T23273] ___sys_sendmsg+0x2a5/0x360 [ 635.640589][T23273] ? __lock_acquire+0x683/0x2cf0 [ 635.640615][T23273] ? __pfx____sys_sendmsg+0x10/0x10 [ 635.640670][T23273] ? __fget_files+0x2a/0x420 [ 635.640688][T23273] ? __fget_files+0x3a2/0x420 [ 635.640717][T23273] __x64_sys_sendmsg+0x1b1/0x290 [ 635.640741][T23273] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 635.640781][T23273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.640803][T23273] do_syscall_64+0x174/0x580 [ 635.640820][T23273] ? trace_irq_disable+0x3b/0x140 [ 635.640839][T23273] ? clear_bhb_loop+0x40/0x90 [ 635.640862][T23273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.640881][T23273] RIP: 0033:0x7f4b5d19ce59 [ 635.640900][T23273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.640916][T23273] RSP: 002b:00007f4b5df9e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 635.640936][T23273] RAX: ffffffffffffffda RBX: 00007f4b5d415fa0 RCX: 00007f4b5d19ce59 [ 635.640950][T23273] RDX: 0000000024000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 635.640963][T23273] RBP: 00007f4b5df9e090 R08: 0000000000000000 R09: 0000000000000000 [ 635.640974][T23273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 635.640986][T23273] R13: 00007f4b5d416038 R14: 00007f4b5d415fa0 R15: 00007fff956c65f8 [ 635.641018][T23273] [ 635.949660][T23283] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4308'. [ 636.063519][T23288] netlink: 27 bytes leftover after parsing attributes in process `syz.2.4310'. [ 636.274919][T23295] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 636.287618][T23295] batman_adv: batadv0: Adding interface: gretap1 [ 636.295446][T23295] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 636.333994][T23295] batman_adv: batadv0: Interface activated: gretap1 [ 636.341302][T23297] netlink: 'syz.2.4313': attribute type 3 has an invalid length. [ 636.497051][T23302] can: request_module (can-proto-0) failed. [ 636.546501][T23309] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4318'. [ 636.604337][ T5627] block nbd3: Receive control failed (result -1) [ 636.641546][T23315] [ 636.643930][T23315] ====================================================== [ 636.651003][T23315] WARNING: possible circular locking dependency detected [ 636.658118][T23315] syzkaller #0 Not tainted [ 636.662574][T23315] ------------------------------------------------------ [ 636.669628][T23315] syz.2.4318/23315 is trying to acquire lock: [ 636.675696][T23315] ffff88813fe7e9b8 (&mm->mmap_lock){++++}-{4:4}, at: gup_fast_fallback+0x20d/0x20e0 [ 636.685223][T23315] [ 636.685223][T23315] but task is already holding lock: [ 636.692591][T23315] ffff8880254f8260 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}, at: tls_sw_sendmsg+0x161/0x2860 [ 636.702370][T23315] [ 636.702370][T23315] which lock already depends on the new lock. [ 636.702370][T23315] [ 636.712764][T23315] [ 636.712764][T23315] the existing dependency chain (in reverse order) is: [ 636.721773][T23315] [ 636.721773][T23315] -> #7 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 636.729960][T23315] lock_sock_nested+0x41/0x100 [ 636.735259][T23315] inet_shutdown+0x6a/0x390 [ 636.740362][T23315] nbd_mark_nsock_dead+0x2cb/0x550 [ 636.746299][T23315] sock_shutdown+0x15e/0x260 [ 636.751402][T23315] nbd_clear_sock+0x24/0x170 [ 636.756567][T23315] nbd_config_put+0x35b/0x660 [ 636.761751][T23315] nbd_genl_connect+0x18f7/0x1c10 [ 636.767285][T23315] genl_family_rcv_msg_doit+0x233/0x340 [ 636.773345][T23315] genl_rcv_msg+0x614/0x7a0 [ 636.778359][T23315] netlink_rcv_skb+0x226/0x4a0 [ 636.783633][T23315] genl_rcv+0x28/0x40 [ 636.788130][T23315] netlink_unicast+0x7bb/0x940 [ 636.793396][T23315] netlink_sendmsg+0x813/0xb40 [ 636.798672][T23315] sock_sendmsg_nosec+0x13a/0x180 [ 636.804212][T23315] ____sys_sendmsg+0x54e/0x850 [ 636.809483][T23315] ___sys_sendmsg+0x2a5/0x360 [ 636.814666][T23315] __x64_sys_sendmsg+0x1b1/0x290 [ 636.820111][T23315] do_syscall_64+0x174/0x580 [ 636.825213][T23315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.831615][T23315] [ 636.831615][T23315] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 636.839251][T23315] __mutex_lock+0x19d/0x1550 [ 636.844353][T23315] nbd_queue_rq+0x373/0x1150 [ 636.849458][T23315] blk_mq_dispatch_rq_list+0x499/0x1990 [ 636.855603][T23315] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 636.862479][T23315] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 636.868965][T23315] blk_mq_run_work_fn+0x16c/0x300 [ 636.874501][T23315] process_scheduled_works+0xa8e/0x14e0 [ 636.880592][T23315] worker_thread+0xa47/0xfb0 [ 636.885694][T23315] kthread+0x388/0x470 [ 636.890271][T23315] ret_from_fork+0x514/0xb70 [ 636.895393][T23315] ret_from_fork_asm+0x1a/0x30 [ 636.900670][T23315] [ 636.900670][T23315] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 636.907873][T23315] __mutex_lock+0x19d/0x1550 [ 636.912970][T23315] nbd_queue_rq+0xc1/0x1150 [ 636.917982][T23315] blk_mq_dispatch_rq_list+0x499/0x1990 [ 636.924056][T23315] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 636.930916][T23315] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 636.937420][T23315] blk_mq_run_work_fn+0x16c/0x300 [ 636.942968][T23315] process_scheduled_works+0xa8e/0x14e0 [ 636.949029][T23315] worker_thread+0xa47/0xfb0 [ 636.954138][T23315] kthread+0x388/0x470 [ 636.958719][T23315] ret_from_fork+0x514/0xb70 [ 636.963828][T23315] ret_from_fork_asm+0x1a/0x30 [ 636.969122][T23315] [ 636.969122][T23315] -> #4 (set->srcu){.+.+}-{0:0}: [ 636.976239][T23315] __synchronize_srcu+0xc9/0x2f0 [ 636.981687][T23315] elevator_switch+0x1e8/0x7b0 [ 636.987070][T23315] elevator_change+0x2fa/0x480 [ 636.992348][T23315] elevator_set_default+0x375/0x440 [ 636.998063][T23315] blk_register_queue+0x3f3/0x4e0 [ 637.003652][T23315] __add_disk+0x6cb/0xe30 [ 637.008504][T23315] add_disk_fwnode+0xfb/0x4b0 [ 637.013696][T23315] nbd_dev_add+0x733/0xb60 [ 637.018623][T23315] nbd_init+0x15f/0x1e0 [ 637.023409][T23315] do_one_initcall+0x250/0x870 [ 637.028692][T23315] do_initcall_level+0x10a/0x1a0 [ 637.034232][T23315] do_initcalls+0x59/0xa0 [ 637.039085][T23315] kernel_init_freeable+0x29d/0x3e0 [ 637.044802][T23315] kernel_init+0x1d/0x1d0 [ 637.049650][T23315] ret_from_fork+0x514/0xb70 [ 637.054753][T23315] ret_from_fork_asm+0x1a/0x30 [ 637.060040][T23315] [ 637.060040][T23315] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 637.067869][T23315] __mutex_lock+0x19d/0x1550 [ 637.072986][T23315] elevator_change+0x1af/0x480 [ 637.078272][T23315] elevator_set_none+0xb5/0x140 [ 637.083649][T23315] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 637.089969][T23315] nbd_start_device+0x189/0xb30 [ 637.095333][T23315] nbd_genl_connect+0x1597/0x1c10 [ 637.100883][T23315] genl_family_rcv_msg_doit+0x233/0x340 [ 637.106961][T23315] genl_rcv_msg+0x614/0x7a0 [ 637.111977][T23315] netlink_rcv_skb+0x226/0x4a0 [ 637.117253][T23315] genl_rcv+0x28/0x40 [ 637.121743][T23315] netlink_unicast+0x7bb/0x940 [ 637.127011][T23315] netlink_sendmsg+0x813/0xb40 [ 637.132282][T23315] sock_sendmsg_nosec+0x13a/0x180 [ 637.137817][T23315] ____sys_sendmsg+0x54e/0x850 [ 637.143088][T23315] ___sys_sendmsg+0x2a5/0x360 [ 637.148269][T23315] __x64_sys_sendmsg+0x1b1/0x290 [ 637.153713][T23315] do_syscall_64+0x174/0x580 [ 637.158810][T23315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.165210][T23315] [ 637.165210][T23315] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 637.173833][T23315] blk_alloc_queue+0x544/0x690 [ 637.179109][T23315] __blk_mq_alloc_disk+0x194/0x390 [ 637.184731][T23315] nbd_dev_add+0x494/0xb60 [ 637.189653][T23315] nbd_init+0x15f/0x1e0 [ 637.194321][T23315] do_one_initcall+0x250/0x870 [ 637.199594][T23315] do_initcall_level+0x10a/0x1a0 [ 637.205039][T23315] do_initcalls+0x59/0xa0 [ 637.209875][T23315] kernel_init_freeable+0x29d/0x3e0 [ 637.215580][T23315] kernel_init+0x1d/0x1d0 [ 637.220420][T23315] ret_from_fork+0x514/0xb70 [ 637.225514][T23315] ret_from_fork_asm+0x1a/0x30 [ 637.230789][T23315] [ 637.230789][T23315] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 637.237985][T23315] fs_reclaim_acquire+0x71/0x100 [ 637.243427][T23315] kmem_cache_alloc_noprof+0x64/0x5f0 [ 637.249310][T23315] mas_alloc_nodes+0x291/0x350 [ 637.254666][T23315] mas_preallocate+0x2cf/0x630 [ 637.259948][T23315] vma_link+0x123/0x470 [ 637.264610][T23315] insert_vm_struct+0x1bf/0x290 [ 637.269968][T23315] create_init_stack_vma+0x5c1/0x9b0 [ 637.275760][T23315] alloc_bprm+0x506/0x640 [ 637.280596][T23315] kernel_execve+0x85/0x9c0 [ 637.285605][T23315] try_to_run_init_process+0x13/0x60 [ 637.291419][T23315] kernel_init+0xad/0x1d0 [ 637.296254][T23315] ret_from_fork+0x514/0xb70 [ 637.301348][T23315] ret_from_fork_asm+0x1a/0x30 [ 637.306618][T23315] [ 637.306618][T23315] -> #0 (&mm->mmap_lock){++++}-{4:4}: [ 637.314166][T23315] __lock_acquire+0x1520/0x2cf0 [ 637.319521][T23315] lock_acquire+0x106/0x350 [ 637.324528][T23315] gup_fast_fallback+0x226/0x20e0 [ 637.330062][T23315] __iov_iter_get_pages_alloc+0x378/0xa40 [ 637.336293][T23315] iov_iter_get_pages2+0x5e/0xa0 [ 637.341744][T23315] sk_msg_zerocopy_from_iter+0x21b/0x8c0 [ 637.347967][T23315] tls_sw_sendmsg+0x10d5/0x2860 [ 637.353330][T23315] sock_sendmsg_nosec+0x90/0x180 [ 637.358781][T23315] __sys_sendto+0x408/0x5a0 [ 637.363823][T23315] __x64_sys_sendto+0xde/0x100 [ 637.369094][T23315] do_syscall_64+0x174/0x580 [ 637.374195][T23315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.380653][T23315] [ 637.380653][T23315] other info that might help us debug this: [ 637.380653][T23315] [ 637.390862][T23315] Chain exists of: [ 637.390862][T23315] &mm->mmap_lock --> &nsock->tx_lock --> sk_lock-AF_INET6-NBD [ 637.390862][T23315] [ 637.404308][T23315] Possible unsafe locking scenario: [ 637.404308][T23315] [ 637.411762][T23315] CPU0 CPU1 [ 637.417167][T23315] ---- ---- [ 637.422526][T23315] lock(sk_lock-AF_INET6-NBD); [ 637.427369][T23315] lock(&nsock->tx_lock); [ 637.434296][T23315] lock(sk_lock-AF_INET6-NBD); [ 637.441654][T23315] rlock(&mm->mmap_lock); [ 637.446056][T23315] [ 637.446056][T23315] *** DEADLOCK *** [ 637.446056][T23315] [ 637.454180][T23315] 2 locks held by syz.2.4318/23315: [ 637.459427][T23315] #0: ffff88805a84a8e8 (&ctx->tx_lock){+.+.}-{4:4}, at: tls_sw_sendmsg+0x13c/0x2860 [ 637.468947][T23315] #1: ffff8880254f8260 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}, at: tls_sw_sendmsg+0x161/0x2860 [ 637.479032][T23315] [ 637.479032][T23315] stack backtrace: [ 637.484912][T23315] CPU: 0 UID: 0 PID: 23315 Comm: syz.2.4318 Not tainted syzkaller #0 PREEMPT(full) [ 637.484930][T23315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 637.484939][T23315] Call Trace: [ 637.484947][T23315] [ 637.484955][T23315] dump_stack_lvl+0xe8/0x150 [ 637.484974][T23315] print_circular_bug+0x2e1/0x300 [ 637.484995][T23315] check_noncircular+0x12e/0x150 [ 637.485016][T23315] __lock_acquire+0x1520/0x2cf0 [ 637.485033][T23315] ? __update_page_owner_handle+0x5a/0x570 [ 637.485050][T23315] ? __update_page_owner_handle+0x5a/0x570 [ 637.485064][T23315] ? __update_page_owner_handle+0x51a/0x570 [ 637.485080][T23315] ? __page_table_check_zero+0x6a/0x3e0 [ 637.485105][T23315] ? gup_fast_fallback+0x20d/0x20e0 [ 637.485123][T23315] lock_acquire+0x106/0x350 [ 637.485138][T23315] ? gup_fast_fallback+0x20d/0x20e0 [ 637.485156][T23315] ? __page_table_check_zero+0x6a/0x3e0 [ 637.485179][T23315] ? __page_table_check_zero+0x397/0x3e0 [ 637.485201][T23315] ? __page_table_check_zero+0x6a/0x3e0 [ 637.485223][T23315] ? gup_fast_fallback+0x20d/0x20e0 [ 637.485241][T23315] gup_fast_fallback+0x226/0x20e0 [ 637.485259][T23315] ? gup_fast_fallback+0x20d/0x20e0 [ 637.485278][T23315] ? get_page_from_freelist+0x2212/0x2270 [ 637.485295][T23315] ? kernel_text_address+0xa5/0xe0 [ 637.485315][T23315] ? unwind_get_return_address+0x4d/0x90 [ 637.485359][T23315] ? __pfx_gup_fast_fallback+0x10/0x10 [ 637.485376][T23315] ? stack_trace_save+0xa9/0x100 [ 637.485405][T23315] ? is_valid_gup_args+0x11f/0x200 [ 637.485423][T23315] ? get_user_pages_fast+0x4d/0xb0 [ 637.485442][T23315] __iov_iter_get_pages_alloc+0x378/0xa40 [ 637.485459][T23315] ? __alloc_frozen_pages_noprof+0x1db/0x380 [ 637.485476][T23315] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 637.485493][T23315] iov_iter_get_pages2+0x5e/0xa0 [ 637.485509][T23315] sk_msg_zerocopy_from_iter+0x21b/0x8c0 [ 637.485524][T23315] ? __lock_acquire+0x683/0x2cf0 [ 637.485543][T23315] ? alloc_pages_noprof+0x13b/0x2a0 [ 637.485560][T23315] ? __pfx_sk_msg_zerocopy_from_iter+0x10/0x10 [ 637.485586][T23315] tls_sw_sendmsg+0x10d5/0x2860 [ 637.485621][T23315] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 637.485641][T23315] ? __might_fault+0xaf/0x130 [ 637.485661][T23315] ? __pfx_aa_sk_perm+0x10/0x10 [ 637.485677][T23315] ? sock_rps_record_flow+0x19/0x350 [ 637.485699][T23315] ? inet_send_prepare+0x5b/0x260 [ 637.485721][T23315] ? inet6_sendmsg+0x101/0x120 [ 637.485775][T23315] ? __pfx_inet6_sendmsg+0x10/0x10 [ 637.485790][T23315] sock_sendmsg_nosec+0x90/0x180 [ 637.485812][T23315] __sys_sendto+0x408/0x5a0 [ 637.485828][T23315] ? __pfx___sys_sendto+0x10/0x10 [ 637.485852][T23315] ? do_user_addr_fault+0xc4a/0x1340 [ 637.485870][T23315] __x64_sys_sendto+0xde/0x100 [ 637.485884][T23315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.485900][T23315] do_syscall_64+0x174/0x580 [ 637.485915][T23315] ? trace_irq_disable+0x3b/0x140 [ 637.485929][T23315] ? clear_bhb_loop+0x40/0x90 [ 637.485945][T23315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.485961][T23315] RIP: 0033:0x7f4b5d15d68e [ 637.485976][T23315] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 637.485989][T23315] RSP: 002b:00007f4b5df7be88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 637.486005][T23315] RAX: ffffffffffffffda RBX: 00007f4b5df7d6c0 RCX: 00007f4b5d15d68e [ 637.486017][T23315] RDX: 0000000000000020 RSI: 00007f4b5df7c000 RDI: 0000000000000004 [ 637.486026][T23315] RBP: 0000000000000000 R08: 00007f4b5df7bf04 R09: 000000000000000c [ 637.486036][T23315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 637.486045][T23315] R13: 00007f4b5df7bf58 R14: 00007f4b5df7c000 R15: 0000000000000000 [ 637.486062][T23315] [ 637.893857][ T9] net_ratelimit: 1 callbacks suppressed [ 637.893875][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.000864][T23309] Cannot find add_set index 2 as target [ 638.040077][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.359969][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 638.923262][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.964098][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.280073][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.920698][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.970463][ T4990] udevd[4990]: worker [5646] /devices/virtual/block/nbd12 timeout; kill it [ 640.979137][ T4990] udevd[4990]: seq 25594 '/devices/virtual/block/nbd12' killed [ 641.003396][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.079976][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.043717][T19282] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.082963][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.122999][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.131468][ T5719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.163943][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.211695][ T5752] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog