last executing test programs: 2.093195354s ago: executing program 4 (id=6673): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0xfdfffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002e00000084000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000220000000000000080000006b1189000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) 1.756485072s ago: executing program 4 (id=6680): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1883dfbbce9b2d33f000fcff08"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000611082000000000095"], &(0x7f0000000140)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) socketpair(0x1, 0x5, 0xeee3, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r1) sendmsg$key(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[], 0x30}}, 0x4080) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000e98b6325a0ae518ca3e6343a9989634174cd32c80332c96b06a522f6c0d2f7b57dd221225dab22b95fffcd86059d96b0605125d44b9d8a049a9a3d3e00ef3e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.720096071s ago: executing program 4 (id=6682): bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@fallback, 0xffffffffffffffff, 0x5}, 0x20) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="6801000000010104000000000000000002003a00080003400000100e080007400000000024000280140001800800010000000000080002007f0000010c00028005000100000000001400108008000140000000000800024000000000240001801400018008000100e000000108000200e00000010c000280050001000000000034000f800800014000000f7508000140fffffffd08000340000009c70800034000000081080002"], 0x168}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r1, 0x4048587b, &(0x7f0000000f00)={{r0, &(0x7f0000000100)='syz2\x00', 0x404c1, &(0x7f0000000140)={@align=0xaf2, {0x6, 0x2, 0x3ff, 0x101}}, 0x7dd2, &(0x7f0000000180)={@_ha_fsid}, &(0x7f00000001c0)=0xfffffffe}, 0xa, &(0x7f0000000dc0)=[{0x3, 0xdc, &(0x7f0000000280)='osf\x00', &(0x7f00000002c0)="cb3ac02e21ac656b45d118b7b249bd3d059c5fe3c685e842ac289fa88b2915b34360f5b69f2bc36aaa9e48863551dfb711c41de50147b93a186b963618c3983819f5c3e272ebef4d750c76befeb304fe7b73b47cef30b57dd9229edbed7f0692379bbaa7ec35845e1fa11137b905688bbc0d8de20975dfd9ee7372fc58b83c5b369e93dc26f2b526846f7252fc5652a81c2577ffc8f3b66b707b94d81c8362f04e397983063cb1dd4cd149dfdea5c3f70a01d5a86a339eaa6f38362c58c73b2c6829f514a6fbbdf2b26c9987d2bad610d9ae854069e6e02564c8b90c476d0dff50686b6c38494c9b1ebfafc76e74ac27603baaa16bad74eb33d5", 0xfa, 0x12}, {0x3, 0x5, &(0x7f00000003c0)='byteorder\x00', &(0x7f0000000400)="eea5dabd13513b1ad91db91f394b6cc87b88823bf60887396a7c1d31a20501c9866e701203d329957a6dc6f8d969", 0x2e, 0x2a}, {0x1, 0x8000000, &(0x7f0000000440)='byteorder\x00', &(0x7f0000000480)="b031651b0202753a6808fdd124ae567704fe2a7524a2fb4b5ca45fa37c971c42d2665ce7720c310cc36395da9b87371712b56af7ba46e480156d154486d59fcd6dcf29356a7154b3e2ab743b1e983cffd107d94e5de648c0c7441dda40d8fe", 0x5f, 0x20}, {0x3, 0x6, &(0x7f0000000500)='\x00', &(0x7f0000000540)="aa5e632bc452b2b88ce4b1d72c5673ab58ab14a699db68bfa51a8f5b036fde5ebe74ab788dde74101a59af89382557785650a6f6e1238cd9c7c4289e0e860e482c1115615a4dbf2b66e985f6760ef9b23e089a61a076feda7a7a9b72f323ae173145f285fddc6a918ec0eeaa71cade79f97382c3f131b26e307baaaf17655604f1bfca96195d41292094430e7c82e54fcaba07b14d36524c654d9049e287ebb8e790a7a65d4ec30aba64f3e0154f6565f5fbede5d9cd76d454968442e9bac66c252efacbf25e20703107784d69a53631f522e4d3", 0xd4, 0xc}, {0x2, 0x24000, &(0x7f0000000640)='/\x00', &(0x7f0000000680)="e06856549446418988f03ae79b4ce3d24a04ecc62733c233ede0781967e5c677591ad0b6281aa45ad5b25cb0a01f0ddf1bd43fecc31c3e590edf9412624021bbab8fbe8a5733a26c1b1c2f58f46bc302e88e86d34ea85eb941f1ba3c440a4300fb98aa9d331424d005146ec6605def1e1706c2a6a80d84fd2be2e507aa3c6f4a36f1f5b9f4728892f2ca6b8f161f3ec9adce32e277e67f12f1f0449d38ee6162fecbd3330966", 0xa6, 0x2}, {0x3, 0xf, &(0x7f0000000740)='{\\)+../#\x00', &(0x7f0000000780)="cc2dfff7853745d8efb6d799b421b379f312624dcd4d2a1f20efbcd168519a8bceaefc85a89ad48fd98ad66efd8015a3cc61e3e62337dec74b400cd2eb", 0x3d, 0x2}, {0x3, 0x6, &(0x7f00000007c0)='byteorder\x00', &(0x7f0000000940)="e46f5e578cc7e81129fee7c621f4d3f08a8f0f5e85ff1c0f61e82ef1f9aa00e8ffc86afe6356ff851920ae065becc8537db25d015a265fa09e7e33ad4c94dfee5f5ec46fefe5cdb0b5b6eb9b1dd30848c92bad5c8211cd2a18ba3de877889b2ebee16a83986982a3eca153a3b46e98951954c5130503bf47d71a8e522347368d74142d2d81c991e827d73bec24371d66c7a73facb9cb01cd8507118c21c07641b3e663970c4a595aa12a07dcbf8815b748fabcbf472dc26cb877dc175cdb3b3698ba4cf1f7f54ad30e3720dfd0b29cf5da28a10907ba9dffd85ff7", 0xdb, 0x2}, {0x1, 0x4, &(0x7f0000000a40)='osf\x00', &(0x7f0000000a80)="a97428c167bb387fd530abd0e56ecf7cdd61a440d8977e5bfdc943a191666531f2ada30c6048c560f5d4df39fc25cd537d236969846450e151551cff45a4df8875540749533ebe1357697984351d594c8017989b93120b39083015ec8a9340a26311668cbb2bb2241c09187078c06bdc09adcd9f28984446be7d6cc1b63bd59dbf1bf9480f77708023a02814bb64bd00389156d25c674731261fb16141a59a96fc959e9b491356346c894ee8b93ec82cb06a0fbbc9910bac33a9a0570a95dd4c240db91dfbfe52c3867adc33a5c740b45cfc141505be3e3a026ced56", 0xdc, 0x8}, {0x2, 0x8, &(0x7f0000000b80)=':$\xed[\x91]\x00', &(0x7f0000000bc0)="a96badf9ad942835ad", 0x9, 0x22}, {0x2, 0xef8611f, &(0x7f0000000c00)='syz2\x00', &(0x7f0000000c40)="4ca735d89febcc43dcb912c89ab460098da0622c9c215e2808b0ceb7d06e4d02fc16ace5f4f335f1c8e380f342a3584af9e7f9", 0x33}]}) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4004044}, 0x44044) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000001100)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000010c0)={&(0x7f0000000f80)={0x10c, 0x2, 0x1, 0x101, 0x0, 0x0, {0x3}, [@CTA_TUPLE_REPLY={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @broadcast}}}]}, @CTA_TUPLE_MASTER={0x20, 0xe, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @empty}}}]}, @CTA_HELP={0x14, 0x5, 0x0, 0x1, {0xe, 0x1, 'snmp_trap\x00'}}, @CTA_TUPLE_MASTER={0x38, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_LABELS={0x24, 0x16, 0x1, 0x0, [0x9, 0x6, 0x43e, 0x5, 0x4, 0x5, 0x2, 0x4]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x81}, 0x800) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x18, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}, 0x1, 0x0, 0x0, 0x850}, 0x0) 1.675861882s ago: executing program 3 (id=6683): r0 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000240), 0x0, 0x0, 0x0, 0x7400}, 0x5931a207a26eb3d6) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r2 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) r3 = socket$rds(0x15, 0x5, 0x0) recvmsg(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x46}, 0x2083) socket$kcm(0x2a, 0x2, 0x0) getpeername(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000180)) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getpeername$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000000c0)=0x14) r8 = getuid() setsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000400)={{{@in=@broadcast, @in6=@private2, 0x4e20, 0x0, 0x4e22, 0x0, 0xa, 0x40, 0x20, 0xb, r7, r8}, {0x7, 0x6, 0x6, 0x7, 0x7, 0xa, 0x9, 0xe}, {0x7, 0x5, 0x7, 0x3}, 0xeee, 0x6e6bb8, 0x2, 0x0, 0x0, 0x1}, {{@in=@remote, 0x4d4, 0x2b}, 0x2, @in=@local, 0x3506, 0x1, 0x3, 0x8, 0x7f, 0xe, 0x8000}}, 0xe8) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_ctinfo={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x0, 0x0, 0x0, 0x800000}}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x2}]}, {0xffffffffffffff93}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x4e20, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}, 0xa}}}, &(0x7f00000002c0)=0x20) sendmmsg$inet_sctp(r4, &(0x7f0000006ac0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=[@sndinfo={0x20, 0x84, 0x2, {0x4, 0x4, 0x7fffffff, 0x62094c52, r6}}], 0x20, 0x80}], 0x1, 0x4040004) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x7c, 0x30, 0x1, 0x0, 0x0, {}, [{0x68, 0x1, [@m_vlan={0x64, 0x1, 0x0, 0x0, {{0x9}, {0x38, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5}, @TCA_VLAN_PUSH_VLAN_ID={0x6}, @TCA_VLAN_PARMS={0x1c, 0x2, {{}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}]}, {0x57}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) 1.608430097s ago: executing program 4 (id=6684): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)={0x30, r2, 0x21, 0x72bd25, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x10, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x6, 0x2, [{0x6, 0x1}, {0x3, 0x9}]}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x20, r2, 0x8, 0x70bd28, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x4, 0x4b}}}}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x400, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x5}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x50}, @TCA_FQ_PIE_ECN={0x8, 0xa, 0x1}]}}]}, 0x44}}, 0x400c4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)={0x1c, r7, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x40800) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x74, r7, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan1\x00'}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x37}}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xa}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xfd}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x51}]}, 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_WPAN_PHY(r8, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="921d26bd7000fedbdf250000000008000300", @ANYRES32=r10, @ANYBLOB="08000300", @ANYRES32=r11, @ANYBLOB="0800010003000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x8001) r12 = socket$netlink(0x10, 0x3, 0x0) r13 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r13, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xfffffffffffffff9) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r14, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r15 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="200000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="9128040000000000"], 0x20}}, 0x8000) sendmsg$inet(r15, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 1.590012478s ago: executing program 3 (id=6685): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2057, 0x2021}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}, @IFLA_IFNAME={0x14}]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, 0x0, 0xc854) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000180)=0x4010000, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendfile(0xffffffffffffffff, r2, 0x0, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, 0x0, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r8, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) ioctl$BTRFS_IOC_WAIT_SYNC(r8, 0x40089416, 0x0) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000005dc0)={0x1f, @none, 0x11}, 0xa) shutdown(r8, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$netlink(0x10, 0x3, 0x8) sendmsg$nl_generic(r9, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="08010000280002002cbd7000fcdbdf251500f76e02c27383bc7fa81d90af000095454dfb2630980621dbee288111d5f46fb5d6e0fe3ff95a3910d76e908e5a397203b3db5f090cfe9dea4a476c381148ae8d07c29556bd7a19c8f119a23c0a169b7fb0f06140752e7f6b31f8ace91d7ee2b64985b0c1721e893fa8afaa169b19875b690056b9f3b843030f65af7c60bb77a3f0252e5991ef004e6e6bef23a7edac27598b9651e8b92e67ccdcc1eedfc15b7980621eb9d93be7bdaa819018be90d1e37e2c18ec29b52b88974ff7aebf806ab9a1e3eff769a08cf8ed7fba65ac43e38fefbe346003b719406eb06fae6ea4a832c39e100d84e20532d51e5c3c14003200fe8000000000000000000000000000aa0000afe9820c5045b8e6cf81203ba34007ab4c58ed390403f022a2f185c0cf0ed45285b565f32a163fd8f99cea71794adcea30df836ac4e350096c318284ce9a4d35fde9a5bbf9a9d42139eccd"], 0x108}, 0x1, 0x0, 0x0, 0x800}, 0x800) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008000200", @ANYRES32], 0x1c}}, 0x20000080) 1.398363246s ago: executing program 0 (id=6688): socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0}, 0x10) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0x20, 0x0, 0x0) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000000)={0x2, 0xffffffffffffff7f, 0x1}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0xd, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x6, 0x0, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc084}, 0x44080) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newtfilter={0x84, 0x2c, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x2, 0xfff3}, {0xfff3, 0x4}, {0x7, 0x6}}, [@TCA_RATE={0x6, 0x5, {0x5, 0x6}}, @TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_CHAIN={0x8, 0xb, 0x2}, @filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_KEY_ARP_SIP_MASK={0x8, 0x3a, 0xffffff00}, @TCA_FLOWER_KEY_UDP_DST_MASK={0x6}, @TCA_FLOWER_KEY_MPLS_TTL={0x5, 0x43, 0xff}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT={0x6}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT={0x6}, @TCA_FLOWER_KEY_ICMPV4_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_CVLAN_ETH_TYPE={0x6, 0x4f, 0x88a8}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x55}, 0x4000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={0xffffffffffffffff, r4, 0x25, 0xf9968fae722cdfba, @val=@netfilter={0x1}}, 0x20) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, 0x0, &(0x7f0000000100)=0x20) socket$inet_sctp(0x2, 0x1, 0x84) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000001280)=0x10) r5 = socket$netlink(0x10, 0x3, 0x10) socket$l2tp(0x2, 0x2, 0x73) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) r9 = socket(0x1e, 0x5, 0x0) connect$tipc(r9, &(0x7f0000000040)=@name={0x1e, 0x2, 0x3, {{0x41, 0x3}, 0x4}}, 0xfffffed6) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000700000008000300", @ANYRES32=r8, @ANYBLOB="140004006e6963766630000000000000000000000800050007"], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2400c890) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000340)=0xc) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380)=r10, 0x12) 1.397980441s ago: executing program 4 (id=6689): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000300)={{r0, &(0x7f0000000040)='memory.events\x00', 0x38e80, &(0x7f0000000180)={@_ha_fsid={[0x9, 0x200]}, {0x7, 0x5, 0x800, 0xa}}, 0x29, 0x0, &(0x7f0000000400)=0x1}, {[0x3, 0xfffffff8, 0xd, 0x3]}, 0x6, 0x3c, &(0x7f00000002c0)=""/60}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000000)=0x3) socket$inet6(0xa, 0x80002, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x14, 0x25, 0x319, 0x70bd26, 0x8000, {0x16}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x24044004) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040057}, 0x240008c4) ioctl$PPPIOCSPASS(r2, 0x40107447, 0x0) ioctl$PPPIOCSDEBUG(r2, 0x40047440, 0x0) write$ppp(r2, &(0x7f0000000480)="1e", 0x1) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000003c0)={0x0, r2, 0x7, 0xfffffffffffffffd, 0x1, 0x2}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r8, &(0x7f0000000200)=0x20000, 0x806000) ioctl$FS_IOC_RESVSP(r8, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r0, 0x0) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/62, 0x1338000, 0x800}, 0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) 1.394183136s ago: executing program 1 (id=6690): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r1) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r4, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x1000000000003c}, 0x60) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="4b02870000", @ANYRES16=r2, @ANYBLOB="01002bbd70000000000036000000080073000000000008000300030020000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x44}, 0x1, 0x0, 0x0, 0x4000811}, 0x20042840) (async) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="4b02870000", @ANYRES16=r2, @ANYBLOB="01002bbd70000000000036000000080073000000000008000300030020000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x44}, 0x1, 0x0, 0x0, 0x4000811}, 0x20042840) sendmsg$DEVLINK_CMD_PORT_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0xa4, r2, 0x20, 0x70bd27, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x2}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x3}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40000}, 0x491) (async) sendmsg$DEVLINK_CMD_PORT_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0xa4, r2, 0x20, 0x70bd27, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x2}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x3}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40000}, 0x491) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xe, &(0x7f0000000b00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff6a0af0fff8ffff1971a400fe00000000b7060000080000002d6400000000000045040300010000001704000001000a00b7040000ff010000720af2fe000000008500000049000000b700000070b2000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d761ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a8321e056acf27c34bed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb93ce1c0983cdcb48477b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e44c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6bc7c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c460880000000000000000000000000000007a4604baa70bda5d5f18f54e9638350a6dd81a55ab5528efd1ef5a564908db7cce99e5c569c2947763b90e03b6d1a53b590e4ff4867f0d86b9af58244866b9df33634c8d85ce1b3bfa3e5bec6989c907c2f46b9a837676e07d87bb7dba3f34694ceb5b9faf10eece00bcfd503ed3f3048782665a848d79e443de4ba97db3a9bde69be7612cb1441c61eadd5bb4494ff2eb189c2ab3a241c12f764c0719650c1b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x8, &(0x7f0000000080), 0x8, 0x10, &(0x7f0000000340), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) 1.279408244s ago: executing program 1 (id=6691): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={0x0, 0x0, 0x2a, 0x0, 0x1, 0x50000000}, 0x28) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdf8, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xa, 0xd}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200, 0x0, 0xb, 0x7, 0xffffffff, 0xfffffffd, 0x5, 0x3, 0x3ff, 0xe, 0x7, 0x14000000, 0x7, 0xce3, 0x0, 0x100, 0x9, 0x1, 0x4, 0x5, 0x9, 0x16d, 0x9, 0x6, 0x3, 0x0, 0x1000, 0x7, 0x9, 0x0, 0x4, 0x0, 0x1, 0xfffffffb, 0x6, 0x81fa, 0xfc9, 0x2, 0x5, 0x8000, 0x1d2, 0x2, 0x4f, 0x1ff, 0x2, 0x2, 0x80, 0x7, 0x4, 0x80000001, 0x3, 0x97c, 0x3, 0x2, 0x8, 0x4, 0x401, 0xffffffff, 0xc7ec, 0x49d, 0xfffffff8, 0xfff, 0x7fffffff, 0xd, 0x7ff, 0x3, 0x24, 0x9a1e, 0x3, 0xffffd68e, 0x7fff, 0x2, 0x0, 0x51, 0x3, 0xffffffff, 0x1, 0x9, 0x2, 0x80000000, 0xb1, 0x3, 0x0, 0x5, 0xdc, 0x7, 0x50, 0x3, 0x10000, 0x4, 0x3, 0x83, 0xffffffff, 0x292, 0x80000000, 0xd, 0x2, 0x8, 0x6, 0x1, 0xc85, 0x4, 0xeb, 0x2, 0x9, 0xc4f, 0xffff, 0x9, 0x3, 0x401, 0x1, 0x2, 0x100, 0xe, 0x2, 0x365c, 0x5, 0x2, 0x3, 0x101, 0x6, 0x74e2, 0xdc54, 0x5, 0xfffffffb, 0x9d, 0x0, 0x0, 0x0, 0x1, 0x2, 0x1, 0x2, 0x5f5, 0xb4, 0x10000, 0x9, 0x6, 0x9, 0x10, 0x8c65, 0xd3, 0xb7, 0x3, 0x3, 0x1, 0x9, 0x4, 0x35d, 0x5, 0xffffffff, 0x5, 0x3, 0x2, 0x1, 0x0, 0x0, 0x1, 0x7fffffff, 0x0, 0x9, 0x9, 0xacb7, 0xc, 0x7f, 0x8, 0x0, 0x0, 0x67, 0x4, 0x8, 0x3, 0x40, 0x7, 0x200, 0x9, 0xe, 0x46, 0x6, 0x100, 0x3, 0x8, 0xd, 0x2, 0x0, 0x9, 0xfffffff8, 0x3, 0xf, 0x1, 0xfffffffb, 0x800, 0x7fff, 0x174e0, 0x44a2e11f, 0x7, 0x7, 0x4, 0x8, 0x3ce, 0x80000000, 0x5, 0x9, 0x6, 0x2, 0x100, 0x6, 0x59, 0x3ff, 0x3, 0x101, 0x6, 0xffffffff, 0x7, 0x5, 0x3, 0x9, 0x4e6c, 0x7, 0x10000000, 0x3, 0x7fff, 0x0, 0x6, 0x4, 0x9, 0x7, 0x7ff, 0x8353992d, 0x8001, 0x8001, 0x2, 0x3ff, 0xc3, 0x80, 0x0, 0x907, 0x8000, 0x400, 0x9, 0x6, 0x4, 0xe0000, 0x3, 0xf149, 0xfdc4, 0x0, 0x9, 0x8, 0x0, 0x5, 0xfffeffff, 0xd9, 0x26c, 0x0, 0x10000]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x24040000}, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$netlink(0x10, 0x3, 0x0) 976.179152ms ago: executing program 0 (id=6692): r0 = socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000700)={0xb0, 0x1403, 0x1, 0x70bd26, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'gre0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bond\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0xffb3, 0x33, 'ipvlan1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_0\x00'}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20000040}, 0x4008010) ioctl$NILFS_IOCTL_SYNC(r1, 0x80086e8a, &(0x7f0000000000)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={0x38, 0x1403, 0x1, 0x0, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200c08a5}, 0x8000) 948.943062ms ago: executing program 1 (id=6693): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) close(r2) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r3, 0x0) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000280)=ANY=[], 0x10448) (async) write$cgroup_subtree(r6, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x11fe726f7e78fcf0}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x11fe726f7e78fcf0}, 0x28) write(0xffffffffffffffff, 0x0, 0x0) (async) write(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r5, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_EVENTS(r7, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xd) (async) getsockopt$inet_sctp6_SCTP_EVENTS(r7, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xd) getsockopt$PNPIPE_INITSTATE(r4, 0x113, 0x4, 0x0, &(0x7f0000000040)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000015c0)={&(0x7f0000001480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0xc, [@fwd={0x1}, @union={0x2, 0x1, 0x0, 0x5, 0x0, 0x0, [{0xa, 0x1}]}]}, {0x0, [0x5f, 0x2e, 0x61, 0x30, 0x5f, 0x0, 0x0, 0x0, 0x0, 0x61]}}, &(0x7f0000001540)=""/74, 0x48, 0x4a, 0x1}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a0020400000000700000a001400110076657468105f746f5f62726964676500080017004e224e24140002"], 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a0020400000000700000a001400110076657468105f746f5f62726964676500080017004e224e24140002"], 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 897.606298ms ago: executing program 0 (id=6694): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000380)=ANY=[], 0x8f) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x2c, 0x40, 0x107, 0xfffffefe, 0x0, {0x4, 0x7c}, [@nested={0x4, 0x142}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x6, 0xc, 0x0, 0x0, @str='\x80\n'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2600f64c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, 0x0, &(0x7f0000000740)) socket$inet_sctp(0x2, 0x1, 0x84) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) write$tun(r1, &(0x7f0000000380)=ANY=[], 0x8f) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x2c, 0x40, 0x107, 0xfffffefe, 0x0, {0x4, 0x7c}, [@nested={0x4, 0x142}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x6, 0xc, 0x0, 0x0, @str='\x80\n'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2600f64c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, 0x0, &(0x7f0000000740)) (async) 812.211281ms ago: executing program 2 (id=6695): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000003b00)) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000060a010400000000000000000a0000010700010000007a3100000000200004801c00018011000100666c6f775f6f66666c6f616400000000040002800900020073797a3200000000050007400e000000140000001100010000000000000000000200000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) ioctl$BTRFS_IOC_SNAP_DESTROY(0xffffffffffffffff, 0x5000940f, &(0x7f0000000000)={{r0}, "cdd29d84a813c3c4200c1ff199eed59ea56474cc746bf1030b5c74e860a9d05ca771ef5ea637a9b176421fb00fa9c21567b36179413ab3564fbd1126a0dc0994238e450dfd4e35c2fd87e14446af90f3757716bb7421c69c1b84ec96187853f6938309a8bb4c4300cea750594c64cabf268de81335eedd42cebdf8cca0592943a793d2c66f99fc31bdb5b0aa85569a936625737f1b847a1c088552d43b69418d5caf86a1dcb7722142d226c097fb4439f85bb59e0eec376fd705d422d1a424ce2daf4d642f5234ec20f9adb68778cc456a3acee79417e233f85158f56b28a337d198aa9dfa0bfae07517711deefd89284ed450b0f55b1bf0944719e7b2a775dd4403425f936c73ae37594ec637d79eac019433cb8c51d6481d87455f75efb5d42fad42db5655bdc9d7cafce2823771e090179934e362ffb2a0225f2bfe34a5d4d544a08671431bfd492ee8454309e76bb916314fd66ca1db78b8d09e49d99a6748a6d2df290ecd984cd9df9d9d2e4bdccff54b7759cc32cf9a61570a96142f1a2ab40aa46d45d9347b5d1739fade9fd8619f2d5fea31ca507710dd4fa3f5bde68306e4a9fcce6b33b0af536b69a908b65319d16e52e69d0c6b8d61fd39ec0aee13b6196f8fdc87e7c1d3d04b81d657403f6bc67c7dab7cd189866dff4ca33a1800fde35c2c85a9a5f028f94414e392c207bc075cd632a7a09762cd918efefacf12fa1090c155540d574f46fa0cf6338464cd48089cb3a230a0f46002617054ec093a9553b6c170559dbe40304b5507335e79de6f95bd1ff3a023f1aa6979c0a1c80a1fb98327d3fad415a689e17fd0c6ea3742a4fede7ce8e5c81e6b577eb1b43d579ad9629a31c1e797a96a8c1e773fcbbc72474a1b12d9f4c1c23f476d8af24ebe53f1af027da811ba1266b3582a96cd8c2e4bdf219b29f18c84b7160372c367a7ad2bae20f4c7d8585423fe33e8335d9ac159cac26a86b89c456be4bda09c3a5cc28cba96e66cb3bbe6ae6203ac317cfcc94f5d6c1e56a4b9a070a5ab19ffd31131351579dc3a863a31f355e736a03d747cffe1a7a2b22b42fd34ae5671ee718e5de3134853e972bd22648dd338f22ac7981e7cf9c42b122c72179e30c46033b132785ad1a0c2294eaae77a2db6be26d821296b99f568a6f6b4ac58ef8cd9cc0816d87a909d940a1240dfa7f2a10e7618ba15149f176741eefc5831575c15c92c96d611728cb442348e5643f62ab3497122262b39e24e482df71e5a41f3a6ed0d97c89c07e4e9a4f1a44477b94d1b09e7f33754aeb51ecb71e5119b592c00da6d129f8ffa1ee458dad2c7c1fd6f2cd998f683974ffb6d7fa8f69dfd999a31d93079eb67985ab760973ae29a2f9a6f9185d41c59ed6581ce0bc67cc2911ed7e687a1379436a09ab3bcf39a4e44837b9f01711c67dfca534a6489d4e813cdbaa7211d78cd4cdb52617fae66deb70cc40842fcb0c9b154be76d4ba5b5197c24ca8443627fb04e086ffe377f4edf67003ccf92eaf23d7a22949974df78ab545b7bc0a354eaf143fe6919f3bc990eab19495d365ec0b223034f6d8a4cfdda1c1b40886a97c6a69ac6fb788e8094e65dcc1e212353389b3a22ca9a237f0c697e234eddec5d9e89c8e800d895d437461755120cb7c2d86bbfb850d959b0ebe385a162629a0775e27a98a3371fac7906b1f17371d12117d0ce304ad7645294673b2ad837372591dc911e205291383bc74d965ed4c77c4067a714f7922d782502421e82ee577831ed795773be0727ad5ec28eb6314d380593060922638730a9dc107ea224c2c1f3d5ca7a2ac9f888807d1472b54697be83b38d393efa7eb92247e534621cacfb647b01e087a5c821d5ffdc93f48729394941a5a853f9f531d9f07f54415fe2f4328ff1229637a8aa2dfc156822b380916f551c66a298ed4e92001d92322f3b779355e0ba3f1183d31a31594eb7ca1a526752f95be9b299f873912c51073148b8f042976cc7a5489b21d7d56090c0f083072de053476c236b533013a415a37a4f7bd234f06984d7443006046d02ee03fb516768eeb7830c92c1fed81e944cef3248309c025383ccc88207126fb1ea59a9d9200185a10fd486dc5b01bc673851514cbeb6315411e674f3b9e402bd0211ccb32d4f560e821f10dd302ec035976b3627b7714b86df8ff34070cede08318cfc46f38c9274ba23d8521a202215ccd55e28096ef332a298a85c1bfeee5ccf6e628a3ac32ec1440d945ae7dd5b0c6e9aa27cb35b40e413339a26123839545871b9723f3535d8eed4e72b6ac7bfda448b1d763d0a428ead7f5b3a02cc6e1651ea3812a8a1d8178ac748ec965613d2fb3c8a02a56b594a1131e8d7eaa16920aa1c3ae67a652bf63c84c146763341213425db844b1c597d4b18cc6a0e495d015c024af19ee5846de3c1d51e5c2144f57d85caa1ec2e5467361391891fbae63fb79017cd726366ac76f2c932002a513dae37f833a208026e36d41bcce3a023c91efb29bcfc77070abdc2c258795b4665570997bf2db5e29d1e2e88279f31924206b87316e5e7bc22fb22245a7baba7154f571ed8d801bcf505e26fafafa07ef6dd3915b5df1e6695601acdbaae3a71dca437a05ff39236dcc86baae32d76838c4996903582bc7da46b53dd763680da5e171a758f3cb95fffc16755644fdd8d0661f30ed0f376393cfd56a1a31f473e7ac35d5ea32499397ddfbc9d38c93a4aaafc3475dba85dcf534f530bd9573ee2c9139e5ebae79d0b639ee6a2bd5bde55f4b1d5953090b1cee25a99aacc77a08b7c3cd39590e24924a5e1b6ec06779ae90f0fcfed2d9b381807013e9732a570b2277860906a64ef2b1be51224910760cb223e313f2623f55f6e8192374be097c5d7335e670bf1fcd08be1f1f2d85ce66e3479425aff280c7d75a9b0f076ffadc5ef2148f0b3b2f84b4fefc3b42b7ceb6d816ef9304eda6da2bcc99ccebaa16c17a7582e85d46c0072788bd50e779ea0f773fe70eacd9f59a0b8fbe938eb01fdac2af78fce47a6ce434d346ea45e4514990beb1351691bdf2e1a2399c97f8461e349dbb02b183ff6b8ebd5a5a2cd920d940dd925e78976435a7d8b740785061436b9359eb12926f931e296d9891e0180934b3acd009de02d65ea4886121d850bb8aa8fdf5bc23ae3306c61b5c3bd98d5b6dd6664f64e42ba60af7d3aa3826c9b6de43b99d29288f4823948ea1671e41ea15c43a3570adf90d56790a6589ad458920f4819b58a427d629a875e0c35953d9911d97e5005e1765ac44db7105f09a1dbebba43e4472d7c73a3994b3a1031e5dd8d7f490673271994c242b905b455ce291bc9672cd246eccbe990e569b25ad52526a271eb725b731b204b4e3d87d2e5164e8d8620088381e6cee78400d81ca43fb2d36aa6b43f62f13e7f68c92ff9ec29d86309fc396ac8c433fc833979100368b082f175fa26969c18f69350410813da48357975db2bbd2022d92657250b99a0805fd5d433d5949d9d36645fbfaeebeeaa55a05c4d47401d27519dfa51eb02122aad9ea04f4874103db31368e2f4d7508a3ab5181ad77c38305c0a636cbca7466a18b1657ae04857c19c44b36db0d6e7b4faa26e4e97daf4744e4363a4793a4d43d4ed4a563c015fcd24321a83e610b9c5f56f1f324f162c4c7b39cd97e9e2a0ebaba7618f7f358374e2308def90e40d55fe0fb36b52523589d4675a1d2510f0574d088d40d7965b5d7bc8214a4a10ac5885197ddd7f2bff0d224e268a6e41199f90e8754814f107807fe80af085d28360fbd42e59bc7ab2e1023384360b577d98c19348d6971d859dc0bb3dead537bab0ef08d5e20aa91f17ee050afef20f97c8b910471524cc661c0c12116922a7b498101e2d7b0218e1d20bdac294d437f7c9cdb719681c655a40c11b0d7eb3ce5bfdead8a6e045f15fe5d365d0fae098d539a0124e9e6e21e9c3a4639f7980f3607bf8d9da8c64122afe9b1552c4ee441212820b305e6c0dc54cfa6050e8b031d4cd2330af85397c7db182f7efa3599cfe203aebad61fcafb599771ebc2a3357c6ec858e39fa84017ecc5ef8a2620e323040f9451a830c37b9c6303d022e65b7104860f292cfbe3a30d2ab880db687e33275d6d51f6f53c9e04cc4429d203c4a2cd3d3752f92c488a4a0dbb9f83cd6535002ba02574573513cf59a07f7ea04247346fffe759fb362f716733a7d98bffa5e5d32ca8b215525d95a661b9cedd4184e154ee928caa71b8b5d901cea2e1d526a9802b6c25cedf357613ac4fabc80fe105ad3b9e08420e0a956c40a842d822c8edeef60d2cd76d20a568933a6e91ecad10ab325fd6a4b8e54c2ea0b889b033173b051cd0db02101bf6162fad501b0dcfe67c2de48779e893516daf4b23beac26c825bc38ff7f959aa30c4ebdae48aba2728d5530684de34e011a3ea8b78d179b1efadeaf91a42dbc30b0112566338e5e72af35783b26df0ac081993d17b58b30af525ab58ced10e076504b60be3c741b927e4f6175e7570166b7681da7702ed25d87b4504aed857fd86d159a98910e3b94e126d7db997a8db116ce4151cfaf47bb05f7d3f4d260eb072dea474b7b95c42e366a097fa5d5422fb988ca5fb2efda7ef0dc4313dcbbeac0b359b1d700090c3566c31008ed7a0d45994cefb06140e96e1fe1c808791b68e7a1201e559553ced6de7c552ed7695f9f86b8422a8e8a6939a2afa4b2226b1aa50d50b64ab42c7c983ce7f480fd912e3bb4c259fa949a8a6bc2eec3664ecf8c9f631e863760a36b0475af2a3c5e9594f8d96a5d6bb7d5ff3c73b13e174b6c7f8947533640c7c31e5bab978776d3c7dca6e1063e744a75b08692623b5ffb0234da6686a7c91bd3d702e25d520923b4ecf8a5cf4696580b561f4139258040e3b099d8a32ac0dced9c9ab56b53f88a047145c7f83bba7cb5134a2932cf079e1517f0b4e6f028ad41b4cecb2e24cfd7766e16bfaec5b0caaebd229c8861febb43d90f73e25bcd2354bd17b642d66f5c6605f77c53dc7f3d360a38d68b38673d014a67e618ca8ff2a874586e063ac33ea98cd01a48f9a9553b39a103862e6b8034fe05013f861f6b136cbd27343c4f23db20f3a7dcf29820dbd5fdc4a90dc360320741e7036e210a75a037a660f606745865f9df0c615e5929915afb82dc02aa7f3afc8b14d9ef5864e6aa6fd288e3d030b8ae2affdde674dfff24777c728987eebdf3d58e565981195b2db477e9b5478f53a289b1aa6576419bfdbf1b5dd29ebe57f946627d8e41fa7ee37572a172648fe4cad8805bb8d7780c967965fcf72647342256ed5e6f48db28c280a26ef5e7a8d59889f2fea6b3def1072980ba11e0b8edbe621f6c0224e5413b71fdfd4856bdaa9177918accfbf5b145cc068dc3f5dc3e730c16ec6e8d78caeb5ead66d1e2cab26035286a9a3f3a64795042fa0d242ab0b9ba6194743f196a6f0c0d05d340c364b88ecc9e390f46915c9a6b48190a0e9cd44d58b3f2a22d103bc0d5b1fb3e6e78a18dd6b3d061f3e4c0196e697021dd3f0619fe62f7b228006fd650b0b46c091fc0b5cd3f6779c19e885a1384ab4eead6c6fee14a9212f0783b0c6cfd6f1bb52a71b52e88eaf40b841e1b77dd3884d42eb7c010e90b09e14610adea58bb6732b63164a4ce35644037f295b389ecdfe3182b1e0ec1227bf6d3b72e00dbcfbf03ed16299461a9e4f961bb24bc0269f71b833c1e31bb1a798be1d4657c89dec5cdb0928ea8b5c40e7a058374967e3e2b065682"}) 806.630144ms ago: executing program 0 (id=6696): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = socket$nl_audit(0x10, 0x3, 0x9) r2 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f00000000c0)={r1, r2, 0x200, 0xb9, &(0x7f0000000000)="0cebc517dbb5e4bf6166c2579b36766e964bc0dedcc97931cbeef91ed48d48aa39bd947a27c932a3b96e0dabbe3706a61ac07a182e24043df8a019e42545f9ce0ad5864fc4ac58afbcfee8eb8138b91a2ed576e53cdae385fe29a9b2408cd83039778c76807c106606a82cd01b7193758e72a82b23359c2f1355acbf01a76a7a150b3454b86aad35ab907e70531bec775ea9a078cbece3bf7d1f333ee1fb5ac1316cf1cccea369efdf98ef840651038d693360ef5858bcfc40", 0x5, 0x8, 0xb5, 0x8001, 0x421, 0x2, 0x3, 'syz0\x00'}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000180)={@mcast1, @private=0xa010100, 0x1c, 0x13}}) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000000300)={r0, &(0x7f0000000200)=',(\x00', 0x40281, &(0x7f0000000240)={@align=0x3, {0x4, 0x100, 0x3, 0x1bbe}}, 0x5, &(0x7f0000000280), &(0x7f00000002c0)=0x7a}) ioctl$OCFS2_IOC_GROUP_ADD(r4, 0x40186f02, &(0x7f0000000340)={0x3, 0x7fb, 0x1ff, 0xa575}) r5 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) ioctl$sock_SIOCGSKNS(r5, 0x894c, &(0x7f0000000380)=0x5) ioctl$XFS_IOC_AG_GEOMETRY(r5, 0xc080583d, &(0x7f00000003c0)={0x7fffffff, 0x6, 0x40, 0x6, 0x0, 0x9, 0x1b58, 0x8001}) ioctl$XFS_IOC_FD_TO_HANDLE(r2, 0xc038586a, &(0x7f0000000540)={r4, &(0x7f0000000440)=',(\x00', 0x404200, &(0x7f0000000480)={@align=0x2, {0x5, 0x9, 0x2, 0x6}}, 0xf, &(0x7f00000004c0)={@_ha_fsid}, &(0x7f0000000500)=0x6}) ioctl$BTRFS_IOC_START_SYNC(r6, 0x80089418, &(0x7f0000000580)) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f00000005c0)={0x1ff, 0x8, 0x3, 0x8, 0x7}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000680)={{r6, 0xffffffffffffffff}, &(0x7f0000000600), &(0x7f0000000640)='%pi6 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={r7, 0xffffffffffffffff}, 0x4) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000800)={r7, &(0x7f0000000700)='\x00', 0x109c81, &(0x7f0000000740)={@align=0x100000001, {0x9, 0x7, 0x8001}}, 0x9, &(0x7f0000000780), &(0x7f00000007c0)=0xb7b}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r2, 0xc0385868, &(0x7f0000000940)={r1, &(0x7f0000000840)='sit0\x00', 0x80000, &(0x7f0000000880)={@_ha_fsid={[0x6, 0x6]}, {0x7b1, 0xff3f, 0x8000, 0x401}}, 0xd6, &(0x7f00000008c0), &(0x7f0000000900)=0x1e0ab7d5}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000c00)={'batadv_slave_0\x00', 0x0}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000e80)={r6, 0x20, &(0x7f0000000e40)={&(0x7f0000000cc0)=""/110, 0x6e, 0x0, &(0x7f0000000d40)=""/196, 0xc4}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000ec0)={0xe, 0x29, &(0x7f0000000980)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x40}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r9}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r10}}, @jmp={0x5, 0x1, 0x6, 0xb, 0x9, 0x2, 0xfffffffffffffffc}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000b00)='GPL\x00', 0x8, 0x9e, &(0x7f0000000b40)=""/158, 0x41000, 0x18, '\x00', r11, @sk_skb=0x28318c96f054157d, r8, 0x8, &(0x7f0000000c40)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000000c80)={0x2, 0x7, 0x8001, 0x6}, 0x10, r12, r4, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000011c0)={r6, 0x0, 0xba, 0x18, &(0x7f0000000f80)="f4039e364febd40136739111bcf0a4f1b10be8ec7ada49f1585a80e66783f8ca2a1ccfec7a8f41d5315cbe1d3b16d8dbe2a92b123ff46b930de221436dae1b1dacdf2b1826ad6262e5867a698c918822ceae483cd9eb9d21449bb8db98995dc9917c18a8d79dfe9e4b4de84cd637d619e3ff6d698c852088b48884f71c8cd1a2aa9e751bced5458e0f297dcc2833ec348c2cf33cb9e9665d6408930bc1a6795baef82f92af9fac28248cfb0e382ebe2c8eedf3cf9ade3a74fe7d", &(0x7f0000001040)=""/24, 0x3ff, 0x0, 0x7f, 0xa8, &(0x7f0000001080)="0f61d1fffe774d0e4f207409735f44ffa4098ee9fe22a1d0437767fe5d1f3390432c382bfc97f0671f1af1898276c041035579dd23546528f0f3e67e421e5c949132b6d2100c192bae4ece3f1e97b9ab094cf9f45a736717516d761077d832902161e567f2440851f1f2160461c8028164b5fd53997c1d9c50078aa3427112", &(0x7f0000001100)="2fbe88e973412c7aa89aaddcfa2e4e9ac3e172e376335ab491f58febd5dcdd8dad258b624ea45bdfcb8c266fa59801ca5e6bcf2e7118641a53aea253ce2f73db521c3ca12b0df38296aca865064dde12df4e0aa0ea0c47aaa7ffa657da2ce601f1d3e56e76f271ab0eb26824c1ce8a766f652b34a88a1314f39fa09323956d099f08efa684037b166ff658810fa3319b2fb30f6e554e661f5af3c8bf4d88a45f14696f713f9a2f37", 0x2, 0x0, 0x6}, 0x50) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000001340)={r3, &(0x7f0000001240)='GPL\x00', 0x2, &(0x7f0000001280)={@align=0xff, {0x2, 0x1000, 0x1, 0x3}}, 0x2, &(0x7f00000012c0)={@_ha_fsid}, &(0x7f0000001300)=0x8dbf7e17}) ioctl$XFS_IOC_FSGROWFSDATA(r7, 0x4010586e, &(0x7f0000001380)={0x81, 0x3}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000013c0)={'veth0\x00'}) sendmsg$IPSET_CMD_LIST(r10, &(0x7f0000001500)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000014c0)={&(0x7f0000001440)={0x44, 0x7, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x941}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0xffff0000}]}, 0x44}, 0x1, 0x0, 0x0, 0x4044050}, 0x0) syz_80211_inject_frame(&(0x7f0000001540), &(0x7f0000001580)=@mgmt_frame=@assoc_resp={{{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1}, {0x2}, @device_b, @device_a, @from_mac=@device_b, {}, @value=@ver_80211n={0x0, 0x7714, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}}, 0x4001, 0x15, @random=0x8000, @void, @void, [{0xdd, 0x95, "f99329d453d14d33a8c80687977db99e0e7d7ea9f85e474f7049ff889a5abf257143a1932979a19cc5934e616d783dd3eea415f5e2fcd348efbe4b191e695246a120c13ee82d184206fe4b6a9afc0076f3ca609cde8aa7d01b2a7968c85a4725889b1d3652149ae780b39cda721445d739868a5d647b22629c6b86c199a6a895527eea07f0d22af9e1f23f465dd3ec7dc1d33a0e9d"}, {0xdd, 0x96, "0373a50b3d2dcb8d27bf0be8db115c2005fb50280cfd2264b3878f4e9500d8c28bcb419385231acf99f8a5b6b5d75c8c1f703ecec62b1926d73bd15d4b17743567108ecf4d6a44eaec2af2f2a50aae8fb5d6dc4e16eb238964049198eda292c0673b2a5d65de640a2c79759ddbe0dd0ad0cbc6a659b4f07d3e698a825663757ecfd77c15f6edcb20be6971476845e6ecaf84b26ffada"}, {0xdd, 0x76, "0b91b5296d1c4241fbbaf02ac6d185e34191c3b36eb39382312c20761efe23ad1490ec0c0c730f498f1e7b15eaea0aeb29627ae489f162e5a6a13257aa5423c8bea56348abadf50ae58824af26e8f763adf2c6efa91468d092348bebef55e2d84e48ba8ba1a672723b80221c2578e89e3f1a0a0b658e"}, {0xdd, 0x7f, "c8983a1148f099e639edf3a1312a55ee295c1cf24592eaaf2308ef94e746f5b3e8cb9fca6e0d165e776599fd101e0edde49e78167344c639fd962d5e8025f9006a466780dd7300451a2e72e882fcba53808bcc1fbfe08c8d2aecd8ae63ff962a92dc5fd15d080040da7fcaf324fb2c62efc6b28c0a96a3f34f9ca9adb8a6be"}, {0xdd, 0x75, "4d992f4f130bb7a1c911f8ccf5172c27a01293eacd8cd572795f5ee807732cf0ca21df575be0894e0c4f34df5139e45c0d7845f8b6d6e8e4be593f1bd84f16b6f8ce89f9876ad25ad82bd862abe42f3b8d17d0c5676952cfddea4772895947f69cedfad69b79a3d5c2c3f204261cab52f53d36f703"}, {0xdd, 0xd4, "e7a3e3ac70bda61b1f1d9b6bb2fedbf995b335aa58607a91f28136d08cb61d8b018e88b2ddf2c89c7161c97e19750d878312f684b17c7481724760c08c00666738c3f7f2114d2441716593351701479b552bc084989e0ba873320e04330b2df640ce0988f80b7b8d89ef8373671bdbc0edb171eecbd8be180079a1f700a6f690572680446c6a31b5f2cbb3e2d275509ab41ee220b74d64d26692831c7906fe5dab77a0aea2d2654312c49bf8ef5e25c3150c1fc52332d092ce2e2b0bd0d17d642fea5904aa18df3e10fef6846241593f4833d80f"}, {0xdd, 0x3f, "0da4c4ef4862f9b13a9fbf1887e75d532a1582062cd1f91f7b3df92c886d444971bd6e72dd182d3c564375567435523d2271f361e30b9485993c5ab32c3b8f"}, {0xdd, 0xa6, "0a2787941479bf8286151b51fa93d23c47a5fe8e321a6536af839398661678c359582c2c0b3bfc31987ac716e6075f71c72a380fd5baf108de36692d91704066e94d3174310b5200e459a795613646b9bc23a7eb6cf9209772f85e7622689880ce816e228b23cb54d5f766a1b4a35ee36e87b755780b908d68448e225008aacc660f7a1bcf0c7ef83443db202293cb5343058361933570462e745b01235d3263d2a42885194b"}]}, 0x480) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r13, &(0x7f0000001ac0)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a40)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24008001}, 0x4000) getsockopt$bt_BT_DEFER_SETUP(r7, 0x112, 0x7, &(0x7f0000001b00)=0x1, &(0x7f0000001b40)=0x4) 797.388135ms ago: executing program 2 (id=6697): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x890b, 0x0) socket$packet(0x11, 0x2, 0x300) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r2, 0x0, 0x0, 0x4008084, &(0x7f0000000140)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) sendto$inet(r2, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r3, 0x7}, 0x8) r4 = accept4(r0, &(0x7f00000000c0)=@xdp, &(0x7f0000000140)=0x80, 0x800) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000200)={r3, 0x8, 0x86, "f915421c7047e622df7adb1dcbf67e6718cb176f8b545823c038bd61375b4d2e03405b3fb1f65c3605e982e974c6e59781ef2d11035c72803d0842be2feb43b8bf73a7fc4368b5eb06d57c0023c1890abaed70fe169425b4ac71272c2715c2d2b629bad17ffa59aeb2d67808518c767d3fe461e7a91501ad83b84b114cfa7d29631f331e199e"}, 0x8e) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, 0x0, &(0x7f00000001c0)) 684.258836ms ago: executing program 2 (id=6698): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000200)=ANY=[@ANYBLOB='c 756'], 0x9e) 683.887053ms ago: executing program 4 (id=6699): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) (async) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000007e5841140000000f0002006e657464657673696d3000170800b8"], 0x3c}}, 0xc084) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) 683.29559ms ago: executing program 2 (id=6700): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000040)=0x0) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private2, 0x4e23, 0x8, 0x4e22, 0x0, 0x2, 0x80, 0x1a0, 0x87, 0x0, r2}, {0xfff, 0x101, 0x2, 0x1, 0x10001, 0x0, 0xe, 0xe7e}, {0x20, 0x2, 0x3ff, 0x8}, 0x7, 0x6e6bbb, 0xf75d533f4534495e, 0x1, 0x0, 0x3}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x3505, 0x4, 0x2, 0x0, 0x828, 0xfffff000, 0x4}}, 0xe8) socket$unix(0x1, 0x1, 0x0) r3 = socket(0x2, 0x6, 0x20) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000000)=0x519fd189, 0x4) listen(r0, 0x8) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000180)={@in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x0, 0x22, 0x0, "800c37e6e4e0fadf075c048bb967cdf9fef46eecb9f3056464af596be66ec6a939de1b8e955ca68fa9d51f342c0ee7fac9cbdd9d1f1337c70c1efde490c79913019634703ac885d44aced57b00c8d728"}, 0xd8) 572.444795ms ago: executing program 3 (id=6701): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_MEDIA={0x24, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000}, 0x40000) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x25, &(0x7f0000000140)={&(0x7f0000000240)={0x18, 0x3c, 0x301, 0x70bd25, 0xfffffffc, {0x9}, [@typed={0x4, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x200448d3}, 0x0) 531.568394ms ago: executing program 2 (id=6702): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000400)=0xc) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000540)={0x3c, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0x8, 0xc, 0x0, 0x0, @uid=r2}, @nested={0xb, 0x0, 0x0, 0x1, [@generic="976b6408686030"]}, @nested={0x18, 0x1, 0x0, 0x1, [@nested={0x14, 0xf6, 0x0, 0x1, [@nested={0x10, 0x146, 0x0, 0x1, [@typed={0x8, 0x14a, 0x0, 0x0, @u32=0xb3}, @nested={0x4, 0x4d}]}]}]}]}, 0x3c}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) pselect6(0x40, &(0x7f0000000140)={0xfe, 0x3, 0x6, 0x10000, 0x9, 0x7, 0x54, 0xffffffffffff0001}, &(0x7f00000002c0)={0x3, 0x0, 0x8000000000000001, 0x5, 0x0, 0x7, 0x6, 0xda}, &(0x7f00000003c0)={0xf34b, 0x2, 0x2, 0x0, 0x9, 0x1, 0x200000, 0x7}, &(0x7f0000000500)={0x0, 0x989680}, &(0x7f00000006c0)={&(0x7f00000005c0)={[0x1]}, 0x8}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x8c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x48, 0x12, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0xd236}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}, {0x10, 0x1, 0x0, 0x1, @queue={{0xa}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0xd4}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x5}}]}}]}, 0x48}}, 0x20040084) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x40000, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000007c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r11, {0x0, 0x10}, {}, {0x8, 0xffe1}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x9, 0x24d5f894f4f8c250, 0x1, 0x526}, 0x7e}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4894}, 0x42) close(r9) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r12 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r12, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r12, &(0x7f0000000200)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r11, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e000f00fdc6c1020040ff8407c2fb7fe0406e52534b4f6b3d327db412f40000000003000000", 0xfdd0}], 0x1}, 0x4005) sendmsg$inet(r3, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000015006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) r13 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r13, &(0x7f0000000240)={&(0x7f0000000000)={0xa, 0x4e22, 0x4, @remote, 0x4}, 0xffffffffffffff60, &(0x7f0000000040), 0x1, 0x0, 0x56}, 0x24000011) 472.440438ms ago: executing program 1 (id=6703): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b008b994bb7e6e9d61c00000e734c6485", @ANYRES32=0x0, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000020000000200"/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca90000000000004d090100000000009500000000000000b702000000000000632af8ff00000000b509000000000000dbaaf8fff1000000bf8600000000000007080000f8ffffffbfa400000000000007090000f0ffffffc70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f1ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000400)={{0xffffffffffffffff, &(0x7f0000000000)='/+\x00', 0x80800, &(0x7f0000000140)={@align=0x3, {0x1000, 0x5, 0x1, 0x800}}, 0x0, &(0x7f0000000180), &(0x7f00000001c0)=0x7}, 0x1, &(0x7f00000003c0)=[{0x3, 0xe, &(0x7f0000000200)='\x00', &(0x7f00000002c0)="5589b7a96bbf01f3b20f3280b36a418f798136d98ab99f3dee7005caba4b51088f6798e575612a1ea30fbff4bb5e6e1447bc37823088c4dae998eb0d9961f232e2ded8ea6d9be990cbdcc071404f52d3d8b1f02214936c60f8c20a5e5da2b7e386d0fcea74a9956b4f2a9d4a86f5e547324e440c95c669c2272f78f66db698d288f7f9bce1608a89d63a5a8ab2989e91d13ca0149e49daadf4bcf218e3f57767362747543b75dce139ad53f8c6fc21996bcbde3e9804d0cc655322115c8427d28c0f90e02da1b37d627fc1f7830e0a65aaeaf7cc29534b9a3c4632eb90aaae7cf07515afce6bff9921dc74e1bf", 0xed, 0x20}]}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000005c0)={@ipv4={""/10, ""/2, @initdev}, 0x0}, &(0x7f0000000600)=0x14) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{0x1, 0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)=r2}, 0x20) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xd50, 0xfffffffffffffee0, &(0x7f0000000000)="259a53f271a76d2608004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x7, 0xfff3}, {0xb, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000940)={{r0, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f0000000900)='%-010d \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a40)={{r0, 0xffffffffffffffff}, &(0x7f00000009c0), &(0x7f0000000a00)='%pB \x00'}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000ac0)=@bpf_ext={0x1c, 0x1c, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xd9c}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000580)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x0, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000640)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000680)={0x5, 0x3, 0xb0e, 0x1}, 0x10, 0x2ef3b, r2, 0x0, &(0x7f0000000a80)=[r5, r8, r9, r0, r1, r0], 0x0, 0x10, 0xf26decd}, 0x94) 408.276307ms ago: executing program 3 (id=6704): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r0], 0xb0}}, 0x0) 363.729988ms ago: executing program 3 (id=6705): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$OCFS2_IOC_GROUP_EXTEND(r0, 0x40046f01, &(0x7f00000000c0)=0x5) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000100b0000850000006d00000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000440)={'syztnl1\x00', r3, 0x4, 0x3, 0x9, 0x8, 0xa, @private0, @remote, 0x80, 0x80, 0x8, 0xc2}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000000)="c1188e19b95d02ff4284860151b0", 0x0, 0xa3d8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000140)={'veth1_vlan\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000006a000105fefdffffffdbdf2500000000000000000800098c702fb2c8ed2ca5d3eaa88823c5b64f35bc0c5225ee33e96cdc6264e7bb237001f6b2f9afe2b7c39444bf64a3ef8e2700387171ff6efb2c664eb2f5d5f682366da0f22936da48367d92070c604e50201e8f7dc2090f4b24e40eb6ebd000edce0371fe2871925495103e55a9aa89262b4061a260fdd23f55479a73fed2f5870201c16556da71f6144f52e5e4bc2e94405eb884c13b852e81640bec3f", @ANYRES32=r4, @ANYRESHEX=r0], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x20008000) close(0x3) 267.936931ms ago: executing program 1 (id=6706): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r0, 0x913e0000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r2, 0x4048587b, &(0x7f0000000340)={{r2, &(0x7f0000000040)='\x00', 0x4080, &(0x7f0000000080)={@_ha_fsid={[0x1, 0x6b]}, {0x8, 0x7, 0x7, 0x10001}}, 0xfffffffd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x5}, 0x1, &(0x7f0000000300)=[{0x2, 0x9, &(0x7f0000000140)='cgroup.controllers\x00', &(0x7f0000000200)="7525c9f85f3fa17a44d48c1a1ef32cb73cbdfccccd5506295f7eb192f2a75d9e3f616e840fbdcf8a91c72647bd3181adc7e751b9879de40bf9dbdb31b3dbe48fae1b91adaaed70e10f938c813c9ea2bd28d3abf2dbacdf1563cab9430e0abd853b882a47671d056c4f509b3d498303b7ef617de1038515bafa84c8970e72d0045dcc7b092a77e8bfef880f51e0c0bfc1e803c843985ef127411f83af4263a693fcf81fd6125a79c77cfb23782c1b1e8460a70bdd7f9b7f5f26982c5baa47f3bd4ce2771f112b8cda75a6d2f1d5a7e04b8220d58f", 0xd4, 0x4d29280c08d265c6}]}) (async) mmap(&(0x7f00004ef000/0x3000)=nil, 0x3000, 0x3000000, 0x13, r2, 0x0) (async) mmap(&(0x7f0000707000/0x2000)=nil, 0x2000, 0x3, 0x12, r1, 0xc3ceb000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r4 = socket$l2tp(0x2, 0x2, 0x73) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @private=0xa010100}, 0x10) (async) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r3, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r0, 0x0) (async) mmap(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x8fbc0e6f77c18ed3, 0x11, r5, 0x1000) (async) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000180)={0x1100, 0x0, 0x52, 0x11000}) 241.169306ms ago: executing program 2 (id=6707): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="7a0af8ff75257000bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b25952850a84a70002b2ab3d6ffaa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc44bc25fb591cf77b9dfb379a3f611dbc2a364916f098dab10b1a297cf528666d1ddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e9e54687d3c56d7bedb6b2f25ddb8c640bb321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0b6dd7356aa79d5fabb5c0d0da6d719d7e0efb2bb713d18242cd5df6ca53307a4cdd91be4587f90e317c8de5e5c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1786eda2b20"], &(0x7f0000000100)='GPL\x00'}, 0x48) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000500)=r1, 0x4) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x4008054) write$nci(r2, 0x0, 0x14) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f00000007c0), r7) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r7, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32=r10, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000180)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000280)={'wpan4\x00', 0x0}) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r16 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001980), r15) r17 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r17, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r14, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r16, 0x1, 0x80000000, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xb}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r18}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000090}, 0x20008840) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x40, r8, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r13}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r18}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x44021) sendmsg$kcm(r0, &(0x7f0000000600), 0x80) 128.195087ms ago: executing program 1 (id=6708): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000640)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0xf) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x3d, 0x800000, 0x8, 0x7, 0x2, 0x81}) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) close(r0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r3, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0xb, &(0x7f0000001240)=""/181, &(0x7f0000001340)=0xb5) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r4, &(0x7f0000001300)=[{&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)=""/163, 0xfeb2}], 0x2) write$cgroup_int(r5, &(0x7f0000000140), 0xfffffdef) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000300)={0x0, 0xa1, &(0x7f0000000040)={&(0x7f00000005c0)={0x2c, r7, 0x705, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40008d0}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="980000001000010027bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="24040100000000001400030076657468315f746f5f626f6e6400000014001680100001800c0003007fff"], 0x98}, 0x1, 0x0, 0x0, 0x805}, 0x60000090) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r10 = syz_init_net_socket$llc(0x1a, 0x802, 0x0) bind$llc(r10, &(0x7f0000000000)={0x1a, 0x0, 0x6, 0x3, 0x3, 0x46}, 0x10) close(r10) sendmsg$NL80211_CMD_SET_INTERFACE(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x408d1}, 0x0) 117.616885ms ago: executing program 0 (id=6709): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x2f}, @printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x7c, &(0x7f0000000000)={@broadcast, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "381f34", 0x46, 0x2f, 0xff, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8100, 0x0, 0x892f, [0x80]}, {}, {}, {0xa888}}}}}}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000001c00)={0xa, 0x4e21, 0x8, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x5}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000140)=[{&(0x7f00000001c0)="580000001400192340834b80040d8c560a067f024e22000000000000ab5c58000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000100214e0000", 0x58}], 0x1) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000002c0)=""/234, 0xea}, {&(0x7f00000003c0)=""/173, 0xad}, {&(0x7f0000000480)=""/165, 0xa5}, {&(0x7f0000000540)=""/194, 0xc2}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000001640)=""/15, 0xf}], 0x6, &(0x7f0000001700)=""/3, 0x3}, 0x9bcbb34ace2ac515) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x0, &(0x7f0000000080)="a314472a3ebf07662bb26a717f3b", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 86.583551ms ago: executing program 3 (id=6710): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000300)={{r0, &(0x7f0000000040)='memory.events\x00', 0x38e80, &(0x7f0000000180)={@_ha_fsid={[0x9, 0x200]}, {0x7, 0x5, 0x800, 0xa}}, 0x29, 0x0, &(0x7f0000000400)=0x1}, {[0x3, 0xfffffff8, 0xd, 0x3]}, 0x6, 0x3c, &(0x7f00000002c0)=""/60}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000000)=0x3) socket$inet6(0xa, 0x80002, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x14, 0x25, 0x319, 0x70bd26, 0x8000, {0x16}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x24044004) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040057}, 0x240008c4) ioctl$PPPIOCSPASS(r2, 0x40107447, 0x0) ioctl$PPPIOCSDEBUG(r2, 0x40047440, 0x0) write$ppp(r2, &(0x7f0000000480)="1e", 0x1) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000003c0)={0x0, r2, 0x7, 0xfffffffffffffffd, 0x1, 0x2}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r8, &(0x7f0000000200)=0x100000, 0x806000) ioctl$FS_IOC_RESVSP(r8, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r0, 0x0) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/62, 0x1338000, 0x800}, 0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) 0s ago: executing program 0 (id=6711): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtfilter={0xbc, 0x2c, 0xd27, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r2, {0x4, 0x8001}, {}, {0x6, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x5, 0x1, {0xfff1, 0xb}}, @TCA_U32_SEL={0x84, 0x5, {0xb, 0x1, 0x7, 0xd, 0x0, 0xcc, 0x4, 0x1, [{0x1, 0x0, 0xf82, 0x101}, {0x6, 0x1, 0x1, 0xc}, {0x4, 0xfffffffe, 0x2, 0x1}, {0x3, 0x5, 0x1, 0xfffffff1}, {0x9, 0x3, 0xfffffff9, 0x2}, {0xedf5, 0xc, 0x2, 0xffff}, {0x0, 0x0, 0x81, 0x8}]}}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2006c805}, 0x20040054) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000140)={r0, &(0x7f0000000080)='syzkaller\x00', 0x408a00, &(0x7f0000000180)={@_ha_fsid={[0xffffffaa, 0x6]}, {0x8001, 0xd373, 0x9, 0x7fff}}, 0x1, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x10000}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x3c0, 0x1f0, 0x1f0, 0x0, 0x108, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8, 0x0, {0xa00}}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x447) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r5) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a80)=ANY=[@ANYRES64, @ANYRES16=r7, @ANYBLOB="f5af24bd7000000000000e0000000800030082f6d018ccac6c340a400e14ec98785d3e18910a6fe8acbe9d2668b1f459bbf220f6e64d795661d614caa6f5ae470b286293ed3aba8c766fc3fff2af2ff702e3c8e90346b0826a354ecc160ff3be85c583bcff6aa712c1c0f0b601a272a21ab5b7658df6416b4b14df26ae4953c00fd0dac2c959dc6320001322efee9cf653ba7e56097c24c3410c0b7c7d4116b82156687ca70355f69441776dd134e2a8d02ad61f8b0d5061f504194c9f2a5f01cf", @ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) r8 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xc) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xc, 0x80010, r9, 0x1000) r10 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_BT_SECURITY(r10, 0x112, 0x4, &(0x7f0000000040)={0x80, 0xde}, 0x2) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r12 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r11, &(0x7f00000002c0)=[{&(0x7f0000000080)="2e9b3d0007e03dd65193dfb6c575963f86ddf06712e960272f8db0049d90491ceaebfd26d4eef23248000000f858dbb8a1905234", 0x34}, {&(0x7f0000000100)="051a0000", 0x4}, {&(0x7f0000000200)="73ec500447db", 0x6}], 0x3) sendmsg$DEVLINK_CMD_PORT_GET(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x3c, r8, 0x1, 0x70bd2b, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}]}, 0x3c}}, 0x0) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="fc00000010000100feffffbffedbdf2500000000000000000000000000000000fe880000000000000000000000000101000103944e230005000080003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff02000000000e0000000000000000030000000000000000ac1414bb00000000200000000000000000000000000000000900000000132d0be6b2d6b2029fd0bae2b460c4000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff020000000000007cf80000000000000000000000e8d2fff88d0e0385b46bca000000001f00000000000000ff0100000000000002000000fcffffff400002002abd7000043500000a0001fd2000"], 0xfc}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r14 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r14, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe8000000000000000000000000000aafc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac1414bb000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff000000000b000000ffffffffffffffff00000000000000000900000000000000feffffffffffffff02000000fcffffff000000002abd7000043500000a0001002000000000000000480003006465666c61746500"/240], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a801400000000080c000000140001002001000000000000000000000000000114000200fc0200000000000000000000000000ff080018004e244e246ffec4d916392a7a6e2891e8abf79233117381b5776c9578aa91f225f6996e62f558043a171ee8f0f4c57f99f5f83a0728302f222775a798ce1096801ac34e0b952f68d7f2c20f1492c656e7e7fdedf2459d9aa9e8d7767e9044c5e532ef3d52116b50f6c4accc54b3668cdbd7ce6be904e9ec9f29410927b12ea68b032474301f3a7883922de65b0c3d24c946f4a690efb3b8b08cede82ed228091b2e18f07054f8aa2a3b7f21a6a8cd3c70e808"], 0x4c}}, 0x40000) kernel console output (not intermixed with test programs): k. [ 450.914811][T26327] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 450.942707][T26327] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 451.003072][T26343] netlink: 256 bytes leftover after parsing attributes in process `syz.0.5338'. [ 451.037146][T26343] netlink: 72 bytes leftover after parsing attributes in process `syz.0.5338'. [ 451.269064][T26368] netlink: 'syz.3.5345': attribute type 1 has an invalid length. [ 451.497253][T26376] tipc: Started in network mode [ 451.508781][T26376] tipc: Node identity , cluster identity 4711 [ 451.526930][T26376] tipc: Failed to obtain node identity [ 451.551188][T26376] tipc: Enabling of bearer rejected, failed to enable media [ 451.744764][T26386] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5350'. [ 451.867454][T21385] wlan1: Trigger new scan to find an IBSS to join [ 452.133136][T26401] sctp: [Deprecated]: syz.4.5355 (pid 26401) Use of struct sctp_assoc_value in delayed_ack socket option. [ 452.133136][T26401] Use struct sctp_sack_info instead [ 452.487523][T26417] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 452.743968][T26444] syzkaller0: entered promiscuous mode [ 452.763163][T26444] syzkaller0: entered allmulticast mode [ 453.269940][T26465] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 453.409212][T26470] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.436138][T26470] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 54526 - 0 [ 453.462462][T26470] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 453.590847][T26470] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.627569][T26470] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 54526 - 0 [ 453.647587][T26470] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 453.740977][T26470] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.773766][T26470] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 54526 - 0 [ 453.805078][T26470] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 453.893467][T26473] bond9: Removing last arp target with arp_interval on [ 453.945920][T26470] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.993106][T26470] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 54526 - 0 [ 454.037042][T26470] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 454.185620][T21381] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 454.216268][T21381] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.247113][T21381] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 54526 - 0 [ 454.289416][T21383] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 454.312043][T21383] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.348458][T21383] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 54526 - 0 [ 454.392738][T21383] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 454.409906][T21383] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.419073][T21383] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 54526 - 0 [ 454.453147][T21383] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 454.468740][T21383] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.477581][T21383] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 54526 - 0 [ 454.505190][T26510] syzkaller0: entered promiscuous mode [ 454.528066][T26510] syzkaller0: entered allmulticast mode [ 454.550436][T26516] x_tables: duplicate underflow at hook 2 [ 454.907288][T21383] wlan1: Trigger new scan to find an IBSS to join [ 455.164514][T26548] __nla_validate_parse: 7 callbacks suppressed [ 455.164544][T26548] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5400'. [ 455.374555][T26558] validate_nla: 2 callbacks suppressed [ 455.374571][T26558] netlink: 'syz.0.5402': attribute type 21 has an invalid length. [ 455.414271][T26558] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5402'. [ 455.433560][T26558] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5402'. [ 455.452902][T26558] netlink: 'syz.0.5402': attribute type 21 has an invalid length. [ 455.469966][T26558] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5402'. [ 455.556485][ T30] audit: type=1800 audit(1782165534.200:20): pid=26566 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5405" name=20 dev="tmpfs" ino=2229 res=0 errno=0 [ 455.625688][T26572] netlink: 200 bytes leftover after parsing attributes in process `syz.1.5406'. [ 455.665317][T26579] netlink: 'syz.3.5409': attribute type 27 has an invalid length. [ 455.678854][T26581] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5408'. [ 455.696283][T26571] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5407'. [ 456.075665][T26607] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5417'. [ 456.163565][T26621] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5418'. [ 456.279233][T26627] IPVS: set_ctl: invalid protocol: 137 0.0.0.0:20002 [ 456.309001][T26627] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5420'. [ 456.331677][T26624] syzkaller0: entered promiscuous mode [ 456.356739][T26624] syzkaller0: entered allmulticast mode [ 456.387978][T26631] ip6gre2: entered promiscuous mode [ 456.403242][T26631] ip6gre2: entered allmulticast mode [ 456.514383][T26634] lo speed is unknown, defaulting to 1000 [ 456.552788][T26639] dvmrp6: entered allmulticast mode [ 457.216815][T26679] netlink: 'syz.0.5434': attribute type 1 has an invalid length. [ 457.403444][T26679] bond13: entered promiscuous mode [ 457.446536][T26679] 8021q: adding VLAN 0 to HW filter on device bond13 [ 457.498533][T26694] netlink: 'syz.4.5435': attribute type 13 has an invalid length. [ 457.554874][T26692] siw: device registration error -23 [ 457.561239][T26682] bond13: (slave bridge4): making interface the new active one [ 457.570173][T26682] bridge4: entered promiscuous mode [ 457.580364][T26682] bridge4: left promiscuous mode [ 457.644762][T26696] syzkaller0: entered promiscuous mode [ 457.651207][T26696] syzkaller0: entered allmulticast mode [ 457.785135][T26704] netlink: 'syz.4.5441': attribute type 3 has an invalid length. [ 457.793920][T26706] openvswitch: netlink: Key type 30 is not supported [ 457.807357][T26704] netlink: 'syz.4.5441': attribute type 1 has an invalid length. [ 457.867887][T21386] wlan1: Creating new IBSS network, BSSID 00:00:00:8d:00:00 [ 458.060885][T26720] xt_CT: You must specify a L4 protocol and not use inversions on it [ 458.132690][T26728] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 458.382702][T26741] tipc: Resetting bearer [ 458.396065][T26741] tipc: Resetting bearer [ 458.441204][T26746] syzkaller0: entered promiscuous mode [ 458.457451][T26746] syzkaller0: entered allmulticast mode [ 458.635468][T26755] syzkaller0: entered promiscuous mode [ 458.661648][T26755] syzkaller0: entered allmulticast mode [ 458.810229][T26766] netlink: 'syz.3.5458': attribute type 8 has an invalid length. [ 459.009806][T26770] bond14: entered promiscuous mode [ 459.016014][T26770] 8021q: adding VLAN 0 to HW filter on device bond14 [ 459.046620][T26774] macvtap1: entered promiscuous mode [ 459.053006][T26774] vlan0: entered promiscuous mode [ 459.059986][T26774] vlan0: left promiscuous mode [ 459.113816][T26776] 8021q: adding VLAN 0 to HW filter on device bond14 [ 459.121908][T26776] bond14: (slave ip6gre4): The slave device specified does not support setting the MAC address [ 459.134596][T26776] bond14: (slave ip6gre4): Error -95 calling set_mac_address [ 459.191735][T26778] vlan3: entered promiscuous mode [ 459.205168][T26778] hsr0: entered promiscuous mode [ 459.210769][T26778] vlan3: entered allmulticast mode [ 459.216021][T26778] hsr0: entered allmulticast mode [ 459.221568][T26778] hsr_slave_0: entered allmulticast mode [ 459.228302][T26778] hsr_slave_1: entered allmulticast mode [ 459.260496][T26787] netlink: 'syz.2.5466': attribute type 7 has an invalid length. [ 459.352021][T26801] netlink: 'syz.1.5465': attribute type 13 has an invalid length. [ 459.602352][T26801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 459.710394][T26801] 8021q: adding VLAN 0 to HW filter on device team0 [ 460.265834][T26831] __nla_validate_parse: 15 callbacks suppressed [ 460.265850][T26831] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5473'. [ 460.335753][T26801] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 460.350164][T26801] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 460.383285][T26801] veth1_vlan: left promiscuous mode [ 460.391512][T26801] veth0_vlan: left promiscuous mode [ 460.397765][T26801] veth0_vlan: entered promiscuous mode [ 460.406559][T26801] veth1_vlan: entered promiscuous mode [ 460.428416][T26801] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 460.445555][T26801] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 460.462047][T26801] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 460.481170][T26801] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 460.528107][T26801] A link change request failed with some changes committed already. Interface vxlan1 may have been left with an inconsistent configuration, please check. [ 460.572248][T26846] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5476'. [ 460.594094][T21383] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.603644][T21383] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.628908][T21383] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.647453][T21383] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.670965][T21383] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.689362][T21383] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.702410][T21383] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.724916][T21383] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.738648][T26854] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5479'. [ 460.771584][T26854] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5479'. [ 460.774583][T26855] IPv6: NLM_F_CREATE should be specified when creating new route [ 460.790190][T26851] netlink: 15672 bytes leftover after parsing attributes in process `syz.4.5478'. [ 460.807978][T26855] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 460.815258][T26855] IPv6: NLM_F_CREATE should be set when creating new route [ 460.822547][T26855] IPv6: NLM_F_CREATE should be set when creating new route [ 460.829821][T26855] IPv6: NLM_F_CREATE should be set when creating new route [ 460.839994][T26851] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5478'. [ 460.849410][T26851] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5478'. [ 460.860895][T26851] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5478'. [ 461.216421][T26877] validate_nla: 3 callbacks suppressed [ 461.216440][T26877] netlink: 'syz.0.5486': attribute type 10 has an invalid length. [ 461.287191][T26877] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 461.296709][T26881] syzkaller0: entered promiscuous mode [ 461.302907][T26881] syzkaller0: entered allmulticast mode [ 462.317947][T26907] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5493'. [ 462.333908][T26907] netlink: 261 bytes leftover after parsing attributes in process `syz.1.5493'. [ 462.835722][T26930] syzkaller0: entered promiscuous mode [ 462.841502][T26930] syzkaller0: entered allmulticast mode [ 464.230171][T26879] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 464.331312][T26932] netlink: 'syz.3.5501': attribute type 10 has an invalid length. [ 464.345866][T26932] vxcan1: entered promiscuous mode [ 464.352209][T26932] vxcan1: entered allmulticast mode [ 464.369108][T26932] team0: Refused to change device type [ 464.398882][T26941] IPv6: sit3: Disabled Multicast RS [ 464.422925][T26941] ip6tnl4: entered allmulticast mode [ 464.454840][T26936] xt_hashlimit: size too large, truncated to 1048576 [ 464.804344][T26951] lo speed is unknown, defaulting to 1000 [ 465.288980][T26992] __nla_validate_parse: 7 callbacks suppressed [ 465.289041][T26992] netlink: 148 bytes leftover after parsing attributes in process `syz.4.5516'. [ 465.313265][T26992] netlink: 'syz.4.5516': attribute type 1 has an invalid length. [ 465.450016][T26994] syzkaller0: entered promiscuous mode [ 465.474443][T26994] syzkaller0: entered allmulticast mode [ 465.578328][T27005] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5521'. [ 465.639344][T27005] netlink: 'syz.3.5521': attribute type 11 has an invalid length. [ 465.659186][T27013] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5524'. [ 465.761664][T27013] syzkaller0: entered promiscuous mode [ 465.767484][T27013] syzkaller0: entered allmulticast mode [ 465.911452][T27020] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5526'. [ 465.951401][T27020] netlink: 'syz.3.5526': attribute type 4 has an invalid length. [ 466.058493][T27031] dummy0: left promiscuous mode [ 466.191923][T27041] netlink: 820 bytes leftover after parsing attributes in process `syz.1.5532'. [ 466.219064][T27041] netlink: 820 bytes leftover after parsing attributes in process `syz.1.5532'. [ 466.268617][T21386] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 466.499356][T27057] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5537'. [ 466.556144][T27061] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 466.574306][T27057] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5537'. [ 466.682681][T27071] tipc: New replicast peer: 255.255.255.255 [ 466.688923][T27071] tipc: Enabled bearer , priority 26 [ 466.893325][T27079] netlink: 'syz.1.5544': attribute type 21 has an invalid length. [ 466.915526][T27079] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5544'. [ 466.926405][T27079] netlink: 'syz.1.5544': attribute type 1 has an invalid length. [ 467.105818][T27088] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5546'. [ 467.817669][T10787] tipc: Node number set to 4278879548 [ 467.955014][T27132] netlink: 'syz.0.5557': attribute type 1 has an invalid length. [ 468.017808][T27132] 8021q: adding VLAN 0 to HW filter on device bond15 [ 468.130867][T27136] bond15: (slave geneve3): making interface the new active one [ 468.162648][T27136] bond15: (slave geneve3): Enslaving as an active interface with an up link [ 468.827054][ C0] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 469.631646][T27242] netlink: 'syz.3.5578': attribute type 1 has an invalid length. [ 469.652812][T27244] syzkaller1: entered promiscuous mode [ 469.659740][T27244] syzkaller1: entered allmulticast mode [ 469.802973][T27252] veth14: entered allmulticast mode [ 469.898847][T27264] xt_hashlimit: size too large, truncated to 1048576 [ 469.918544][T27264] xt_hashlimit: max too large, truncated to 1048576 [ 470.008893][T27267] syzkaller0: entered promiscuous mode [ 470.023670][T27267] syzkaller0: entered allmulticast mode [ 470.044534][T27267] 0: reclassify loop, rule prio 0, protocol 800 [ 470.252324][T27283] netlink: 'syz.2.5587': attribute type 1 has an invalid length. [ 470.273489][T27283] bond9: entered promiscuous mode [ 470.281879][T27283] 8021q: adding VLAN 0 to HW filter on device bond9 [ 470.302249][T27283] bond9: (slave bridge7): making interface the new active one [ 470.310487][T27283] bridge7: entered promiscuous mode [ 470.317801][T27283] bond9: (slave bridge7): Enslaving as an active interface with an up link [ 470.333545][T27283] __nla_validate_parse: 5 callbacks suppressed [ 470.333563][T27283] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5587'. [ 470.356321][T27283] bond9: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 470.371558][T27283] bond9: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 470.394770][T27287] netlink: 308 bytes leftover after parsing attributes in process `syz.1.5588'. [ 470.472313][T27292] xt_policy: too many policy elements [ 470.495706][T27292] xt_l2tp: v2 sid > 0xffff: 262144 [ 470.523881][T27294] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5591'. [ 470.583374][T27298] netlink: 'syz.1.5592': attribute type 1 has an invalid length. [ 470.615017][T27298] bond6: entered promiscuous mode [ 470.620929][T27298] 8021q: adding VLAN 0 to HW filter on device bond6 [ 470.762064][T27311] netlink: 'syz.3.5594': attribute type 10 has an invalid length. [ 470.781742][T27307] ip6gre0: mtu less than device minimum [ 470.960911][T27316] bridge0: port 1(vlan0) entered blocking state [ 470.980171][T27326] netlink: 'syz.1.5598': attribute type 1 has an invalid length. [ 470.988493][T27316] bridge0: port 1(vlan0) entered disabled state [ 470.988807][T27316] vlan0: entered allmulticast mode [ 471.027027][T27316] geneve0: entered allmulticast mode [ 471.047233][T27316] vlan0: entered promiscuous mode [ 471.067831][T27316] geneve0: entered promiscuous mode [ 471.084080][T27323] netlink: 'syz.2.5595': attribute type 12 has an invalid length. [ 471.129247][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 471.136557][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 471.144627][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 471.152976][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 471.168964][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 471.193081][T27329] gretap1: entered allmulticast mode [ 471.216212][T27329] bond7: (slave gretap1): making interface the new active one [ 471.265879][T27329] bond7: (slave gretap1): Enslaving as an active interface with an up link [ 471.313229][T27323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5595'. [ 471.349988][T27321] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5595'. [ 471.403533][T16888] syz_tun (unregistering): left allmulticast mode [ 471.475944][T27341] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5600'. [ 471.540384][T27350] geneve0: entered promiscuous mode [ 471.549448][T27350] macvlan3: entered promiscuous mode [ 471.663221][T27355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5604'. [ 471.729649][T27355] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.761738][T27355] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.840177][T27355] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.861409][T27355] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.903371][T27330] lo speed is unknown, defaulting to 1000 [ 471.918290][T27355] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.938032][T27355] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.992478][T27355] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.015994][T27355] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.105619][T21385] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.130162][T27378] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5609'. [ 472.140156][T21385] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.164902][T27378] xt_TCPMSS: Only works on TCP SYN packets [ 472.177506][T21385] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.191768][T21385] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.219425][T21385] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.234171][T21385] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.278043][T21385] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.288571][T21385] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.478202][T27387] netlink: 'syz.0.5611': attribute type 1 has an invalid length. [ 472.496340][T27388] netlink: 'syz.0.5611': attribute type 1 has an invalid length. [ 472.553837][T27387] bond16: entered promiscuous mode [ 472.559998][T27387] 8021q: adding VLAN 0 to HW filter on device bond16 [ 472.586503][T27393] bond16: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 472.609463][T27393] bond16: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 472.634219][T27393] bond16: (slave ipvlan3): Setting fail_over_mac to active for active-backup mode [ 472.695761][T27403] tipc: Enabling of bearer rejected, failed to enable media [ 472.824860][T27330] bridge0: port 1(bridge_slave_0) entered blocking state [ 472.842293][T27330] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.857352][T27330] bridge_slave_0: entered allmulticast mode [ 472.872561][T27330] bridge_slave_0: entered promiscuous mode [ 472.883649][T27417] netlink: 'syz.1.5616': attribute type 5 has an invalid length. [ 472.892911][T27330] bridge0: port 2(bridge_slave_1) entered blocking state [ 472.903462][T27427] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5619'. [ 472.917452][T27330] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.932590][T27330] bridge_slave_1: entered allmulticast mode [ 472.951250][T27330] bridge_slave_1: entered promiscuous mode [ 473.003819][T27330] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 473.018958][T27330] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 473.033970][T27429] IPVS: set_ctl: invalid protocol: 22 172.20.20.170:20001 [ 473.080042][T27330] team0: Port device team_slave_0 added [ 473.091051][T27330] team0: Port device team_slave_1 added [ 473.170980][T27330] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 473.188067][T27330] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 473.218447][T27330] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 473.234222][T27330] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 473.240582][ T5625] Bluetooth: hci1: command tx timeout [ 473.242644][T27330] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 473.276223][T27330] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 473.320375][T27330] hsr_slave_0: entered promiscuous mode [ 473.327423][T27330] hsr_slave_1: entered promiscuous mode [ 473.333706][T27330] debugfs: 'hsr0' already exists in 'hsr' [ 473.339631][T27330] Cannot create hsr debugfs directory [ 475.307674][ T5625] Bluetooth: hci1: command tx timeout [ 475.748378][T27408] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 475.758367][T27427] netlink: 'syz.4.5619': attribute type 1 has an invalid length. [ 475.766512][T27427] netlink: 'syz.4.5619': attribute type 1 has an invalid length. [ 475.791639][T27330] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 475.829738][T27330] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 475.852213][T27330] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 475.865471][T27330] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 475.884990][T27330] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 475.907522][T27330] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 475.929520][T27330] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 475.948406][T27330] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 475.992300][T27456] lo speed is unknown, defaulting to 1000 [ 476.117795][T27330] 8021q: adding VLAN 0 to HW filter on device bond0 [ 476.180358][T27330] 8021q: adding VLAN 0 to HW filter on device team0 [ 476.208818][T21382] bridge0: port 1(bridge_slave_0) entered blocking state [ 476.216432][T21382] bridge0: port 1(bridge_slave_0) entered forwarding state [ 476.227825][T27484] "syz.4.5632" (27484) uses obsolete ecb(arc4) skcipher [ 476.260175][T27486] netlink: 'syz.0.5633': attribute type 1 has an invalid length. [ 476.272416][T21382] bridge0: port 2(bridge_slave_1) entered blocking state [ 476.279579][T21382] bridge0: port 2(bridge_slave_1) entered forwarding state [ 476.296548][T27486] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5633'. [ 476.437050][T27499] x_tables: ip_tables: TCPMSS target: only valid for protocol 6 [ 476.450186][T27498] netlink: 212336 bytes leftover after parsing attributes in process `syz.1.5636'. [ 476.502063][T27499] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5637'. [ 476.511154][T27330] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 476.550486][T27500] netlink: 'syz.4.5635': attribute type 7 has an invalid length. [ 476.656455][T27507] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5 [ 477.387819][ T5625] Bluetooth: hci1: command tx timeout [ 477.407673][T27330] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 477.447071][T27536] "syz.2.5644" (27536) uses obsolete ecb(arc4) skcipher [ 477.550260][T27330] veth0_vlan: entered promiscuous mode [ 477.580230][T27330] veth1_vlan: entered promiscuous mode [ 477.617982][T27330] veth0_macvtap: entered promiscuous mode [ 477.665301][T27330] veth1_macvtap: entered promiscuous mode [ 477.745890][T27330] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 477.793405][T27330] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 477.826279][ T1162] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.856780][ T1162] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.868692][T27553] IPv6: NLM_F_CREATE should be specified when creating new route [ 477.878804][ T1162] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.888486][T27553] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5648'. [ 477.900362][ T1162] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.959538][T27559] netlink: 'syz.2.5651': attribute type 1 has an invalid length. [ 477.967504][T27559] netlink: 'syz.2.5651': attribute type 1 has an invalid length. [ 478.022818][T21385] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.048344][T21385] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.070298][ T1104] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.084520][T27561] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5652'. [ 478.099326][ T1104] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.209562][T27569] "syz.3.5655" (27569) uses obsolete ecb(arc4) skcipher [ 478.355361][T27575] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5657'. [ 478.430026][T27582] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5658'. [ 478.441732][T27582] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5658'. [ 478.540016][T27588] netlink: 'syz.1.5661': attribute type 1 has an invalid length. [ 478.548689][T27588] netlink: 'syz.1.5661': attribute type 1 has an invalid length. [ 478.625178][T27596] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5660'. [ 478.702797][T27595] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5663'. [ 478.890501][T27608] "syz.1.5667" (27608) uses obsolete ecb(arc4) skcipher [ 479.121893][T27625] netlink: 'syz.2.5673': attribute type 1 has an invalid length. [ 479.144018][T27625] netlink: 'syz.2.5673': attribute type 1 has an invalid length. [ 479.161986][T27623] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 479.181424][T27623] netlink: 'syz.1.5672': attribute type 2 has an invalid length. [ 479.192403][T27623] netlink: 'syz.1.5672': attribute type 1 has an invalid length. [ 479.241434][T27632] pim6reg: entered allmulticast mode [ 479.290175][T27632] pim6reg: left allmulticast mode [ 479.467142][ T5625] Bluetooth: hci1: command tx timeout [ 479.643971][T27671] netlink: 'syz.4.5685': attribute type 1 has an invalid length. [ 479.655284][T27671] netlink: 'syz.4.5685': attribute type 1 has an invalid length. [ 480.389040][T27733] openvswitch: netlink: nsh attr 13 is out of range max 3 [ 480.412390][T27733] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 480.718199][T27764] Bluetooth: MGMT ver 1.23 [ 480.881942][T27774] Cannot find set identified by id 0 to match [ 483.259659][T27723] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 483.276676][T27775] validate_nla: 3 callbacks suppressed [ 483.276725][T27775] netlink: 'syz.0.5711': attribute type 1 has an invalid length. [ 483.329336][T27778] netlink: 'syz.2.5713': attribute type 1 has an invalid length. [ 483.348598][T27778] netlink: 'syz.2.5713': attribute type 1 has an invalid length. [ 483.397292][T27786] __nla_validate_parse: 7 callbacks suppressed [ 483.397311][T27786] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5715'. [ 483.516742][T27795] netlink: 'syz.0.5718': attribute type 1 has an invalid length. [ 483.552460][T27801] syzkaller0: entered promiscuous mode [ 483.558608][T27801] syzkaller0: entered allmulticast mode [ 483.610892][T27795] 8021q: adding VLAN 0 to HW filter on device bond18 [ 483.621965][T27802] bond0: (slave dummy0): Releasing backup interface [ 483.634728][T27795] netlink: 'syz.0.5718': attribute type 10 has an invalid length. [ 483.636336][T27802] bond18: (slave dummy0): Enslaving as a backup interface with an up link [ 483.652854][T27795] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5718'. [ 483.663127][T27795] dummy0: entered promiscuous mode [ 483.673903][T27795] bond18: (slave dummy0): Releasing backup interface [ 483.822183][T27810] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 483.903065][T27825] netlink: 3 bytes leftover after parsing attributes in process `syz.2.5727'. [ 483.913459][T27825] netlink: 'syz.2.5727': attribute type 29 has an invalid length. [ 484.097717][T27834] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5730'. [ 484.392329][T27852] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5736'. [ 484.661078][T27869] syzkaller0: entered promiscuous mode [ 484.690643][T27869] syzkaller0: entered allmulticast mode [ 484.769647][T27876] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5744'. [ 484.873990][T27884] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 484.898660][T27881] netlink: 276 bytes leftover after parsing attributes in process `syz.3.5745'. [ 484.922284][T27884] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 484.955706][T27872] gtp1: entered promiscuous mode [ 484.960892][T27872] gtp1: entered allmulticast mode [ 484.965999][T27884] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 484.980751][T27872] team0: Port device gtp1 added [ 484.988254][T27889] netlink: 'syz.4.5746': attribute type 50 has an invalid length. [ 485.005451][T27884] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 485.115286][T27895] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5748'. [ 485.226086][T27901] lo speed is unknown, defaulting to 1000 [ 485.305263][T27908] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 485.371393][T27909] tipc: Enabling of bearer rejected, already enabled [ 485.401222][T27907] tipc: Enabling of bearer rejected, already enabled [ 485.434966][T27911] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5754'. [ 485.481820][T27911] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5754'. [ 485.531005][T27911] syz_tun: entered promiscuous mode [ 485.540225][T27911] macsec1: entered allmulticast mode [ 485.545644][T27911] syz_tun: entered allmulticast mode [ 485.561097][T27911] syz_tun: left allmulticast mode [ 485.566634][T27911] syz_tun: left promiscuous mode [ 485.920473][T27945] Cannot find add_set index 0 as target [ 485.967850][T27941] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 486.276285][T27951] syzkaller0: entered promiscuous mode [ 486.282380][T27951] syzkaller0: entered allmulticast mode [ 486.583976][T27969] syzkaller1: entered promiscuous mode [ 486.599156][T27969] syzkaller1: entered allmulticast mode [ 486.862568][T28004] veth0: entered promiscuous mode [ 487.053292][T28015] 8021q: adding VLAN 0 to HW filter on device bond11 [ 487.096353][T28015] bond11 (unregistering): Released all slaves [ 487.178334][T28030] siw: device registration error -23 [ 487.395305][T28046] syz_tun: left allmulticast mode [ 487.483003][T28048] bond5 (unregistering): Released all slaves [ 487.679241][T28057] bond5: option resend_igmp: invalid value (2878) [ 487.686795][T28057] bond5: option resend_igmp: allowed values 0 - 255 [ 487.703207][T28057] bond5 (unregistering): Released all slaves [ 487.755001][T28002] veth0: left promiscuous mode [ 488.120579][T28063] lo speed is unknown, defaulting to 1000 [ 488.141836][T28069] sctp: [Deprecated]: syz.1.5796 (pid 28069) Use of int in maxseg socket option. [ 488.141836][T28069] Use struct sctp_assoc_value instead [ 488.382797][T28078] syzkaller1: entered promiscuous mode [ 488.390891][T28078] syzkaller1: entered allmulticast mode [ 488.566690][T28094] block nbd0: Unsupported socket: should be TCP or UNIX. [ 488.896164][T28098] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 488.896650][T28101] __nla_validate_parse: 17 callbacks suppressed [ 488.896679][T28101] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5806'. [ 488.919665][ T5625] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 489.103074][T28111] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5808'. [ 489.114331][T28115] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5811'. [ 489.128136][T28111] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5808'. [ 489.505467][T28117] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5810'. [ 489.625645][ T30] audit: type=1800 audit(1782165568.270:21): pid=28137 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.5814" name=CB dev="tmpfs" ino=2872 res=0 errno=0 [ 489.764097][T28143] syzkaller0: entered promiscuous mode [ 489.795400][T28143] syzkaller0: entered allmulticast mode [ 489.931652][T28152] netlink: 'syz.3.5820': attribute type 1 has an invalid length. [ 489.951233][T21386] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 490.417989][T28152] 8021q: adding VLAN 0 to HW filter on device bond1 [ 490.519358][T28154] bond1: (slave veth3): Enslaving as an active interface with a down link [ 490.555603][T28156] bond1: (slave dummy0): making interface the new active one [ 490.566662][T28156] dummy0: entered promiscuous mode [ 490.582518][T28156] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 490.604653][T28168] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5822'. [ 490.957788][T28195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5830'. [ 490.981448][T28195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5830'. [ 491.066587][T28204] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5834'. [ 491.265183][T28216] syzkaller0: entered promiscuous mode [ 491.281352][T28216] syzkaller0: entered allmulticast mode [ 491.431465][T28225] netlink: 240 bytes leftover after parsing attributes in process `syz.0.5839'. [ 491.442784][T28225] netlink: 'syz.0.5839': attribute type 9 has an invalid length. [ 491.721250][T28235] veth0: entered promiscuous mode [ 491.735691][T28236] netlink: 'syz.1.5843': attribute type 3 has an invalid length. [ 492.009336][T28246] lo speed is unknown, defaulting to 1000 [ 492.028413][T28241] "syz.0.5846" (28241) uses obsolete ecb(arc4) skcipher [ 492.430424][T28263] syzkaller1: entered promiscuous mode [ 492.447539][T28263] syzkaller1: entered allmulticast mode [ 493.207879][ T24] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 493.227339][T28288] gre0: left allmulticast mode [ 493.240859][T28293] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input6 [ 493.359636][T28295] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 493.431680][T28288] tipc: Resetting bearer [ 493.556786][T28288] bridge0: left allmulticast mode [ 493.628703][T28288] dummy0: left promiscuous mode [ 493.784878][ T5749] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 494.083287][T28288] tipc: Resetting bearer [ 494.111021][T28288] syzkaller0: left promiscuous mode [ 494.117147][T28288] syzkaller0: left allmulticast mode [ 494.160274][T28288] bond6: left allmulticast mode [ 494.184172][T28288] ip6gre3: left allmulticast mode [ 494.198396][T28288] bond9: left allmulticast mode [ 494.204996][T28288] ip6tnl1: left allmulticast mode [ 494.216783][T28288] veth11: left promiscuous mode [ 494.222544][T28288] hsr1: left promiscuous mode [ 494.241937][T28288] bond13: left promiscuous mode [ 494.254139][T28288] bond16: left promiscuous mode [ 494.392455][T28309] bridge0: port 1(syz_tun) entered blocking state [ 494.416804][T28309] bridge0: port 1(syz_tun) entered disabled state [ 494.434036][T28309] syz_tun: entered allmulticast mode [ 494.449562][T28309] syz_tun: entered promiscuous mode [ 494.462391][T21385] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.477264][T21385] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.500105][T21385] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.529353][T21385] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.557733][T21385] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.568146][T21385] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.576652][T21385] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.585190][T21385] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.613879][T28327] xt_hashlimit: size too large, truncated to 1048576 [ 494.770462][T28335] xt_hashlimit: size too large, truncated to 1048576 [ 495.055031][T28360] __nla_validate_parse: 6 callbacks suppressed [ 495.055051][T28360] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5875'. [ 495.369225][T28384] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 495.405672][T28385] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5879'. [ 495.432073][T28385] block nbd0: Unsupported socket: should be TCP or UNIX. [ 495.563141][T28405] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5884'. [ 495.686676][T28409] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5886'. [ 495.876469][T28428] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5891'. [ 495.985217][T28436] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5892'. [ 496.323062][T28462] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.5900'. [ 496.339331][T28465] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5901'. [ 496.348627][T28462] openvswitch: netlink: Missing key (keys=40, expected=100) [ 496.703694][T28486] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.5906'. [ 496.714228][T28486] ksmbd: Unknown IPC event: 1, ignore. [ 496.740298][T28486] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.5906'. [ 496.755530][T28486] ksmbd: Unknown IPC event: 1, ignore. [ 499.428778][T28514] netlink: 'syz.3.5913': attribute type 21 has an invalid length. [ 499.436824][T28514] netlink: 'syz.3.5913': attribute type 22 has an invalid length. [ 499.445157][T28514] netlink: 'syz.3.5913': attribute type 23 has an invalid length. [ 499.453348][T28514] netlink: 'syz.3.5913': attribute type 25 has an invalid length. [ 499.702980][T28521] netlink: 'syz.4.5915': attribute type 21 has an invalid length. [ 499.869629][T28536] syzkaller1: entered promiscuous mode [ 499.875648][T28536] syzkaller1: entered allmulticast mode [ 499.900503][T28533] syzkaller0: entered promiscuous mode [ 499.908306][T28533] syzkaller0: entered allmulticast mode [ 499.994744][T28538] Cannot find del_set index 3 as target [ 500.048213][T28546] netlink: 'syz.0.5923': attribute type 3 has an invalid length. [ 500.056437][T28546] netlink: 'syz.0.5923': attribute type 3 has an invalid length. [ 500.069228][T28546] netlink: 'syz.0.5923': attribute type 3 has an invalid length. [ 500.079028][T28546] netlink: 'syz.0.5923': attribute type 3 has an invalid length. [ 500.083067][T28551] __nla_validate_parse: 5 callbacks suppressed [ 500.083084][T28551] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5924'. [ 500.102754][T28551] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5924'. [ 500.130709][T28551] ip6erspan0: entered allmulticast mode [ 500.357012][T28571] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5931'. [ 500.425707][T28574] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5932'. [ 500.447221][ T5808] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 500.594384][T28585] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 500.635738][T28585] batman_adv: batadv0: Adding interface: gretap1 [ 500.660783][T28585] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 500.695353][T28585] batman_adv: batadv0: Interface activated: gretap1 [ 500.710890][T21381] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 501.108726][T28617] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5942'. [ 501.120610][T28625] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5944'. [ 501.140987][T28624] netlink: 'syz.0.5945': attribute type 1 has an invalid length. [ 501.246784][T28624] bond20: entered promiscuous mode [ 501.259343][T28624] 8021q: adding VLAN 0 to HW filter on device bond20 [ 501.307207][ T5808] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 501.445801][T28625] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.453293][T28625] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.599717][T28625] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 501.621411][T28625] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 501.714773][T28625] batman_adv: batadv0: Interface deactivated: gretap1 [ 501.816495][T28638] 8021q: adding VLAN 0 to HW filter on device bond0 [ 501.826080][T28638] 8021q: adding VLAN 0 to HW filter on device team0 [ 501.838124][T28638] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 501.860204][T28638] bridge0: port 1(bridge_slave_0) entered blocking state [ 501.867727][T28638] bridge0: port 1(bridge_slave_0) entered forwarding state [ 501.879955][T28638] bridge0: port 2(bridge_slave_1) entered blocking state [ 501.887138][T28638] bridge0: port 2(bridge_slave_1) entered forwarding state [ 501.908985][T28638] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 501.920254][T28638] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 501.958712][T28638] veth1_vlan: left promiscuous mode [ 501.967512][T28638] veth0_vlan: left promiscuous mode [ 501.974225][T28638] veth0_vlan: entered promiscuous mode [ 501.984721][T28638] veth1_vlan: entered promiscuous mode [ 501.996081][T28638] veth1_macvtap: left promiscuous mode [ 502.003206][T28638] veth0_macvtap: left promiscuous mode [ 502.011131][T28638] veth0_macvtap: entered promiscuous mode [ 502.027839][T28638] veth1_macvtap: entered promiscuous mode [ 502.040154][T28638] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 502.052761][T28638] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 502.065659][T28638] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 502.079194][T28638] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 502.097508][T28638] 8021q: adding VLAN 0 to HW filter on device bond1 [ 502.109533][T28638] ip6erspan0: left allmulticast mode [ 502.121418][T28638] batman_adv: batadv0: Interface activated: gretap1 [ 502.138638][T28635] ipvlan3: entered allmulticast mode [ 502.144055][T28635] bond20: entered allmulticast mode [ 502.173755][T28624] ipvlan4: entered allmulticast mode [ 502.195570][T28655] bond20: (slave bridge7): making interface the new active one [ 502.203642][T28655] bridge7: entered promiscuous mode [ 502.209785][T28655] bridge7: entered allmulticast mode [ 502.216828][T28655] bond20: (slave bridge7): Enslaving as an active interface with an up link [ 502.227435][T28623] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5943'. [ 502.249032][T28623] bridge0: port 2(bridge_slave_1) entered disabled state [ 502.264832][T28658] tipc: Enabling of bearer rejected, failed to enable media [ 502.294139][ T1162] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 502.310525][ T1162] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 502.419799][T21383] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 502.466272][T21383] dummy0: left promiscuous mode [ 502.509179][T10800] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 502.693637][T28700] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5957'. [ 503.071223][T28741] netlink: 7 bytes leftover after parsing attributes in process `syz.0.5968'. [ 503.368883][T28757] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5971'. [ 503.445429][T28757] vlan2: entered promiscuous mode [ 503.460383][T28757] gretap0: entered promiscuous mode [ 503.683537][T28775] syzkaller0: entered promiscuous mode [ 503.697283][T28775] syzkaller0: entered allmulticast mode [ 504.054217][T28802] syzkaller0: entered promiscuous mode [ 504.065159][T28802] syzkaller0: entered allmulticast mode [ 506.780399][T28783] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 506.957656][T28830] __nla_validate_parse: 1 callbacks suppressed [ 506.957683][T28830] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5989'. [ 506.969851][T28835] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 507.048639][T28833] syzkaller0: entered promiscuous mode [ 507.070430][T28833] syzkaller0: entered allmulticast mode [ 507.225363][T28846] IPVS: set_ctl: invalid protocol: 19 10.1.1.2:20003 [ 507.271734][T28846] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5992'. [ 507.282711][T28848] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5993'. [ 507.303515][T28846] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5992'. [ 507.323317][T28852] IPVS: set_ctl: invalid protocol: 19 10.1.1.2:20003 [ 507.570562][T28008] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 507.578478][T28008] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 507.578649][T28863] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5998'. [ 507.601712][T28008] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 507.614750][T28008] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 507.625695][T28008] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 507.730862][T28871] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5999'. [ 507.943234][T28884] validate_nla: 3 callbacks suppressed [ 507.943262][T28884] netlink: 'syz.1.6001': attribute type 58 has an invalid length. [ 508.212669][T28864] lo speed is unknown, defaulting to 1000 [ 508.452413][T28898] veth1_macvtap: left promiscuous mode [ 508.699140][T28864] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.707273][T28864] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.715362][T28864] bridge_slave_0: entered allmulticast mode [ 508.723863][T28864] bridge_slave_0: entered promiscuous mode [ 508.734257][T28864] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.742463][T28864] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.750555][T28864] bridge_slave_1: entered allmulticast mode [ 508.759605][T28864] bridge_slave_1: entered promiscuous mode [ 508.799360][T28864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 508.814358][T28864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 508.855525][T28864] team0: Port device team_slave_0 added [ 508.866221][T28864] team0: Port device team_slave_1 added [ 508.901892][T28864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 508.910443][T28864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 508.939313][T28864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 508.953118][T28864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 508.961042][T28864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 508.989943][T28864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 509.052244][T28864] hsr_slave_0: entered promiscuous mode [ 509.060035][T28864] hsr_slave_1: entered promiscuous mode [ 509.071146][T28864] debugfs: 'hsr0' already exists in 'hsr' [ 509.077863][T28864] Cannot create hsr debugfs directory [ 509.707745][T28008] Bluetooth: hci5: command tx timeout [ 510.503151][T28858] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 510.519733][T28864] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 510.575866][T28864] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 510.624547][T28908] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6005'. [ 510.649203][T28864] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 510.690126][T28864] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 510.735897][T28864] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 510.752912][T28915] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6007'. [ 510.771649][T28864] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 510.815683][T28912] syzkaller0: entered promiscuous mode [ 510.830506][T28912] syzkaller0: entered allmulticast mode [ 510.851093][T28864] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 510.883869][T28864] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 511.039632][T21381] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 511.062177][T21381] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 511.070246][T28929] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6009'. [ 511.225223][T28864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 511.252263][T28936] netlink: 'syz.4.6012': attribute type 12 has an invalid length. [ 511.289130][T28936] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 511.344573][T28936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6012'. [ 511.365496][T28945] nbd: must specify a device to reconfigure [ 511.376282][T28864] 8021q: adding VLAN 0 to HW filter on device team0 [ 511.436170][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.443760][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 511.513919][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.521514][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 511.790507][T28008] Bluetooth: hci5: command tx timeout [ 512.454180][T28961] bridge0: port 1(bridge_slave_0) entered disabled state [ 513.382034][T28961] geneve0: left promiscuous mode [ 513.459669][T21385] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 513.484041][T21385] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.506158][T21385] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 513.515843][T21385] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.554416][T28987] __nla_validate_parse: 2 callbacks suppressed [ 513.554434][T28987] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6022'. [ 513.581723][T21385] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 513.610265][T21385] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.633931][T21385] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 513.650277][T28992] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6023'. [ 513.659004][T28998] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6025'. [ 513.664212][T21385] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.674381][T28993] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6023'. [ 513.718650][T29000] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.812028][T29008] netlink: 'syz.1.6027': attribute type 1 has an invalid length. [ 513.844057][T29008] 8021q: adding VLAN 0 to HW filter on device bond8 [ 513.854565][T29008] bond8: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 513.865616][T29008] bond8: entered allmulticast mode [ 513.867370][T28008] Bluetooth: hci5: command tx timeout [ 513.880513][T29012] netlink: 'syz.3.6028': attribute type 2 has an invalid length. [ 513.890055][T29008] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 513.911990][T29008] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6027'. [ 514.065749][T29022] syzkaller1: entered promiscuous mode [ 514.083542][T29022] syzkaller1: entered allmulticast mode [ 514.135250][T28864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 514.230342][T28864] veth0_vlan: entered promiscuous mode [ 514.270141][T28864] veth1_vlan: entered promiscuous mode [ 514.311230][T29039] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6036'. [ 514.346244][T29040] syzkaller0: entered promiscuous mode [ 514.352862][T29040] syzkaller0: entered allmulticast mode [ 514.361060][T29039] veth1_to_batadv: entered allmulticast mode [ 514.411288][T28864] veth0_macvtap: entered promiscuous mode [ 514.419341][T29042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6038'. [ 514.454734][T28864] veth1_macvtap: entered promiscuous mode [ 514.478317][T29042] erspan0: entered promiscuous mode [ 514.509133][T28864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 514.521213][T29048] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6040'. [ 514.545257][T28864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 514.585572][ T1104] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.606566][ T1104] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.624691][ T1104] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.645282][ T1104] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.735564][T21381] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.767503][T21381] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.804630][ T1104] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.818574][ T1104] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.851659][ T1104] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 515.066111][T29097] tipc: Started in network mode [ 515.072362][T29097] tipc: Node identity ee7f30e5feb1, cluster identity 4711 [ 515.080136][T29097] tipc: Enabled bearer , priority 0 [ 515.088279][T29095] tipc: Enabling of bearer rejected, already enabled [ 515.096831][T29097] syzkaller0: entered promiscuous mode [ 515.102496][T29097] syzkaller0: entered allmulticast mode [ 515.163322][T29097] tipc: Resetting bearer [ 515.196633][T29095] syzkaller1: entered promiscuous mode [ 515.202538][T29095] syzkaller1: entered allmulticast mode [ 515.211275][T29093] tipc: Resetting bearer [ 515.219485][T29093] tipc: Disabling bearer [ 515.440280][T10800] IPVS: starting estimator thread 0... [ 515.449710][T29117] netlink: 'syz.3.6061': attribute type 1 has an invalid length. [ 515.457929][T29117] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6061'. [ 515.475392][T29117] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6061'. [ 515.490423][T29122] FAULT_INJECTION: forcing a failure. [ 515.490423][T29122] name failslab, interval 1, probability 0, space 0, times 0 [ 515.504920][T29122] CPU: 0 UID: 0 PID: 29122 Comm: syz.0.6062 Not tainted syzkaller #0 PREEMPT(full) [ 515.504943][T29122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 515.504954][T29122] Call Trace: [ 515.504996][T29122] [ 515.505068][T29122] dump_stack_lvl+0xe8/0x150 [ 515.505245][T29122] should_fail_ex+0x40c/0x560 [ 515.505323][T29122] should_failslab+0xa8/0x100 [ 515.505445][T29122] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 515.505472][T29122] ? rcu_is_watching+0x15/0xb0 [ 515.505535][T29122] ? __alloc_skb+0x1d7/0x7a0 [ 515.505612][T29122] ? trace_irq_enable+0x3b/0x140 [ 515.505652][T29122] __alloc_skb+0x1d7/0x7a0 [ 515.505672][T29122] netlink_ack+0x136/0xb30 [ 515.505755][T29122] ? __pfx_genl_rcv_msg+0x10/0x10 [ 515.505783][T29122] ? __netlink_lookup+0xc6/0x8b0 [ 515.505798][T29122] ? rcu_is_watching+0x15/0xb0 [ 515.505818][T29122] netlink_rcv_skb+0x2a4/0x4a0 [ 515.505839][T29122] ? __pfx_genl_rcv_msg+0x10/0x10 [ 515.505857][T29122] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 515.505883][T29122] ? down_read+0x2be/0x330 [ 515.505989][T29122] genl_rcv+0x28/0x40 [ 515.506005][T29122] netlink_unicast+0x7bb/0x940 [ 515.506028][T29122] netlink_sendmsg+0x813/0xb40 [ 515.506051][T29122] ? __pfx_netlink_sendmsg+0x10/0x10 [ 515.506073][T29122] ? aa_sock_msg_perm+0xf1/0x1b0 [ 515.506140][T29122] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 515.506172][T29122] ? __pfx_netlink_sendmsg+0x10/0x10 [ 515.506193][T29122] ____sys_sendmsg+0x9b9/0xa20 [ 515.506262][T29122] ? __pfx_____sys_sendmsg+0x10/0x10 [ 515.506282][T29122] ? lock_release+0x4b/0x3c0 [ 515.506314][T29122] ? import_iovec+0x73/0xa0 [ 515.506393][T29122] ___sys_sendmsg+0x2a5/0x360 [ 515.506414][T29122] ? rcu_is_watching+0x15/0xb0 [ 515.506428][T29122] ? get_pid_task+0x20/0x1f0 [ 515.506457][T29122] ? __pfx____sys_sendmsg+0x10/0x10 [ 515.506478][T29122] ? rcu_is_watching+0x15/0xb0 [ 515.506503][T29122] ? __fget_files+0x2a/0x420 [ 515.506528][T29122] ? __fget_files+0x3a2/0x420 [ 515.506548][T29122] __x64_sys_sendmsg+0x1b1/0x290 [ 515.506568][T29122] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 515.506594][T29122] ? rcu_is_watching+0x15/0xb0 [ 515.506609][T29122] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.506640][T29122] do_syscall_64+0x174/0x580 [ 515.506709][T29122] ? trace_irq_disable+0x3b/0x140 [ 515.506728][T29122] ? clear_bhb_loop+0x40/0x90 [ 515.506746][T29122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.506760][T29122] RIP: 0033:0x7f624679ce59 [ 515.506814][T29122] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 515.506858][T29122] RSP: 002b:00007f62475be028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 515.506906][T29122] RAX: ffffffffffffffda RBX: 00007f6246a15fa0 RCX: 00007f624679ce59 [ 515.506917][T29122] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000a [ 515.506926][T29122] RBP: 00007f62475be090 R08: 0000000000000000 R09: 0000000000000000 [ 515.506934][T29122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 515.506943][T29122] R13: 00007f6246a16038 R14: 00007f6246a15fa0 R15: 00007fff380ec878 [ 515.506961][T29122] [ 515.846985][T29120] IPVS: using max 65 ests per chain, 156000 per kthread [ 515.890872][T29135] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 515.947382][T28008] Bluetooth: hci5: command tx timeout [ 515.984414][T29152] netlink: 'syz.4.6070': attribute type 11 has an invalid length. [ 516.015821][T29152] syzkaller0: entered promiscuous mode [ 516.021619][T29152] syzkaller0: entered allmulticast mode [ 516.032777][T29152] netlink: 'syz.4.6070': attribute type 11 has an invalid length. [ 516.092185][T29152] A link change request failed with some changes committed already. Interface vxlan1 may have been left with an inconsistent configuration, please check. [ 516.256876][T29161] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.264173][T29161] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.402134][T29161] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 516.412742][T29161] veth1_to_batadv: left allmulticast mode [ 516.422239][T29161] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 516.510169][T29161] batman_adv: batadv0: Interface deactivated: gretap1 [ 516.529619][ T1104] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 516.548742][ T1104] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 516.569250][ T1104] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 516.580593][ T1104] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 516.662478][T29182] dvmrp8: entered allmulticast mode [ 516.776747][T29195] FAULT_INJECTION: forcing a failure. [ 516.776747][T29195] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 516.790385][T29195] CPU: 0 UID: 0 PID: 29195 Comm: syz.2.6079 Not tainted syzkaller #0 PREEMPT(full) [ 516.790409][T29195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 516.790419][T29195] Call Trace: [ 516.790425][T29195] [ 516.790432][T29195] dump_stack_lvl+0xe8/0x150 [ 516.790457][T29195] should_fail_ex+0x40c/0x560 [ 516.790477][T29195] _copy_from_user+0x2d/0xb0 [ 516.790591][T29195] kstrtouint_from_user+0xd6/0x180 [ 516.790608][T29195] ? __might_fault+0xaf/0x130 [ 516.790639][T29195] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 516.790658][T29195] ? __mutex_trylock_common+0x15f/0x270 [ 516.790678][T29195] ? vfs_write+0x22b/0xba0 [ 516.790703][T29195] ? rcu_is_watching+0x15/0xb0 [ 516.790722][T29195] proc_fail_nth_write+0x8e/0x210 [ 516.790763][T29195] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 516.790783][T29195] ? preempt_count_add+0x91/0x190 [ 516.790815][T29195] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 516.790834][T29195] vfs_write+0x296/0xba0 [ 516.790857][T29195] ? __pfx_vfs_write+0x10/0x10 [ 516.790879][T29195] ? __fget_files+0x3a2/0x420 [ 516.790896][T29195] ? __fget_files+0x2a/0x420 [ 516.790916][T29195] ksys_write+0x150/0x270 [ 516.790937][T29195] ? __pfx_ksys_write+0x10/0x10 [ 516.790958][T29195] ? rcu_is_watching+0x15/0xb0 [ 516.790974][T29195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.790991][T29195] do_syscall_64+0x174/0x580 [ 516.791011][T29195] ? trace_irq_disable+0x3b/0x140 [ 516.791032][T29195] ? clear_bhb_loop+0x40/0x90 [ 516.791050][T29195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.791065][T29195] RIP: 0033:0x7fc6c9b5d68e [ 516.791081][T29195] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 516.791095][T29195] RSP: 002b:00007fc6ca9b6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 516.791113][T29195] RAX: ffffffffffffffda RBX: 00007fc6ca9b76c0 RCX: 00007fc6c9b5d68e [ 516.791125][T29195] RDX: 0000000000000001 RSI: 00007fc6ca9b70a0 RDI: 0000000000000008 [ 516.791135][T29195] RBP: 00007fc6ca9b7090 R08: 0000000000000000 R09: 0000000000000000 [ 516.791146][T29195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 516.791156][T29195] R13: 00007fc6c9e16038 R14: 00007fc6c9e15fa0 R15: 00007ffe4292d2e8 [ 516.791175][T29195] [ 517.774565][T29244] lo speed is unknown, defaulting to 1000 [ 517.785874][T29243] syzkaller0: entered promiscuous mode [ 517.794866][T29243] syzkaller0: entered allmulticast mode [ 518.133751][T29258] lo speed is unknown, defaulting to 1000 [ 518.164246][T29277] syzkaller0: entered promiscuous mode [ 518.173172][T29277] syzkaller0: entered allmulticast mode [ 518.180533][T29279] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 518.765817][T29332] Cannot find add_set index 1 as target [ 518.990504][T29340] netlink: 'syz.3.6107': attribute type 7 has an invalid length. [ 521.223735][T29281] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 521.324360][T29349] __nla_validate_parse: 6 callbacks suppressed [ 521.324379][T29349] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6111'. [ 521.405036][T29354] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6112'. [ 521.427441][T29346] nbd: must specify a device to reconfigure [ 521.468112][T29360] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6114'. [ 521.484748][T29358] lo speed is unknown, defaulting to 1000 [ 521.681494][T29375] veth15: entered promiscuous mode [ 521.920705][ T5625] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 521.930449][ T5625] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 521.938002][ T5625] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 521.945755][ T5625] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 521.959695][ T5625] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 521.985519][T29383] geneve3: entered promiscuous mode [ 521.992100][T29383] geneve3: entered allmulticast mode [ 521.999136][T29389] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6123'. [ 522.067334][T29386] bond5 (unregistering): Released all slaves [ 522.335019][T29403] lo speed is unknown, defaulting to 1000 [ 522.380652][T29416] syzkaller0: entered promiscuous mode [ 522.390610][T29416] syzkaller0: entered allmulticast mode [ 522.412449][T29416] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6127'. [ 522.536172][T29384] lo speed is unknown, defaulting to 1000 [ 522.545917][T29425] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 522.576161][T29430] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 522.722814][T29444] bond5: option mode: invalid value (254) [ 522.735062][T29444] bond5 (unregistering): Released all slaves [ 522.975114][T29468] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6134'. [ 523.089329][T29473] netlink: del zone limit has 8 unknown bytes [ 523.153641][T29473] lo speed is unknown, defaulting to 1000 [ 523.159654][T29384] bridge0: port 1(bridge_slave_0) entered blocking state [ 523.172496][T29384] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.180876][T29384] bridge_slave_0: entered allmulticast mode [ 523.188798][T29384] bridge_slave_0: entered promiscuous mode [ 523.197314][T29384] bridge0: port 2(bridge_slave_1) entered blocking state [ 523.204552][T29384] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.212702][T29384] bridge_slave_1: entered allmulticast mode [ 523.220507][T29384] bridge_slave_1: entered promiscuous mode [ 523.229300][T29485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6138'. [ 523.245566][T29384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 523.258076][T29384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 523.307531][T29384] team0: Port device team_slave_0 added [ 523.326568][T29384] team0: Port device team_slave_1 added [ 523.333873][T29488] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6139'. [ 523.375475][T29384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 523.383677][T29384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 523.411004][T29384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 523.430671][T29485] syzkaller0: entered promiscuous mode [ 523.436438][T29485] syzkaller0: entered allmulticast mode [ 523.456663][T29384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 523.464169][T29384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 523.491746][T29384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 523.540959][T29384] hsr_slave_0: entered promiscuous mode [ 523.548213][T29384] hsr_slave_1: entered promiscuous mode [ 523.554528][T29384] debugfs: 'hsr0' already exists in 'hsr' [ 523.567664][T29497] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6141'. [ 523.573804][T29384] Cannot create hsr debugfs directory [ 523.586834][T29500] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6142'. [ 523.642783][T29506] sctp: [Deprecated]: syz.2.6144 (pid 29506) Use of int in max_burst socket option. [ 523.642783][T29506] Use struct sctp_assoc_value instead [ 523.743696][T29512] IPVS: set_ctl: invalid protocol: 59 224.0.0.2:20002 [ 523.759306][T29502] bridge_slave_0: left allmulticast mode [ 523.766204][T29502] bridge_slave_0: left promiscuous mode [ 523.785856][T29502] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.803737][T29502] bridge_slave_1: left allmulticast mode [ 523.815794][T29502] bridge_slave_1: left promiscuous mode [ 523.824711][T29502] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.850024][T29502] bond0: (slave bond_slave_0): Releasing backup interface [ 523.870836][T29502] bond0: (slave bond_slave_1): Releasing backup interface [ 523.908934][T29502] team0: Port device team_slave_0 removed [ 523.932637][T29502] team0: Port device team_slave_1 removed [ 523.941359][T29502] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.951883][T29502] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 523.963353][T29502] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.978554][T29502] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 523.989197][T29502] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 524.027164][ T5625] Bluetooth: hci3: command tx timeout [ 524.113265][T29384] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 524.124774][T29384] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.268850][T29384] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 524.280303][T29384] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.347974][T29384] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 524.361244][T29384] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.444320][T29384] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 524.455520][T29384] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.538831][T29384] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 524.550107][T29384] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 524.562031][T29384] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 524.571717][T29384] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 524.580571][T29384] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 524.594129][T29384] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 524.605447][T29384] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 524.626050][T29384] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 524.734862][T29384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 524.774338][T29384] 8021q: adding VLAN 0 to HW filter on device team0 [ 524.785705][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 524.792909][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 524.804116][ T5625] block nbd0: Receive control failed (result -32) [ 524.829050][T21385] bridge0: port 2(bridge_slave_1) entered blocking state [ 524.836187][T21385] bridge0: port 2(bridge_slave_1) entered forwarding state [ 524.922969][T29579] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 525.098463][T29590] 8021q: adding VLAN 0 to HW filter on device bond5 [ 525.106772][T29596] x_tables: duplicate underflow at hook 2 [ 525.504357][T29384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 525.574521][T29634] "syz.0.6175" (29634) uses obsolete ecb(arc4) skcipher [ 525.597364][T29384] veth0_vlan: entered promiscuous mode [ 525.763699][T29384] veth1_vlan: entered promiscuous mode [ 525.804827][T29384] veth0_macvtap: entered promiscuous mode [ 525.823694][T29384] veth1_macvtap: entered promiscuous mode [ 525.830621][T29647] tipc: Disabling bearer [ 525.868542][T29384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 525.885495][T29384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 525.900100][T21382] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.910210][T21382] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.924167][T29653] mac80211_hwsim hwsim76 wlan0: entered promiscuous mode [ 525.934245][T29653] mac80211_hwsim hwsim76 wlan0: entered allmulticast mode [ 525.946174][T29653] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 525.965218][T21382] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.986664][T21382] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 526.090661][T21381] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 526.107528][ T5625] Bluetooth: hci3: command tx timeout [ 526.112551][T21381] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 526.148361][T21382] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 526.172208][T21382] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 526.185759][T29663] xt_l2tp: invalid flags combination: 0 [ 526.317915][T29670] IPVS: Scheduler module ip_vs_sip not found [ 526.431865][T29694] netlink: 'syz.0.6195': attribute type 12 has an invalid length. [ 526.473129][T29697] __nla_validate_parse: 11 callbacks suppressed [ 526.473147][T29697] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6193'. [ 526.496363][T29698] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 526.516542][T29695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6190'. [ 526.528163][T29700] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6193'. [ 526.589396][T29697] netlink: 'syz.2.6193': attribute type 10 has an invalid length. [ 526.608245][T29697] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6193'. [ 526.637940][T29697] dummy0: entered promiscuous mode [ 526.970224][T29730] tipc: Started in network mode [ 526.975209][T29730] tipc: Node identity ac14140f, cluster identity 4711 [ 526.982673][T29730] tipc: New replicast peer: 172.30.0.4 [ 526.988967][T29730] tipc: Enabled bearer , priority 5 [ 526.998367][T29725] 5: entered promiscuous mode [ 527.004265][T29730] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6203'. [ 527.014334][T29730] tipc: Disabling bearer [ 527.021159][T29730] "syz.3.6203" (29730) uses obsolete ecb(arc4) skcipher [ 527.062092][T29737] netlink: 'syz.3.6205': attribute type 11 has an invalid length. [ 527.205812][T29747] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6209'. [ 527.215536][T29747] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6209'. [ 527.226381][T29747] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6209'. [ 527.238099][T29747] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6209'. [ 527.259440][T29747] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6209'. [ 527.333036][T29742] vlan2: entered promiscuous mode [ 527.338461][T29742] hsr0: entered promiscuous mode [ 527.343663][T29742] vlan2: entered allmulticast mode [ 527.356104][T29742] hsr0: entered allmulticast mode [ 527.361655][T29742] hsr_slave_0: entered allmulticast mode [ 527.369057][T29742] hsr_slave_1: entered allmulticast mode [ 527.390563][T29754] netlink: 'syz.1.6212': attribute type 10 has an invalid length. [ 527.410600][T29751] debugfs: '1^!Y [ 527.410600][T29751] 3UH5rBn\' already exists in 'ieee80211' [ 527.486286][T29754] team0: Port device dummy0 added [ 527.588511][T29769] netlink: 'syz.1.6216': attribute type 1 has an invalid length. [ 527.664077][T29773] tipc: Enabled bearer , priority 0 [ 527.729757][T29777] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.737296][T29777] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.804239][T29777] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 527.819111][T29777] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 527.907567][T29773] syzkaller0: entered promiscuous mode [ 527.913305][T29773] syzkaller0: entered allmulticast mode [ 527.929565][T21382] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.943422][T29774] tipc: Resetting bearer [ 527.980606][T29774] tipc: Disabling bearer [ 527.994410][T29791] netlink: 'syz.1.6221': attribute type 1 has an invalid length. [ 528.009292][T21382] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.018537][T21382] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.032839][T21382] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.048259][T29791] nlmon0: entered promiscuous mode [ 528.055449][T29791] nlmon0: entered allmulticast mode [ 528.078253][T29795] 8021q: adding VLAN 0 to HW filter on device bond6 [ 528.092826][T29796] bond6: (slave veth13): Enslaving as an active interface with an up link [ 528.187616][ T5625] Bluetooth: hci3: command tx timeout [ 528.281017][T29811] syzkaller0: entered promiscuous mode [ 528.286748][T29811] syzkaller0: entered allmulticast mode [ 528.302947][T29811] tipc: Enabled bearer , priority 0 [ 528.333688][T29810] tipc: Resetting bearer [ 528.364560][T29810] tipc: Disabling bearer [ 528.499028][T29830] netlink: 'syz.4.6233': attribute type 1 has an invalid length. [ 528.527846][T29830] 8021q: adding VLAN 0 to HW filter on device bond7 [ 528.536683][T29833] netlink: 'syz.3.6234': attribute type 64 has an invalid length. [ 528.693492][T29850] "syz.2.6235" (29850) uses obsolete ecb(arc4) skcipher [ 528.801156][T29860] macvtap0: entered promiscuous mode [ 528.883779][T29869] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 528.989764][T29878] Cannot find del_set index 0 as target [ 529.083905][T29885] syzkaller1: entered promiscuous mode [ 529.099785][T29885] syzkaller1: entered allmulticast mode [ 529.393449][T29896] xt_hashlimit: size too large, truncated to 1048576 [ 529.700504][T29927] tipc: Started in network mode [ 529.713759][T29927] tipc: Node identity 36bd740e3c06, cluster identity 4711 [ 529.726248][T29927] tipc: Enabled bearer , priority 0 [ 529.831368][T29934] syzkaller0: entered promiscuous mode [ 529.839562][T29934] syzkaller0: entered allmulticast mode [ 529.852862][T29934] tipc: Resetting bearer [ 529.859666][T29926] tipc: Enabling of bearer rejected, already enabled [ 529.906214][T29926] tipc: Resetting bearer [ 530.001168][T29926] tipc: Disabling bearer [ 530.075721][ T5625] block nbd2: Receive control failed (result -104) [ 530.145013][T29961] netlink: 'syz.1.6274': attribute type 1 has an invalid length. [ 530.265055][T29971] x_tables: duplicate underflow at hook 2 [ 530.274208][ T5625] Bluetooth: hci3: command tx timeout [ 530.352839][T29965] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 530.380522][T29980] sctp: [Deprecated]: syz.4.6281 (pid 29980) Use of int in max_burst socket option. [ 530.380522][T29980] Use struct sctp_assoc_value instead [ 530.403594][ T5709] IPVS: starting estimator thread 0... [ 530.410202][T29986] FAULT_INJECTION: forcing a failure. [ 530.410202][T29986] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 530.424857][T29986] CPU: 0 UID: 0 PID: 29986 Comm: syz.0.6282 Not tainted syzkaller #0 PREEMPT(full) [ 530.424882][T29986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 530.424892][T29986] Call Trace: [ 530.424898][T29986] [ 530.424906][T29986] dump_stack_lvl+0xe8/0x150 [ 530.424932][T29986] should_fail_ex+0x40c/0x560 [ 530.424953][T29986] _copy_to_user+0x31/0xb0 [ 530.424975][T29986] simple_read_from_buffer+0xe1/0x170 [ 530.424998][T29986] proc_fail_nth_read+0x1bb/0x230 [ 530.425020][T29986] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 530.425042][T29986] ? rw_verify_area+0x24a/0x4c0 [ 530.425063][T29986] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 530.425080][T29986] vfs_read+0x213/0xa80 [ 530.425102][T29986] ? __pfx___mutex_lock+0x10/0x10 [ 530.425123][T29986] ? __pfx_vfs_read+0x10/0x10 [ 530.425146][T29986] ? __fget_files+0x3a2/0x420 [ 530.425162][T29986] ? __fget_files+0x2a/0x420 [ 530.425182][T29986] ksys_read+0x150/0x270 [ 530.425203][T29986] ? __pfx_ksys_read+0x10/0x10 [ 530.425224][T29986] ? rcu_is_watching+0x15/0xb0 [ 530.425243][T29986] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.425261][T29986] do_syscall_64+0x174/0x580 [ 530.425281][T29986] ? trace_irq_disable+0x3b/0x140 [ 530.425303][T29986] ? clear_bhb_loop+0x40/0x90 [ 530.425322][T29986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.425337][T29986] RIP: 0033:0x7f624675d68e [ 530.425353][T29986] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 530.425367][T29986] RSP: 002b:00007f62475bdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 530.425385][T29986] RAX: ffffffffffffffda RBX: 00007f62475be6c0 RCX: 00007f624675d68e [ 530.425397][T29986] RDX: 000000000000000f RSI: 00007f62475be0a0 RDI: 0000000000000004 [ 530.425407][T29986] RBP: 00007f62475be090 R08: 0000000000000000 R09: 0000000000000000 [ 530.425418][T29986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.425427][T29986] R13: 00007f6246a16038 R14: 00007f6246a15fa0 R15: 00007fff380ec878 [ 530.425447][T29986] [ 530.736951][T29985] IPVS: using max 55 ests per chain, 132000 per kthread [ 530.983336][T30021] syzkaller0: entered promiscuous mode [ 530.993314][T30021] syzkaller0: entered allmulticast mode [ 531.034900][T30023] syzkaller0: entered promiscuous mode [ 531.040998][T30023] syzkaller0: entered allmulticast mode [ 531.125340][T30029] lo speed is unknown, defaulting to 1000 [ 531.569700][T30057] netlink: 'syz.4.6305': attribute type 1 has an invalid length. [ 531.573291][T30056] syzkaller0: entered promiscuous mode [ 531.583843][T30056] syzkaller0: entered allmulticast mode [ 531.610236][T30057] 8021q: adding VLAN 0 to HW filter on device bond9 [ 531.619454][T30057] bond8: (slave bond9): making interface the new active one [ 531.627550][T30057] bond8: (slave bond9): Enslaving as an active interface with an up link [ 531.650457][T30057] bond8: (slave gretap1): Enslaving as a backup interface with an up link [ 531.661632][T30057] __nla_validate_parse: 19 callbacks suppressed [ 531.661651][T30057] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6305'. [ 531.679834][T30057] 8021q: adding VLAN 0 to HW filter on device bond8 [ 531.955584][T28008] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 531.964557][T28008] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 531.975764][T28008] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 531.985330][T28008] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 531.992909][T28008] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 532.148984][T30081] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6313'. [ 532.187465][ C0] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 532.281185][T18579] syz_tun (unregistering): left allmulticast mode [ 532.290343][ T36] smbdirect: ib_dev[syz1] removed [ 532.295447][T18579] syz_tun (unregistering): left promiscuous mode [ 532.312182][T18579] bridge0: port 1(syz_tun) entered disabled state [ 532.333753][ T5731] infiniband syz1: ib_query_port failed (-19) [ 532.378910][T30100] syzkaller0: entered promiscuous mode [ 532.399586][T30100] syzkaller0: entered allmulticast mode [ 532.494831][T30080] lo speed is unknown, defaulting to 1000 [ 532.898113][T30137] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6324'. [ 532.995046][T30137] bridge1: port 1(veth0_to_bond) entered blocking state [ 533.011359][T30137] bridge1: port 1(veth0_to_bond) entered disabled state [ 533.023483][T30137] veth0_to_bond: entered allmulticast mode [ 533.036311][T30137] veth0_to_bond: entered promiscuous mode [ 533.206366][T30080] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.226348][T30080] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.242359][T30148] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6325'. [ 533.258058][T30080] bridge_slave_0: entered allmulticast mode [ 533.278984][T30080] bridge_slave_0: entered promiscuous mode [ 533.377586][T30080] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.386102][T30080] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.402796][T30080] bridge_slave_1: entered allmulticast mode [ 533.423332][T30080] bridge_slave_1: entered promiscuous mode [ 533.483329][T30080] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 533.509554][T30080] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 533.538098][T30080] team0: Port device team_slave_0 added [ 533.547559][T30080] team0: Port device team_slave_1 added [ 533.574238][T30080] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 533.581499][T30080] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 533.624317][T30080] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 533.654937][T30080] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 533.668427][T30080] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 533.715045][T30080] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 533.755982][T30080] hsr_slave_0: entered promiscuous mode [ 533.763338][T30080] hsr_slave_1: entered promiscuous mode [ 533.770601][T30080] debugfs: 'hsr0' already exists in 'hsr' [ 533.798052][T30080] Cannot create hsr debugfs directory [ 533.918140][T30080] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.928370][T30080] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.939286][T30080] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 54526 - 0 [ 534.011231][T30080] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 534.021732][T30080] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.033961][T30080] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 54526 - 0 [ 534.037086][T28008] Bluetooth: hci2: command tx timeout [ 534.100453][T30080] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 534.116758][T30080] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.127842][T30080] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 54526 - 0 [ 534.159263][T30097] Set syz1 is full, maxelem 65536 reached [ 534.176671][T30080] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 534.195454][T30080] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.211846][T30080] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 54526 - 0 [ 535.580205][T30116] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 535.594367][T30080] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 535.617761][T30080] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 535.634011][T30080] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 535.650380][T30165] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6329'. [ 535.653082][T30080] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 535.675818][T30080] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 535.678052][T30169] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6329'. [ 535.707609][T30080] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 535.722666][T30167] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6330'. [ 535.736711][T30080] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 535.743774][T30167] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6330'. [ 535.782417][T30080] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 535.890835][T30178] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6334'. [ 535.950992][T30196] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6336'. [ 535.983908][T30193] syzkaller0: entered promiscuous mode [ 536.002689][T30193] syzkaller0: entered allmulticast mode [ 536.035722][T30196] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 536.054404][T30196] veth0: entered promiscuous mode [ 536.077606][T30196] debugfs: 'hsr1' already exists in 'hsr' [ 536.096046][T30196] Cannot create hsr debugfs directory [ 536.107108][T28008] Bluetooth: hci2: command tx timeout [ 536.136199][T30080] 8021q: adding VLAN 0 to HW filter on device bond0 [ 536.177749][T30080] 8021q: adding VLAN 0 to HW filter on device team0 [ 536.189493][T21381] bridge0: port 1(bridge_slave_0) entered blocking state [ 536.196648][T21381] bridge0: port 1(bridge_slave_0) entered forwarding state [ 536.230700][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 536.237904][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 536.290870][T30201] netlink: 'syz.2.6337': attribute type 61 has an invalid length. [ 536.629714][T30208] netlink: 'syz.2.6338': attribute type 1 has an invalid length. [ 536.724715][T30208] xt_CT: You must specify a L4 protocol and not use inversions on it [ 536.756331][T30208] openvswitch: netlink: Key type 278 is out of range max 32 [ 536.972262][T30227] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 537.195949][T30242] netlink: 6024 bytes leftover after parsing attributes in process `syz.0.6347'. [ 537.299375][T30080] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 537.844838][T30267] netlink: 'syz.1.6351': attribute type 1 has an invalid length. [ 537.884281][T30270] bridge3: entered promiscuous mode [ 537.897901][T30270] bridge3: entered allmulticast mode [ 537.943140][T30267] 8021q: adding VLAN 0 to HW filter on device bond1 [ 538.011501][T30080] veth0_vlan: entered promiscuous mode [ 538.044267][T30080] veth1_vlan: entered promiscuous mode [ 538.104247][T30080] veth0_macvtap: entered promiscuous mode [ 538.122757][T30080] veth1_macvtap: entered promiscuous mode [ 538.162762][T30080] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 538.188898][T28008] Bluetooth: hci2: command tx timeout [ 538.199730][T30080] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 538.236530][ T1104] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.247460][ T1104] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.260980][ T1104] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.281538][ T1104] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.383212][T21382] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 538.398899][T21382] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 538.426348][ T1162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 538.439245][ T1162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 538.443337][T30301] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6358'. [ 538.582746][T30311] netlink: 'syz.1.6361': attribute type 1 has an invalid length. [ 538.660061][ T5625] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 538.668712][ T5625] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 538.678425][ T5625] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 538.688301][ T5625] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 538.696289][ T5625] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 538.711335][T30311] 8021q: adding VLAN 0 to HW filter on device bond2 [ 539.014989][T30340] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6365'. [ 539.027966][T30315] lo speed is unknown, defaulting to 1000 [ 539.053419][T30340] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6365'. [ 539.082164][T30345] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6366'. [ 539.095148][T30340] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6365'. [ 539.108432][T30348] netlink: 766 bytes leftover after parsing attributes in process `syz.0.6365'. [ 539.658668][T30382] sctp: [Deprecated]: syz.1.6371 (pid 30382) Use of int in maxseg socket option. [ 539.658668][T30382] Use struct sctp_assoc_value instead [ 539.828224][T30394] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6377'. [ 539.892557][T30396] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6376'. [ 539.917086][T30315] bridge0: port 1(bridge_slave_0) entered blocking state [ 539.951686][T30315] bridge0: port 1(bridge_slave_0) entered disabled state [ 539.984625][T30315] bridge_slave_0: entered allmulticast mode [ 539.986801][T30403] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6379'. [ 539.998652][T30315] bridge_slave_0: entered promiscuous mode [ 540.016619][T30403] netlink: 'syz.1.6379': attribute type 1 has an invalid length. [ 540.051208][T30315] bridge0: port 2(bridge_slave_1) entered blocking state [ 540.097914][T30315] bridge0: port 2(bridge_slave_1) entered disabled state [ 540.117511][T30315] bridge_slave_1: entered allmulticast mode [ 540.124653][T30315] bridge_slave_1: entered promiscuous mode [ 540.180877][T30315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 540.205151][T30315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 540.252243][T12330] udevd[12330]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 540.275943][ T5625] Bluetooth: hci2: command tx timeout [ 540.283612][T30315] team0: Port device team_slave_0 added [ 540.306610][T30315] team0: Port device team_slave_1 added [ 540.410719][T30315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 540.425756][T30315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 540.480995][T30315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 540.508824][T30315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 540.517548][T30315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 540.557082][T30315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 540.729990][T30315] hsr_slave_0: entered promiscuous mode [ 540.746646][T30315] hsr_slave_1: entered promiscuous mode [ 540.757995][ T5625] Bluetooth: hci4: command tx timeout [ 540.762627][T30315] debugfs: 'hsr0' already exists in 'hsr' [ 540.776779][T30315] Cannot create hsr debugfs directory [ 540.796060][T30420] syzkaller0: entered promiscuous mode [ 540.804645][T30420] syzkaller0: entered allmulticast mode [ 541.052624][T30455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 541.135324][T30457] syzkaller0: entered promiscuous mode [ 541.142956][T30457] syzkaller0: entered allmulticast mode [ 541.155933][T30457] TC_ACT_REPEAT abuse ? [ 541.369524][T30462] SET target dimension over the limit! [ 541.513798][T30315] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 541.524821][T30315] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 541.533899][T30315] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 541.548403][T30315] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 541.563821][T30315] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 541.576393][T30315] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 541.585764][T30315] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 541.610977][T30315] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 541.647687][T30469] 8021q: adding VLAN 0 to HW filter on device bond3 [ 541.677430][T30469] ipvlan2: entered allmulticast mode [ 541.684762][T30469] bond3: entered allmulticast mode [ 541.696298][T30469] bond3: (slave ipip1): refused to change device type [ 541.723113][T30477] netlink: 'syz.0.6402': attribute type 11 has an invalid length. [ 541.731168][T30477] netlink: 'syz.0.6402': attribute type 4 has an invalid length. [ 541.765106][T30477] netlink: 'syz.0.6402': attribute type 6 has an invalid length. [ 541.783395][T30315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 541.822804][T30315] 8021q: adding VLAN 0 to HW filter on device team0 [ 541.830586][T30483] netlink: 'syz.4.6403': attribute type 1 has an invalid length. [ 541.850354][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 541.857538][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 541.869089][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 541.876267][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 541.896764][T30483] bond_slave_0: entered promiscuous mode [ 541.902797][T30483] bond_slave_0: entered allmulticast mode [ 541.908364][T30498] openvswitch: netlink: VXLAN extension message has 12 unknown bytes. [ 541.973026][T30503] netlink: 'syz.4.6407': attribute type 21 has an invalid length. [ 542.180149][T30521] netlink: 'syz.0.6412': attribute type 1 has an invalid length. [ 542.229982][T30521] bond1: entered promiscuous mode [ 542.245553][T30521] 8021q: adding VLAN 0 to HW filter on device bond1 [ 542.257479][T30520] __nla_validate_parse: 11 callbacks suppressed [ 542.257496][T30520] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6412'. [ 542.342539][T30521] bond1: (slave veth3): making interface the new active one [ 542.358894][ T5625] Bluetooth: hci2: command tx timeout [ 542.361419][T30521] veth3: entered promiscuous mode [ 542.384726][T30521] bond1: (slave veth3): Enslaving as an active interface with an up link [ 542.402799][T30520] netlink: 'syz.0.6412': attribute type 8 has an invalid length. [ 542.412073][T30520] netlink: 96 bytes leftover after parsing attributes in process `syz.0.6412'. [ 542.425609][T30539] openvswitch: netlink: IP tunnel dst address not specified [ 542.453590][T30536] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6413'. [ 542.549845][T30315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 542.581393][T30546] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6418'. [ 542.690976][T30315] veth0_vlan: entered promiscuous mode [ 542.725153][T30554] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6420'. [ 542.739091][T30315] veth1_vlan: entered promiscuous mode [ 542.829009][ T5625] Bluetooth: hci4: command tx timeout [ 542.844201][T30315] veth0_macvtap: entered promiscuous mode [ 542.880591][T30558] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6422'. [ 542.892043][T30557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6422'. [ 542.902868][T30315] veth1_macvtap: entered promiscuous mode [ 542.921587][T30315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 542.966191][T30557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6422'. [ 542.978266][T30315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 542.982781][T30562] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6424'. [ 543.001914][T30557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6422'. [ 543.011196][T21381] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.021263][T21381] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.047380][T21381] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.056722][T21381] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.136738][T21385] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.164756][T21385] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.211014][T21381] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.222009][T21381] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.283108][T30579] FAULT_INJECTION: forcing a failure. [ 543.283108][T30579] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 543.302619][T30576] netlink: 'syz.4.6427': attribute type 16 has an invalid length. [ 543.330957][T30579] CPU: 1 UID: 0 PID: 30579 Comm: syz.3.6428 Not tainted syzkaller #0 PREEMPT(full) [ 543.330983][T30579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 543.330993][T30579] Call Trace: [ 543.331001][T30579] [ 543.331009][T30579] dump_stack_lvl+0xe8/0x150 [ 543.331031][T30579] should_fail_ex+0x40c/0x560 [ 543.331051][T30579] _copy_from_user+0x2d/0xb0 [ 543.331072][T30579] ___sys_sendmsg+0x1c6/0x360 [ 543.331097][T30579] ? rcu_is_watching+0x15/0xb0 [ 543.331113][T30579] ? get_pid_task+0x20/0x1f0 [ 543.331130][T30579] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.331153][T30579] ? rcu_is_watching+0x15/0xb0 [ 543.331179][T30579] ? __fget_files+0x2a/0x420 [ 543.331196][T30579] ? __fget_files+0x3a2/0x420 [ 543.331217][T30579] __x64_sys_sendmsg+0x1b1/0x290 [ 543.331240][T30579] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 543.331266][T30579] ? rcu_is_watching+0x15/0xb0 [ 543.331281][T30579] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.331297][T30579] do_syscall_64+0x174/0x580 [ 543.331317][T30579] ? trace_irq_disable+0x3b/0x140 [ 543.331337][T30579] ? clear_bhb_loop+0x40/0x90 [ 543.331353][T30579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.331367][T30579] RIP: 0033:0x7fccbbd9ce59 [ 543.331382][T30579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.331396][T30579] RSP: 002b:00007fccbccd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 543.331414][T30579] RAX: ffffffffffffffda RBX: 00007fccbc015fa0 RCX: 00007fccbbd9ce59 [ 543.331425][T30579] RDX: 0000000004000040 RSI: 0000200000000000 RDI: 0000000000000003 [ 543.331437][T30579] RBP: 00007fccbccd5090 R08: 0000000000000000 R09: 0000000000000000 [ 543.331447][T30579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 543.331457][T30579] R13: 00007fccbc016038 R14: 00007fccbc015fa0 R15: 00007ffd73a19c78 [ 543.331477][T30579] [ 543.383062][T30584] syzkaller0: entered promiscuous mode [ 543.539398][T30584] syzkaller0: entered allmulticast mode [ 543.566676][T30586] netlink: 'syz.3.6430': attribute type 4 has an invalid length. [ 543.647377][T30593] syzkaller0: entered promiscuous mode [ 543.658153][T30593] syzkaller0: entered allmulticast mode [ 543.849911][T30611] IPv6: NLM_F_REPLACE set, but no existing node found! [ 543.862342][T30611] netlink: 'syz.4.6438': attribute type 1 has an invalid length. [ 543.884831][T30611] bond1 (unregistering): Released all slaves [ 543.901040][T30613] netlink: 'syz.0.6439': attribute type 12 has an invalid length. [ 544.020810][ T9] IPVS: starting estimator thread 0... [ 544.094662][T30625] lo speed is unknown, defaulting to 1000 [ 544.117298][T30627] IPVS: using max 52 ests per chain, 124800 per kthread [ 544.239788][T30643] veth1_to_hsr: entered promiscuous mode [ 544.248817][T30643] A link change request failed with some changes committed already. Interface veth1_to_hsr may have been left with an inconsistent configuration, please check. [ 544.421376][T30652] syzkaller0: entered promiscuous mode [ 544.436422][T30652] syzkaller0: entered allmulticast mode [ 544.679690][T30667] FAULT_INJECTION: forcing a failure. [ 544.679690][T30667] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 544.736061][T30667] CPU: 0 UID: 0 PID: 30667 Comm: syz.1.6456 Not tainted syzkaller #0 PREEMPT(full) [ 544.736085][T30667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 544.736094][T30667] Call Trace: [ 544.736100][T30667] [ 544.736107][T30667] dump_stack_lvl+0xe8/0x150 [ 544.736130][T30667] should_fail_ex+0x40c/0x560 [ 544.736149][T30667] _copy_from_iter+0x1d3/0x1660 [ 544.736170][T30667] ? rcu_is_watching+0x15/0xb0 [ 544.736190][T30667] ? __pfx__copy_from_iter+0x10/0x10 [ 544.736207][T30667] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 544.736230][T30667] ? netlink_sendmsg+0x650/0xb40 [ 544.736251][T30667] ? skb_put+0x112/0x210 [ 544.736272][T30667] netlink_sendmsg+0x6c0/0xb40 [ 544.736297][T30667] ? __pfx_netlink_sendmsg+0x10/0x10 [ 544.736318][T30667] ? aa_sock_msg_perm+0xf1/0x1b0 [ 544.736335][T30667] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 544.736354][T30667] ? __pfx_netlink_sendmsg+0x10/0x10 [ 544.736376][T30667] ____sys_sendmsg+0x9b9/0xa20 [ 544.736401][T30667] ? __pfx_____sys_sendmsg+0x10/0x10 [ 544.736424][T30667] ? lock_release+0x4b/0x3c0 [ 544.736455][T30667] ? import_iovec+0x73/0xa0 [ 544.736476][T30667] ___sys_sendmsg+0x2a5/0x360 [ 544.736495][T30667] ? rcu_is_watching+0x15/0xb0 [ 544.736510][T30667] ? get_pid_task+0x20/0x1f0 [ 544.736526][T30667] ? __pfx____sys_sendmsg+0x10/0x10 [ 544.736548][T30667] ? rcu_is_watching+0x15/0xb0 [ 544.736574][T30667] ? __fget_files+0x2a/0x420 [ 544.736591][T30667] ? __fget_files+0x3a2/0x420 [ 544.736612][T30667] __x64_sys_sendmsg+0x1b1/0x290 [ 544.736634][T30667] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 544.736660][T30667] ? rcu_is_watching+0x15/0xb0 [ 544.736676][T30667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.736693][T30667] do_syscall_64+0x174/0x580 [ 544.736714][T30667] ? trace_irq_disable+0x3b/0x140 [ 544.736734][T30667] ? clear_bhb_loop+0x40/0x90 [ 544.736751][T30667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.736767][T30667] RIP: 0033:0x7fa2e9b9ce59 [ 544.736782][T30667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 544.736796][T30667] RSP: 002b:00007fa2eaae9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 544.736814][T30667] RAX: ffffffffffffffda RBX: 00007fa2e9e15fa0 RCX: 00007fa2e9b9ce59 [ 544.736826][T30667] RDX: 0000000004000040 RSI: 0000200000000000 RDI: 0000000000000003 [ 544.736836][T30667] RBP: 00007fa2eaae9090 R08: 0000000000000000 R09: 0000000000000000 [ 544.736848][T30667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 544.736857][T30667] R13: 00007fa2e9e16038 R14: 00007fa2e9e15fa0 R15: 00007ffe9c29b138 [ 544.736874][T30667] [ 544.998090][ T5625] Bluetooth: hci4: command tx timeout [ 545.161127][T30678] sctp: [Deprecated]: syz.0.6459 (pid 30678) Use of int in maxseg socket option. [ 545.161127][T30678] Use struct sctp_assoc_value instead [ 545.208325][T30683] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 545.284301][T30696] openvswitch: netlink: nsh attr 5 is out of range max 3 [ 545.293334][T30696] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 545.315782][T30696] syzkaller1: entered promiscuous mode [ 545.322246][T30696] syzkaller1: entered allmulticast mode [ 545.470885][T30708] syzkaller0: entered allmulticast mode [ 545.564425][T30718] syzkaller0: entered promiscuous mode [ 545.571312][T30718] syzkaller0: entered allmulticast mode [ 545.745718][T30722] 8021q: adding VLAN 0 to HW filter on device bond4 [ 545.790173][T30731] bond4: (slave veth13): Enslaving as an active interface with a down link [ 545.884409][T30722] bond4: (slave veth15): Enslaving as an active interface with a down link [ 545.954593][T30731] bond4: (slave bridge4): Enslaving as an active interface with a down link [ 546.113786][T30748] IPVS: set_ctl: invalid protocol: 59 224.0.0.2:20000 [ 546.242821][T30754] bond3: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 546.282255][T30754] bond3 (unregistering): Released all slaves [ 546.966144][T30698] Set syz1 is full, maxelem 65536 reached [ 547.067221][ T5625] Bluetooth: hci4: command tx timeout [ 547.555590][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 563.692451][T30775] __nla_validate_parse: 48 callbacks suppressed [ 563.692468][T30775] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6491'. [ 563.740487][T30786] openvswitch: netlink: Message has 192 unknown bytes. [ 564.092464][T30822] openvswitch: netlink: IP tunnel dst address not specified [ 564.169844][T30829] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6503'. [ 564.199438][T30829] tipc: Enabled bearer , priority 0 [ 564.234119][T30827] tipc: Disabling bearer [ 564.255361][T30836] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6505'. [ 564.285132][T30835] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6505'. [ 564.355638][T30856] validate_nla: 4 callbacks suppressed [ 564.355658][T30856] netlink: 'syz.4.6510': attribute type 1 has an invalid length. [ 564.382532][T30856] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 564.401064][T30860] netlink: 'syz.1.6511': attribute type 3 has an invalid length. [ 564.424090][T30860] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6511'. [ 564.454738][T30869] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6513'. [ 564.536420][T30884] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6516'. [ 564.548413][T30884] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6516'. [ 564.558410][T30884] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6516'. [ 564.568111][T30884] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6516'. [ 564.803112][T30918] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 565.895241][T30968] openvswitch: netlink: Flow key attr not present in new flow. [ 566.063881][T30977] netlink: 'syz.3.6543': attribute type 25 has an invalid length. [ 566.145836][T30977] syzkaller0: entered promiscuous mode [ 566.167613][T30977] syzkaller0: entered allmulticast mode [ 566.174336][T30983] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 566.245135][T30988] xt_HMARK: proto mask must be zero with L3 mode [ 566.485783][T30997] veth1_to_batadv: entered allmulticast mode [ 566.974823][T31009] vlan2: entered promiscuous mode [ 566.982847][T31009] hsr0: entered promiscuous mode [ 566.988962][T31009] vlan2: entered allmulticast mode [ 566.992600][T30906] Set syz1 is full, maxelem 65536 reached [ 567.000569][T31009] hsr0: entered allmulticast mode [ 567.015899][T31009] hsr_slave_0: entered allmulticast mode [ 567.030394][T31009] hsr_slave_1: entered allmulticast mode [ 567.049680][T31014] hsr_slave_0: left promiscuous mode [ 567.060837][T31014] hsr_slave_1: left promiscuous mode [ 582.017237][T31081] syzkaller0: entered promiscuous mode [ 582.022981][T31081] syzkaller0: entered allmulticast mode [ 582.123943][T31094] __nla_validate_parse: 9 callbacks suppressed [ 582.123961][T31094] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6560'. [ 582.135450][T31091] tipc: Started in network mode [ 582.177226][T31091] tipc: Node identity , cluster identity 4711 [ 582.185145][T31091] tipc: Failed to obtain node identity [ 582.207843][T31091] tipc: Enabling of bearer rejected, failed to enable media [ 582.244813][T31103] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6554'. [ 582.391971][T31116] netlink: 'syz.3.6566': attribute type 1 has an invalid length. [ 582.434249][T31116] 8021q: adding VLAN 0 to HW filter on device bond5 [ 582.482547][T31120] bond5: (slave gretap4): making interface the new active one [ 582.499756][T31120] bond5: (slave gretap4): Enslaving as an active interface with an up link [ 582.528264][T31119] lo speed is unknown, defaulting to 1000 [ 582.821029][T31137] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6571'. [ 583.124281][T31159] netlink: 'syz.1.6576': attribute type 1 has an invalid length. [ 583.155721][T31159] 8021q: adding VLAN 0 to HW filter on device bond3 [ 583.167985][T31164] netlink: 'syz.2.6579': attribute type 32 has an invalid length. [ 583.180035][T31159] 8021q: adding VLAN 0 to HW filter on device bond3 [ 583.187417][T31159] bond3: (slave gre1): The slave device specified does not support setting the MAC address [ 583.198914][T31159] bond3: (slave gre1): Error -95 calling set_mac_address [ 583.235522][T31166] gretap1: entered promiscuous mode [ 583.248799][T31166] bond3: (slave gretap1): making interface the new active one [ 583.260835][T31166] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 583.340656][T31159] macvlan2: entered promiscuous mode [ 583.352777][T31159] macvlan2: entered allmulticast mode [ 583.366026][T31159] bond3: entered promiscuous mode [ 583.372400][T31177] Bluetooth: MGMT ver 1.23 [ 583.376261][T31159] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 583.394456][T31159] bond3: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 583.419584][T31159] bond3: left promiscuous mode [ 583.434312][T31164] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6579'. [ 583.447049][T31175] tipc: New replicast peer: 255.255.255.255 [ 583.455254][T31175] tipc: Enabled bearer , priority 5 [ 583.682132][T31183] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6584'. [ 583.725243][T31183] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6584'. [ 583.769839][T31183] netlink: 'syz.0.6584': attribute type 14 has an invalid length. [ 583.817745][T31183] netlink: 'syz.0.6584': attribute type 12 has an invalid length. [ 583.914547][T31205] x_tables: duplicate underflow at hook 3 [ 583.979923][T31199] syzkaller0: entered promiscuous mode [ 583.985621][T31199] syzkaller0: entered allmulticast mode [ 584.047924][T31216] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6592'. [ 584.155289][T31216] ip6gre2: entered promiscuous mode [ 584.166828][T31220] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 584.169065][T31216] ip6gre2: entered allmulticast mode [ 584.174134][T31220] IPv6: NLM_F_CREATE should be set when creating new route [ 584.175508][T31220] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 584.219014][T31228] netlink: 'syz.3.6595': attribute type 1 has an invalid length. [ 584.232361][T31223] netlink: 'syz.0.6592': attribute type 6 has an invalid length. [ 584.243925][T31223] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6592'. [ 584.345209][T31235] ip6t_srh: unknown srh match flags 4000 [ 584.380040][T31239] netlink: 312 bytes leftover after parsing attributes in process `syz.2.6599'. [ 584.402453][T31239] netlink: 'syz.2.6599': attribute type 1 has an invalid length. [ 584.508738][T31247] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6598'. [ 584.609836][T31253] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 584.665179][T31258] openvswitch: netlink: Key 6 has unexpected len 276 expected 2 [ 584.689069][T31263] Bluetooth: MGMT ver 1.23 [ 584.768595][ T5731] tipc: Node number set to 281948389 [ 584.802962][T31268] bond6: entered promiscuous mode [ 584.809194][T31268] 8021q: adding VLAN 0 to HW filter on device bond6 [ 584.847778][T31260] pim6reg1: entered promiscuous mode [ 584.853362][T31260] pim6reg1: entered allmulticast mode [ 584.905183][T31268] 8021q: adding VLAN 0 to HW filter on device bond6 [ 584.933324][T31268] bond6: (slave sit1): The slave device specified does not support setting the MAC address [ 584.956736][T31268] bond6: (slave sit1): Error -95 calling set_mac_address [ 585.091302][T31278] syzkaller0: entered promiscuous mode [ 585.097635][T31278] syzkaller0: entered allmulticast mode [ 585.454416][T31305] syzkaller0: refused to change device tx_queue_len [ 585.884638][T31333] tipc: Started in network mode [ 585.901647][T31333] tipc: Node identity 6e0d01029163, cluster identity 4711 [ 585.910034][T31333] tipc: Enabled bearer , priority 0 [ 585.919446][T31336] tipc: Enabling of bearer rejected, already enabled [ 585.937901][T31333] syzkaller0: entered promiscuous mode [ 585.946098][T31333] syzkaller0: entered allmulticast mode [ 585.969582][T31333] tipc: Resetting bearer [ 586.085575][T31348] nbd: must specify a size in bytes for the device [ 586.108025][T31348] block nbd2: NBD_DISCONNECT [ 586.121294][T31348] block nbd2: Send disconnect failed -32 [ 586.135892][T31348] block nbd2: shutting down sockets [ 586.820019][T31331] tipc: Resetting bearer [ 586.966547][T31331] tipc: Disabling bearer [ 587.037041][T31373] sctp: [Deprecated]: syz.3.6627 (pid 31373) Use of struct sctp_assoc_value in delayed_ack socket option. [ 587.037041][T31373] Use struct sctp_sack_info instead [ 587.089346][ T5897] tipc: Node number set to 4285399298 [ 587.233681][T31389] team_slave_1: entered promiscuous mode [ 587.264380][T31389] team_slave_1: entered allmulticast mode [ 587.320806][T31395] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 587.343586][T31391] netlink: 'syz.3.6632': attribute type 1 has an invalid length. [ 587.397886][T31404] __nla_validate_parse: 5 callbacks suppressed [ 587.397917][T31404] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6635'. [ 587.418102][T31404] netlink: 128 bytes leftover after parsing attributes in process `syz.0.6635'. [ 587.789865][T31423] syzkaller0: entered promiscuous mode [ 587.808770][T31423] syzkaller0: entered allmulticast mode [ 587.972532][T31413] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6638'. [ 588.145479][T31454] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6647'. [ 588.211050][T31441] netlink: 136 bytes leftover after parsing attributes in process `syz.4.6647'. [ 588.250326][T31441] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 588.269678][T31467] netlink: 312 bytes leftover after parsing attributes in process `syz.2.6650'. [ 588.307247][T31467] netlink: 'syz.2.6650': attribute type 1 has an invalid length. [ 588.503506][T31469] lo speed is unknown, defaulting to 1000 [ 588.552586][T31479] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6656'. [ 588.834448][T31492] bond7: option xmit_hash_policy: invalid value (10) [ 588.860852][T31492] bond7 (unregistering): Released all slaves [ 588.884718][T31506] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.6663'. [ 588.992596][T31510] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.6663'. [ 589.740533][T31541] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6674'. [ 589.871842][T31551] netlink: 'syz.3.6677': attribute type 16 has an invalid length. [ 589.994994][T31558] bridge0: port 3(vlan2) entered blocking state [ 590.008035][T31558] bridge0: port 3(vlan2) entered disabled state [ 590.027690][T31558] vlan2: entered allmulticast mode [ 590.036375][T31558] bridge0: entered allmulticast mode [ 590.049952][T31558] vlan2: left allmulticast mode [ 590.059380][T31558] bridge0: left allmulticast mode [ 590.153306][T31571] netlink: 'syz.4.6684': attribute type 1 has an invalid length. [ 590.181516][T31571] netlink: 'syz.4.6684': attribute type 10 has an invalid length. [ 590.194725][T31575] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 590.205072][T31571] dummy0: entered promiscuous mode [ 590.257753][T21381] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 590.290884][T21381] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 590.314042][T21381] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 590.332624][T21381] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 590.754119][T31604] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 590.945147][T31615] sctp: [Deprecated]: syz.2.6697 (pid 31615) Use of struct sctp_assoc_value in delayed_ack socket option. [ 590.945147][T31615] Use struct sctp_sack_info instead [ 591.036299][T31617] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 591.076452][T31621] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.156687][T31621] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.261121][T31621] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.292406][T31632] syzkaller0: entered promiscuous mode [ 591.298926][T31632] syzkaller0: entered allmulticast mode [ 591.395137][T31621] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.522437][T31641] veth1_vlan: left promiscuous mode [ 591.528503][T31641] veth1_vlan: entered promiscuous mode [ 591.541465][T31641] veth1_vlan: entered allmulticast mode [ 591.592278][T21382] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.608308][T21382] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.642840][T21381] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.698447][T21381] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.718469][T31623] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.735966][T31666] netlink: 'syz.0.6711': attribute type 1 has an invalid length. [ 591.764279][T21381] ================================================================== [ 591.772467][T21381] BUG: KASAN: slab-use-after-free in __mutex_lock+0x154/0x1550 [ 591.780167][T21381] Read of size 8 at addr ffff88802addfaa8 by task kworker/u8:15/21381 [ 591.788442][T21381] [ 591.790862][T21381] CPU: 0 UID: 0 PID: 21381 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT(full) [ 591.790953][T21381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 591.790964][T21381] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 591.791062][T21381] Call Trace: [ 591.791069][T21381] [ 591.791077][T21381] dump_stack_lvl+0xe8/0x150 [ 591.791098][T21381] print_address_description+0x55/0x1e0 [ 591.791125][T21381] ? __mutex_lock+0x154/0x1550 [ 591.791145][T21381] print_report+0x58/0x70 [ 591.791160][T21381] kasan_report+0x117/0x150 [ 591.791183][T21381] ? rcu_is_watching+0x15/0xb0 [ 591.791202][T21381] ? __mutex_lock+0x154/0x1550 [ 591.791225][T21381] __mutex_lock+0x154/0x1550 [ 591.791246][T21381] ? __mutex_lock+0x5d4/0x1550 [ 591.791266][T21381] ? udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 591.791289][T21381] ? __pfx___mutex_lock+0x10/0x10 [ 591.791308][T21381] ? do_raw_spin_lock+0x12b/0x2f0 [ 591.791329][T21381] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 591.791347][T21381] ? pwq_dec_nr_in_flight+0xb93/0xf20 [ 591.791367][T21381] ? process_scheduled_works+0xa20/0x14e0 [ 591.791386][T21381] ? rcu_is_watching+0x15/0xb0 [ 591.791402][T21381] ? process_scheduled_works+0xa20/0x14e0 [ 591.791421][T21381] udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 591.791443][T21381] ? rcu_is_watching+0x15/0xb0 [ 591.791459][T21381] ? process_scheduled_works+0xa20/0x14e0 [ 591.791476][T21381] process_scheduled_works+0xa8e/0x14e0 [ 591.791505][T21381] ? __pfx_process_scheduled_works+0x10/0x10 [ 591.791523][T21381] ? do_raw_spin_lock+0x12b/0x2f0 [ 591.791543][T21381] ? assign_work+0x3cf/0x5d0 [ 591.791562][T21381] worker_thread+0xa47/0xfb0 [ 591.791593][T21381] kthread+0x388/0x470 [ 591.791609][T21381] ? __pfx_worker_thread+0x10/0x10 [ 591.791627][T21381] ? __pfx_kthread+0x10/0x10 [ 591.791642][T21381] ret_from_fork+0x514/0xb70 [ 591.791673][T21381] ? __pfx_ret_from_fork+0x10/0x10 [ 591.791689][T21381] ? __switch_to+0xc89/0x1420 [ 591.791712][T21381] ? __pfx_kthread+0x10/0x10 [ 591.791727][T21381] ret_from_fork_asm+0x1a/0x30 [ 591.791750][T21381] [ 591.791757][T21381] [ 591.994849][T21381] Allocated by task 31621: [ 591.999358][T21381] kasan_save_track+0x3e/0x80 [ 592.004083][T21381] __kasan_kmalloc+0x93/0xb0 [ 592.008698][T21381] __kmalloc_noprof+0x358/0x750 [ 592.013626][T21381] udp_tunnel_nic_netdevice_event+0x4e9/0x1850 [ 592.020210][T21381] notifier_call_chain+0x1a5/0x3d0 [ 592.025320][T21381] register_netdevice+0x18a4/0x1eb0 [ 592.030629][T21381] nsim_create+0xbd7/0x1140 [ 592.035222][T21381] __nsim_dev_port_add+0x7f8/0xcd0 [ 592.040352][T21381] nsim_dev_port_add_all+0x37/0xf0 [ 592.045456][T21381] nsim_dev_reload_up+0x4dd/0x880 [ 592.050474][T21381] devlink_reload+0x4b2/0x890 [ 592.055272][T21381] devlink_nl_reload_doit+0xa9c/0xc80 [ 592.060634][T21381] genl_family_rcv_msg_doit+0x233/0x340 [ 592.066168][T21381] genl_rcv_msg+0x614/0x7a0 [ 592.070663][T21381] netlink_rcv_skb+0x226/0x4a0 [ 592.075434][T21381] genl_rcv+0x28/0x40 [ 592.079402][T21381] netlink_unicast+0x7bb/0x940 [ 592.084154][T21381] netlink_sendmsg+0x813/0xb40 [ 592.088908][T21381] ____sys_sendmsg+0x9b9/0xa20 [ 592.093665][T21381] ___sys_sendmsg+0x2a5/0x360 [ 592.098449][T21381] __x64_sys_sendmsg+0x1b1/0x290 [ 592.103416][T21381] do_syscall_64+0x174/0x580 [ 592.108018][T21381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.113898][T21381] [ 592.116214][T21381] Freed by task 31623: [ 592.120359][T21381] kasan_save_track+0x3e/0x80 [ 592.125036][T21381] kasan_save_free_info+0x40/0x50 [ 592.130051][T21381] __kasan_slab_free+0x5c/0x80 [ 592.134811][T21381] kfree+0x1c5/0x640 [ 592.138704][T21381] udp_tunnel_nic_netdevice_event+0x1236/0x1850 [ 592.144935][T21381] notifier_call_chain+0x1a5/0x3d0 [ 592.150040][T21381] unregister_netdevice_many_notify+0x17de/0x2150 [ 592.156438][T21381] unregister_netdevice_queue+0x2f5/0x340 [ 592.162145][T21381] nsim_destroy+0x26d/0x800 [ 592.166636][T21381] __nsim_dev_port_del+0x14e/0x200 [ 592.171739][T21381] nsim_dev_reload_destroy+0x288/0x490 [ 592.177191][T21381] nsim_dev_reload_down+0x8a/0xc0 [ 592.182206][T21381] devlink_reload+0x1c5/0x890 [ 592.186872][T21381] devlink_nl_reload_doit+0xa9c/0xc80 [ 592.192232][T21381] genl_family_rcv_msg_doit+0x233/0x340 [ 592.197765][T21381] genl_rcv_msg+0x614/0x7a0 [ 592.202269][T21381] netlink_rcv_skb+0x226/0x4a0 [ 592.207023][T21381] genl_rcv+0x28/0x40 [ 592.210993][T21381] netlink_unicast+0x7bb/0x940 [ 592.215749][T21381] netlink_sendmsg+0x813/0xb40 [ 592.220508][T21381] ____sys_sendmsg+0x9b9/0xa20 [ 592.225267][T21381] ___sys_sendmsg+0x2a5/0x360 [ 592.229935][T21381] __x64_sys_sendmsg+0x1b1/0x290 [ 592.234862][T21381] do_syscall_64+0x174/0x580 [ 592.239451][T21381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.245336][T21381] [ 592.247649][T21381] Last potentially related work creation: [ 592.253380][T21381] kasan_save_stack+0x3e/0x60 [ 592.258049][T21381] kasan_record_aux_stack+0xbd/0xd0 [ 592.263234][T21381] insert_work+0x3d/0x330 [ 592.267552][T21381] __queue_work+0xb7c/0xff0 [ 592.272048][T21381] queue_work_on+0x106/0x1d0 [ 592.276634][T21381] __udp_tunnel_nic_add_port+0xba9/0xd90 [ 592.282256][T21381] udp_tunnel_push_rx_port+0x169/0x1f0 [ 592.287702][T21381] geneve_offload_rx_ports+0xc7/0x150 [ 592.293157][T21381] geneve_netdevice_event+0x6a/0x80 [ 592.298355][T21381] notifier_call_chain+0x1a5/0x3d0 [ 592.303464][T21381] call_netdevice_notifiers+0x90/0xd0 [ 592.308878][T21381] udp_tunnel_nic_netdevice_event+0xe33/0x1850 [ 592.315023][T21381] notifier_call_chain+0x1a5/0x3d0 [ 592.320122][T21381] register_netdevice+0x18a4/0x1eb0 [ 592.325306][T21381] nsim_create+0xbd7/0x1140 [ 592.329797][T21381] __nsim_dev_port_add+0x7f8/0xcd0 [ 592.334900][T21381] nsim_dev_port_add_all+0x37/0xf0 [ 592.340001][T21381] nsim_dev_reload_up+0x4dd/0x880 [ 592.345022][T21381] devlink_reload+0x4b2/0x890 [ 592.349685][T21381] devlink_nl_reload_doit+0xa9c/0xc80 [ 592.355047][T21381] genl_family_rcv_msg_doit+0x233/0x340 [ 592.360590][T21381] genl_rcv_msg+0x614/0x7a0 [ 592.365078][T21381] netlink_rcv_skb+0x226/0x4a0 [ 592.369833][T21381] genl_rcv+0x28/0x40 [ 592.373819][T21381] netlink_unicast+0x7bb/0x940 [ 592.378570][T21381] netlink_sendmsg+0x813/0xb40 [ 592.383327][T21381] ____sys_sendmsg+0x9b9/0xa20 [ 592.388079][T21381] ___sys_sendmsg+0x2a5/0x360 [ 592.392745][T21381] __x64_sys_sendmsg+0x1b1/0x290 [ 592.397672][T21381] do_syscall_64+0x174/0x580 [ 592.402250][T21381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.408128][T21381] [ 592.410440][T21381] Second to last potentially related work creation: [ 592.417089][T21381] kasan_save_stack+0x3e/0x60 [ 592.421764][T21381] kasan_record_aux_stack+0xbd/0xd0 [ 592.426948][T21381] insert_work+0x3d/0x330 [ 592.431264][T21381] __queue_work+0xcb6/0xff0 [ 592.435753][T21381] queue_work_on+0x106/0x1d0 [ 592.440330][T21381] __udp_tunnel_nic_add_port+0xba9/0xd90 [ 592.445954][T21381] udp_tunnel_push_rx_port+0x169/0x1f0 [ 592.451409][T21381] geneve_offload_rx_ports+0xc7/0x150 [ 592.456769][T21381] geneve_netdevice_event+0x6a/0x80 [ 592.461948][T21381] notifier_call_chain+0x1a5/0x3d0 [ 592.467056][T21381] call_netdevice_notifiers+0x90/0xd0 [ 592.472427][T21381] udp_tunnel_nic_netdevice_event+0xe33/0x1850 [ 592.478573][T21381] notifier_call_chain+0x1a5/0x3d0 [ 592.483674][T21381] register_netdevice+0x18a4/0x1eb0 [ 592.488862][T21381] nsim_create+0xbd7/0x1140 [ 592.493351][T21381] __nsim_dev_port_add+0x7f8/0xcd0 [ 592.498453][T21381] nsim_dev_port_add_all+0x37/0xf0 [ 592.503556][T21381] nsim_dev_reload_up+0x4dd/0x880 [ 592.508570][T21381] devlink_reload+0x4b2/0x890 [ 592.513231][T21381] devlink_nl_reload_doit+0xa9c/0xc80 [ 592.518595][T21381] genl_family_rcv_msg_doit+0x233/0x340 [ 592.524130][T21381] genl_rcv_msg+0x614/0x7a0 [ 592.528618][T21381] netlink_rcv_skb+0x226/0x4a0 [ 592.533387][T21381] genl_rcv+0x28/0x40 [ 592.537356][T21381] netlink_unicast+0x7bb/0x940 [ 592.542106][T21381] netlink_sendmsg+0x813/0xb40 [ 592.546863][T21381] ____sys_sendmsg+0x9b9/0xa20 [ 592.551620][T21381] ___sys_sendmsg+0x2a5/0x360 [ 592.556285][T21381] __x64_sys_sendmsg+0x1b1/0x290 [ 592.561217][T21381] do_syscall_64+0x174/0x580 [ 592.565794][T21381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.571673][T21381] [ 592.573982][T21381] The buggy address belongs to the object at ffff88802addfa00 [ 592.573982][T21381] which belongs to the cache kmalloc-256 of size 256 [ 592.588137][T21381] The buggy address is located 168 bytes inside of [ 592.588137][T21381] freed 256-byte region [ffff88802addfa00, ffff88802addfb00) [ 592.601920][T21381] [ 592.604230][T21381] The buggy address belongs to the physical page: [ 592.610696][T21381] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2adde [ 592.619450][T21381] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 592.627934][T21381] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 592.635477][T21381] page_type: f5(slab) [ 592.639446][T21381] raw: 00fff00000000040 ffff88813fe1bb40 dead000000000100 dead000000000122 [ 592.648023][T21381] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 592.656595][T21381] head: 00fff00000000040 ffff88813fe1bb40 dead000000000100 dead000000000122 [ 592.665252][T21381] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 592.673907][T21381] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 592.682566][T21381] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 592.691217][T21381] page dumped because: kasan: bad access detected [ 592.697624][T21381] page_owner tracks the page as allocated [ 592.703320][T21381] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5632, tgid 5632 (syz-executor), ts 62808764337, free_ts 62754647233 [ 592.724668][T21381] post_alloc_hook+0x22d/0x280 [ 592.729429][T21381] get_page_from_freelist+0x24ae/0x2530 [ 592.734966][T21381] __alloc_frozen_pages_noprof+0x18d/0x380 [ 592.740761][T21381] allocate_slab+0x74/0x5d0 [ 592.745249][T21381] refill_objects+0x328/0x3c0 [ 592.749912][T21381] __pcs_replace_empty_main+0x2e0/0x6b0 [ 592.755447][T21381] __kmalloc_cache_noprof+0x388/0x660 [ 592.760810][T21381] ____ip_mc_inc_group+0x518/0xdb0 [ 592.765995][T21381] ip_mc_up+0x115/0x2e0 [ 592.770174][T21381] inetdev_event+0xfca/0x15e0 [ 592.774841][T21381] notifier_call_chain+0x1a5/0x3d0 [ 592.779944][T21381] __dev_notify_flags+0x1aa/0x310 [ 592.785019][T21381] netif_change_flags+0xde/0x1b0 [ 592.789948][T21381] do_setlink+0xdd6/0x4670 [ 592.794399][T21381] rtnl_newlink+0x15c2/0x1bd0 [ 592.799066][T21381] rtnetlink_rcv_msg+0x802/0xc00 [ 592.803990][T21381] page last free pid 5776 tgid 5776 stack trace: [ 592.810298][T21381] __free_frozen_pages+0xc0d/0xd20 [ 592.815402][T21381] __slab_free+0x274/0x2c0 [ 592.819807][T21381] qlist_free_all+0x99/0x100 [ 592.824386][T21381] kasan_quarantine_reduce+0x148/0x160 [ 592.829837][T21381] __kasan_slab_alloc+0x22/0x80 [ 592.834678][T21381] kmem_cache_alloc_noprof+0x2b8/0x650 [ 592.840125][T21381] do_getname+0x2e/0x250 [ 592.844353][T21381] do_sys_openat2+0xcc/0x200 [ 592.848932][T21381] __x64_sys_openat+0x138/0x170 [ 592.853767][T21381] do_syscall_64+0x174/0x580 [ 592.858356][T21381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.864241][T21381] [ 592.866548][T21381] Memory state around the buggy address: [ 592.872328][T21381] ffff88802addf980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 592.880386][T21381] ffff88802addfa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 592.888489][T21381] >ffff88802addfa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 592.896530][T21381] ^ [ 592.901882][T21381] ffff88802addfb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 592.909927][T21381] ffff88802addfb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 592.917970][T21381] ================================================================== [ 592.934451][T31666] x_tables: duplicate entry at hook 1 [ 593.064943][T21381] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 593.072205][T21381] CPU: 0 UID: 0 PID: 21381 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT(full) [ 593.081850][T21381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 593.091919][T21381] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 593.099238][T21381] Call Trace: [ 593.102533][T21381] [ 593.105472][T21381] vpanic+0x56c/0xa60 [ 593.109474][T21381] ? __pfx_vpanic+0x10/0x10 [ 593.113996][T21381] ? rcu_is_watching+0x15/0xb0 [ 593.118774][T21381] panic+0xc5/0xd0 [ 593.122511][T21381] ? __pfx_panic+0x10/0x10 [ 593.126930][T21381] ? preempt_schedule_thunk+0x16/0x40 [ 593.132314][T21381] ? __mutex_lock+0x154/0x1550 [ 593.137082][T21381] ? preempt_schedule_thunk+0x16/0x40 [ 593.142463][T21381] ? __mutex_lock+0x154/0x1550 [ 593.147228][T21381] check_panic_on_warn+0x89/0xb0 [ 593.152190][T21381] ? __mutex_lock+0x154/0x1550 [ 593.156948][T21381] end_report+0x73/0x170 [ 593.161191][T21381] ? __mutex_lock+0x154/0x1550 [ 593.165949][T21381] kasan_report+0x128/0x150 [ 593.170450][T21381] ? rcu_is_watching+0x15/0xb0 [ 593.175212][T21381] ? __mutex_lock+0x154/0x1550 [ 593.179974][T21381] __mutex_lock+0x154/0x1550 [ 593.184558][T21381] ? __mutex_lock+0x5d4/0x1550 [ 593.189315][T21381] ? udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 593.195552][T21381] ? __pfx___mutex_lock+0x10/0x10 [ 593.200813][T21381] ? do_raw_spin_lock+0x12b/0x2f0 [ 593.205830][T21381] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 593.211190][T21381] ? pwq_dec_nr_in_flight+0xb93/0xf20 [ 593.216552][T21381] ? process_scheduled_works+0xa20/0x14e0 [ 593.222263][T21381] ? rcu_is_watching+0x15/0xb0 [ 593.227020][T21381] ? process_scheduled_works+0xa20/0x14e0 [ 593.232730][T21381] udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 593.238796][T21381] ? rcu_is_watching+0x15/0xb0 [ 593.243549][T21381] ? process_scheduled_works+0xa20/0x14e0 [ 593.249260][T21381] process_scheduled_works+0xa8e/0x14e0 [ 593.254813][T21381] ? __pfx_process_scheduled_works+0x10/0x10 [ 593.260789][T21381] ? do_raw_spin_lock+0x12b/0x2f0 [ 593.265818][T21381] ? assign_work+0x3cf/0x5d0 [ 593.270405][T21381] worker_thread+0xa47/0xfb0 [ 593.274999][T21381] kthread+0x388/0x470 [ 593.279056][T21381] ? __pfx_worker_thread+0x10/0x10 [ 593.284152][T21381] ? __pfx_kthread+0x10/0x10 [ 593.288733][T21381] ret_from_fork+0x514/0xb70 [ 593.293312][T21381] ? __pfx_ret_from_fork+0x10/0x10 [ 593.298409][T21381] ? __switch_to+0xc89/0x1420 [ 593.303343][T21381] ? __pfx_kthread+0x10/0x10 [ 593.307918][T21381] ret_from_fork_asm+0x1a/0x30 [ 593.312680][T21381] [ 593.315983][T21381] Kernel Offset: disabled [ 593.320296][T21381] Rebooting in 86400 seconds..