last executing test programs: 3.223070752s ago: executing program 0 (id=4879): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000540)={0xc9, 0x9, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r2) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280", @ANYRES16=r2, @ANYRES16=r1], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0xc4010) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r0, 0x28, 0x6, &(0x7f0000000580)={0x77359400}, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)=0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r6, 0x4048587b, &(0x7f0000000480)={{r6, &(0x7f0000000000)='-]$\\}\x00', 0x224000, &(0x7f0000000040)={@_ha_fsid={[0x4, 0x1]}, {0x6, 0x6, 0x5, 0x8}}, 0x80000000, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x4}, 0x1, &(0x7f0000000440)=[{0x0, 0xc, &(0x7f0000000300)='\x00', &(0x7f0000000340)="1c70eb32aa0440b36e59eb298bd37888675849e044a13cedc19800b7dc177277796008a56deae26985719aaecbf27e71aea9002e96b77b94ce0e9159d73be29625e29b49034e112bcd091084af0653a142360f0ba23cebeab01b6c22453be4ced2420b322a1160fef3f5e392d8392f7c4177783cb1c6416dc8a9eb9d30b3d29fc10460dca2a23d8e2c44782a795f812593372bff20b0ef44e7a01e713649dae134614851da0f056a9abaf11bc0a70cbbe97d11420e985a61a38ec943634628a42b07072a60bcccc26a898ce9984f91e56480e427f71155f8217699fb42d030ec2df1514cd00b3e14407b54fac198bee750e8", 0xf2, 0x20}]}) setsockopt$inet_sctp_SCTP_EVENTS(r9, 0x84, 0xb, &(0x7f0000000500)={0x2, 0xb, 0x1, 0xe, 0xeb, 0xf, 0xd, 0x8, 0x0, 0x6, 0x2, 0xc6, 0x4, 0x85}, 0xe) socket$nl_xfrm(0x10, 0x3, 0x6) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r10, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}]}, 0x1c}}, 0x0) read$nci(r6, &(0x7f0000000200)=""/100, 0x64) write$nci(r6, 0x0, 0x0) read$nci(r6, 0x0, 0x0) write$nci(r6, &(0x7f0000000c40)=@NCI_OP_CORE_CONN_CREDITS_NTF={0x0, 0x1, 0x3, 0x6, 0x8, {0x9, [{0x0, 0x1}, {0x0, 0x81}, {0x0, 0x3}, {0x2, 0x3}, {0x3, 0x5}, {0x2, 0xbf}, {0x0, 0xff}, {0x2, 0x3}, {0x1}]}}, 0x16) 3.019618591s ago: executing program 3 (id=4882): syz_genetlink_get_family_id$nl80211(&(0x7f0000001000), 0xffffffffffffffff) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007"], 0x24}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000300)=[{0x0}], 0x1, 0x0) vmsplice(r2, &(0x7f0000000040)=[{0x0}], 0x1, 0x2) ioctl$PPPIOCSPASS(r2, 0x40107447, &(0x7f0000000540)={0x9, &(0x7f00000004c0)=[{0x931, 0x2, 0x8, 0x6}, {0x9, 0x5, 0xfd, 0x3}, {0x2, 0xf5, 0x1, 0x8}, {0xffff, 0x7, 0x4, 0x1}, {0x5, 0x1, 0x18, 0x1ff}, {0xb, 0x19, 0x1, 0x3}, {0x0, 0xa, 0xff, 0x9f}, {0x1, 0x5, 0x7, 0x1000}, {0xb6d, 0xd, 0x0, 0xc7}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff0000000400002f", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x34, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xffe0}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x4040004) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r9) getsockname$packet(r9, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@delchain={0x30, 0x2c, 0xf31, 0x70bd2c, 0x2000, {0x0, 0x0, 0x0, r10, {0x8}, {0xfff2, 0xffff}, {0xffff, 0xffe0}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010003704030000000300000000000000", @ANYRES32=r11, @ANYBLOB="0b1b0500000000001c0012800b00010062726964676500000c000280050007004000"], 0x3c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) recvfrom$unix(r1, &(0x7f0000000000)=""/1, 0x1, 0x2000, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) 2.881982076s ago: executing program 1 (id=4883): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0xf, &(0x7f0000000280)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) mmap(&(0x7f0000a5d000/0x4000)=nil, 0x4000, 0xd, 0x13, r0, 0xb0267000) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r1, 0xc6e9f000) mmap(&(0x7f0000131000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0xffffe000) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000940)={0x0, 0xfffffff0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000000000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff00000000000000003300000002000000e00000020000000000000000000000000000000000000000000000000000000000000000ff010000000000000000000000000001000000003c0000000a000000fe8000000000000000000000000000aa0000000001000000000000000000000000000000ff010000000000000000000000000001000000002b0000000a000000fe8800000000000000000000000000010000000000000000000000000000000000000000ff020000000000000000000000000001000000003200000002000000fe8000000000000000000000000000000000000004"], 0x254}}, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x18, 0x1411, 0x8, 0x70bd2c, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4004001}, 0x6400c000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x600000c, 0x6e073, 0xffffffffffffffff, 0x0) 2.600125377s ago: executing program 1 (id=4886): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0)=',8Z', 0x3) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f000000c300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x54, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x28, 0x3, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x49}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xd}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x40008d1}, 0x40) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r3, 0x1, 0x28, &(0x7f0000000000)=0x1, 0x4) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) close(r2) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710431000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newsa={0x140, 0x10, 0x413, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00', 0xfffd, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x20, 0x0, 0x0, 0xee00}, {@in=@rand_addr=0x64010100, 0x20, 0x32}, @in6=@private1, {0x0, 0x7, 0x800000000000, 0x4, 0xb5f7, 0x4, 0x20000000008}, {0x100000001, 0x8, 0xcc, 0x8}, {0xf8, 0x0, 0x3}, 0x0, 0x4, 0x2, 0x0, 0x1}, [@algo_aead={0x4f, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0x18, 0x40, "06ec87"}}]}, 0x140}}, 0x844) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x27bf, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xa}}, 0x3}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x40010, &(0x7f00000002c0)={0xa, 0x4e21, 0x2, @local, 0x8}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r7, &(0x7f0000000340)='\b\x00\x00\x00', 0x4) shutdown(r6, 0x0) 2.520809506s ago: executing program 2 (id=4887): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@enum64={0x4, 0x0, 0x0, 0x13, 0x1, 0x2}]}, {0x0, [0x0, 0x0, 0x30, 0x2e, 0x1e]}}, 0x0, 0x2b, 0x0, 0x1, 0x3}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0xe4) r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000010010000010000000008000000000000"], 0x18}, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r2 = socket$igmp6(0xa, 0x3, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001000000327bd7000fbdbdf2500000000", @ANYBLOB="320a0500230800001000128008000100767469000400029a080004"], 0x38}, 0x1, 0x0, 0x0, 0x4000080}, 0x4010) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01400010000600000000067400062c00070073797352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000e6ff05000700263a3a0914000600626f6e64300000000000000001000000080003"], 0x78}, 0x1, 0xffffffff00000003}, 0x4) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000140)=[{&(0x7f0000000100)='7', 0x1}], 0x1, 0x0) vmsplice(r5, &(0x7f0000001500)=[{&(0x7f0000000180)="db", 0x1}], 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002a80)={0x28, 0x2c, 0x107, 0x0, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0x6}]}, @nested={0xc, 0x2, 0x0, 0x1, [@nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x8e}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0xc010) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}}, 0x14}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) syz_emit_ethernet(0x42, &(0x7f0000000980)=ANY=[@ANYRES16=r5, @ANYRES16=r0, @ANYRESDEC=r1, @ANYRESDEC=r0, @ANYRES8=r2], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.181448747s ago: executing program 0 (id=4888): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140020000000050005000a000000050001000600000011000300686173683a6970"], 0x60}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r1, &(0x7f0000000000)="800037bbfa9ba1ce", 0x8, 0x2000c804, &(0x7f0000001100)={0xa, 0x4e22, 0x4, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x10102, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f00000000c0)=ANY=[@ANYBLOB="05006637f52cc88021b532000000000085100000020004008500000005000000950033000000000095eba40500000000548f7459ec069e56e7ca46b88f7537952447257431fbc502bb0a20eab3fc974bb5682fc679535543fb54cd369e0d7f13cebb3ce7499f"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) 2.129166012s ago: executing program 3 (id=4889): unshare(0x8040480) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) ppoll(&(0x7f0000000240)=[{r0, 0x201}], 0x1, 0x0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, '\x00', 0xd}, 0x1}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000080)='c', 0x1}], 0x1, &(0x7f0000000a80)=ANY=[@ANYBLOB="480000000000000029000000370000002b0500000000000007280000000308480400030000000000000008000000000000000104000000000000080000000000000004010300000014000000000000002900000043000000080000000000000050"], 0xb0}}], 0x1, 0x4000801) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e21, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}]}, &(0x7f00000001c0)=0x10) shutdown(r0, 0x1) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) connect$inet(r1, &(0x7f0000000140)={0x2, 0x8, @rand_addr=0x64010101}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x22d00, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x8000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000100000000000000ffffffff8500000011000000950000000000000059ddb270be6127ec00bc5ec9164fccb9a7c3d017cd384335d6d02b68052d2c665d8b7b73de53a5ddf5f838b85ab5e108f4a1c233cc6a602d020a8e150887296a6396964b219c8e2bdb48bd66740a82a860d2b985f1b473b223acfb22c4aad362ea52f9cc328732bd56a0377a4140fdbdbce93e16642bef4ca3588af095"], &(0x7f0000000000)='syzkaller\x00', 0x2}, 0x94) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) unshare(0x8040480) (async) socket$inet6_sctp(0xa, 0x801, 0x84) (async) ppoll(&(0x7f0000000240)=[{r0, 0x201}], 0x1, 0x0, 0x0, 0x0) (async) sendmmsg$inet6(r0, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, '\x00', 0xd}, 0x1}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000080)='c', 0x1}], 0x1, &(0x7f0000000a80)=ANY=[@ANYBLOB="480000000000000029000000370000002b0500000000000007280000000308480400030000000000000008000000000000000104000000000000080000000000000004010300000014000000000000002900000043000000080000000000000050"], 0xb0}}], 0x1, 0x4000801) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e21, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}]}, &(0x7f00000001c0)=0x10) (async) shutdown(r0, 0x1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) connect$inet(r1, &(0x7f0000000140)={0x2, 0x8, @rand_addr=0x64010101}, 0x10) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x22d00, 0x0) (async) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x8000, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000100000000000000ffffffff8500000011000000950000000000000059ddb270be6127ec00bc5ec9164fccb9a7c3d017cd384335d6d02b68052d2c665d8b7b73de53a5ddf5f838b85ab5e108f4a1c233cc6a602d020a8e150887296a6396964b219c8e2bdb48bd66740a82a860d2b985f1b473b223acfb22c4aad362ea52f9cc328732bd56a0377a4140fdbdbce93e16642bef4ca3588af095"], &(0x7f0000000000)='syzkaller\x00', 0x2}, 0x94) (async) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) (async) 2.072929477s ago: executing program 2 (id=4890): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sendfile(r1, r0, &(0x7f00000001c0)=0x912fd2900000, 0x9) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000180)) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000041c0)={0x0, 0x0, &(0x7f0000004180)={&(0x7f0000004200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSETELEM={0x24, 0xc, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x4004c00}, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x0, 0x6}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000000c0)={r4, 0x9184}, &(0x7f0000000100)=0xc) sendmsg$kcm(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)="2e00000025008101040000000000009f1ba1f848430000005e1406ca000000ffffffff25ed5860000a898988a800", 0x2e}], 0x1}, 0x0) 2.071733443s ago: executing program 4 (id=4891): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) (async) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x4) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x2000004) (async) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000140)="00214717a70700000000030600710a5e31163ceb9d0471200000000500000000000000ffff03425d4d50e7182ce0ab6d0000", 0x32}], 0x1, 0x5, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000001c0)={0x2, &(0x7f00000002c0)=[{0x30, 0x1, 0x0, 0xfffff020}, {0x6, 0x2, 0x0, 0x5}]}, 0x10) 1.95588889s ago: executing program 4 (id=4892): socket$netlink(0x10, 0x3, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) sendto(r1, &(0x7f0000000740)="605511a04273e925437138111c", 0xd, 0x8001, &(0x7f0000000780)=@hci={0x1d, 0x2, 0x1}, 0x80) (async) sendto(r1, &(0x7f0000000740)="605511a04273e925437138111c", 0xd, 0x8001, &(0x7f0000000780)=@hci={0x1d, 0x2, 0x1}, 0x80) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="020a03051f00000027bd7000fedbdf25010014000e00000003000700ff80000002"], 0xf8}}, 0x20048080) r3 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xff05, 0x8000000, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0xbc2a4219f6b34c13}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x20000840) 1.95281565s ago: executing program 2 (id=4893): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x5411, &(0x7f00000007c0)) close(0xffffffffffffffff) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000100000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="5c00000015006b0300224ed86e6c1d0002117ea6e070d6064e22000300000000250002000f00000017d34460bc24eab556a705251e6182949a00003d3b48dfd8cdbf9767b4fa51f62a64c9f4060046d88037e786a6d0a5d700000017", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000200025a729bd7000fddb0a0000cdfe0000010200010008000600fe7f0000140006002001004a010000000000000000000002"], 0x38}, 0x1, 0x0, 0x0, 0x20008005}, 0x44) syz_emit_ethernet(0xfffffffffffffe46, &(0x7f0000000100)={@broadcast, @remote, @void, {@llc_tr={0x11, {@llc={0xf4, 0x0, 'm', "576a0c0dc480cbe33e85c9186294e2d5c18c43a6617b7b23822e0404477cc50a52ea46b7f6d36e35c0803de2d109191e98db2ca4c1511f7696"}}}}}, &(0x7f0000000180)={0x0, 0x1, [0x754, 0x859, 0xcd7, 0xf83]}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000300006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000f020000d706000020000000620a04ff0ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2736f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfdb247bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded5275c00"/420], &(0x7f0000000100)='GPL\x00'}, 0x48) r4 = socket$nl_audit(0x10, 0x3, 0x9) r5 = socket(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000380)={0x1d, r6, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r5) setsockopt$netlink_NETLINK_CAP_ACK(r4, 0x10e, 0xa, &(0x7f0000000000)=0x1, 0x4) 1.880308407s ago: executing program 2 (id=4894): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0xa300}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCI={0xc, 0x1, 0x8}, @IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0x8}, @IFLA_MACSEC_PROTECT={0x5, 0x8, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x58}, 0x1, 0x0, 0x0, 0x24008000}, 0x800) (async, rerun: 32) sendmsg$netlink(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000d80)=ANY=[@ANYBLOB="200100001200017fffffff0000000000100000000c0000000000000000000000fe0031"], 0x120}], 0x1, 0x0, 0x0, 0x4008004}, 0x4800) (rerun: 32) sendmmsg(r0, &(0x7f0000002140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001ec0)=[{0x10, 0x1, 0x2}], 0x10}}], 0x1, 0x8041) 1.711548039s ago: executing program 3 (id=4895): write$tun(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="70000000ffffffffff"], 0x3e) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x840) unshare(0x2c020400) write$nci(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="c00404cb41646863a483034d46f90ecc5c7db50f49ee4c19b745859d1f5415675a781e20080a0cb8f5908fb854bf58b3f8085bc1e0689ccf8dfdfd871ebf25b1698d027f693e6a1597e346fba6e1cf5cb249f33fcc625f1d1fb8332637e83a035223472c0e04f4004a05f388775e8563e4b19f63213cf9f38c1fef0082f0baec2a752baf724f010185a919b258da2f5cfade2963121d72d3df9ef92bc583328b807afba9692943f5412b33396a4e3c2d10e9c5b928de7366daa70e30f9c623ff6e22acaefb67a7e20212f5404039c43db40c2db0542647e25b95fa8c659334ad6119685930e11bf0db62b6c068eb000000"], 0x7) write$nci(r0, &(0x7f0000000140)=@NCI_OP_CORE_CONN_CLOSE_RSP={0x0, 0x0, 0x2, 0x5, 0x1}, 0x4) 1.680338817s ago: executing program 1 (id=4896): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000d80)={0x6, 0x14, &(0x7f0000000a80)=@raw=[@map_idx_val={0x18, 0xa, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x180000}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x10}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @map_val={0x18, 0x6, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8}, @map_fd={0x18, 0x6}, @exit], &(0x7f0000000b40)='GPL\x00', 0x1ff, 0xaa, &(0x7f0000000b80)=""/170, 0x0, 0x25, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000c40)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000c80)={0x0, 0xd, 0xf410000}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000cc0)=[0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000d00)=[{0x2, 0x1, 0x8, 0x4}, {0x3, 0x2, 0x1, 0xb}, {0x1, 0x2, 0x0, 0x6}, {0x2, 0x1, 0xb, 0xa}, {0x2, 0x2, 0x10, 0x70ccb3e1419113aa}, {0x2, 0x4, 0xd, 0x8}], 0x10, 0x8000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000003c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225c380fac12f8205d182f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05bea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d96ee1b84bb64b14aebc6b5194c55dd6890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b07838a3ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0ed9829dec16ab67a4f59a504e09f55ab82bbd405087a17a229a149c53ee9145500db213cb36489a10957739e481a756e65bde579bbbfb404213f661eeaaffacbcfbfd60b1a715c366da2b37ac7e9e3033f8ec04db1c2412e02ccd0617d9fb646c4897750d068c936c3558a94b05d7c65c0d458c0d70d0aa864bc1e324d3f69b1b4061627da875a4b5c2668ab0990623fe6f3b54cd1c79da4baf256f88750c18486330589473e267fa44e220cf40db662b570c2a2fbba9a34a3dd7bbd8368fe506daa62b45797d4b397905a69e58eb436c08cc78963197adb1b16ad83a1a9b4"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@cgroup=r1, r1, 0x2e}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000f40)={@cgroup, 0x36, 0x1, 0x7, &(0x7f0000000e40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000000e80)=[0x0, 0x0], &(0x7f0000000ec0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000f00)=[0x0, 0x0, 0x0], 0x0}, 0x40) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.self_freezing\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0xc0189436, &(0x7f0000000140)) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000011c0)=@bpf_lsm={0x1d, 0xb, &(0x7f0000000fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb84, 0x0, 0x0, 0x0, 0x9}, [@alu={0x7, 0x0, 0x3, 0x6, 0x0, 0xffffffffffffffdf, 0x10}, @jmp={0x5, 0x1, 0x3, 0x7, 0xb, 0xffffffffffffffe0, 0x4}, @initr0={0x18, 0x0, 0x0, 0x0, 0x55c4362f, 0x0, 0x0, 0x0, 0xce3e}, @map_idx={0x18, 0x5, 0x5, 0x0, 0x8}, @cb_func={0x18, 0x3, 0x4, 0x0, 0x7}]}, &(0x7f0000001040)='syzkaller\x00', 0x318, 0xee, &(0x7f0000001080)=""/238, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)=[0x1, 0x1, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000f80)={@cgroup=r3, r0, 0x10, 0xc, r1, @void, @value=r4, @void, @void, r2}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x2, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6], 0x90}}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001580)={@map=r3, r0, 0x20, 0x2, 0x0, @void, @value=r4, @void, @void, r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x9ffc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f0000000640)={'filter\x00', 0x7, 0x4, 0x3e0, 0x1e8, 0x1e8, 0x0, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@arp={@multicast1, @local, 0xff000000, 0xff000000, 0x1, 0xa, {@empty, {[0x0, 0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x200, 0x1, 0x13f, 0x3, 0x6, 0x80, 'ipvlan0\x00', 'tunl0\x00', {0xff}, {0xff}, 0x0, 0x1}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "c4a0388f06bfa5ba784e5a0f38fc08acff70f36e8dffe8df4858f9879efe"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x9, 0x7}}}, {{@arp={@rand_addr=0x64010100, @local, 0xff, 0xff, 0x9, 0xf, {@mac=@local, {[0x0, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x73e, 0x0, 0x9, 0xdc, 0x8, 0x7, 'ip6_vti0\x00', 'pim6reg\x00', {}, {}, 0x0, 0x3b6}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr=0x64010100, @remote, 0x8, 0xffffffff}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) r9 = socket$netlink(0x10, 0x3, 0x15) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r9, 0x10e, 0x1, 0x0, 0x0) getsockopt$netlink(r9, 0x10e, 0x9, &(0x7f0000001840)=""/42, &(0x7f0000000100)=0x2a) syz_genetlink_get_family_id$devlink(&(0x7f0000001540), r9) syz_emit_ethernet(0x82, &(0x7f0000000a40)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd60ee527a004c3c0020010000000000000000000000000001ff0200000000000000000000000000017300000000001600"], 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r8, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000001c0)=r8}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r8}, 0x4) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB="18070000000000000000000000800000851000000300000018110000", @ANYRES32=r10, @ANYBLOB="00000000000000009500007b00000000850000002300000095"], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r11, 0x0, 0x7a, 0xc0, &(0x7f0000000100)="c34d5d4fa459f0e0908daec0687c8e02e62117aabf07d6bf82998dc89344230962321465c12ecf9883aafce492a5ccacfa7d1522c5329f9542b28d9696b83278b59e38e96c3a9c0bfd500fe3a9ef93afcd4bbb61acacb9dd4e04950591b7566f610a18cfc5f09164f4e1fff6f01dd25e97bce96bcee4e668b3ff", &(0x7f00000002c0)=""/192, 0x8, 0x0, 0xe3, 0xdd, &(0x7f0000000380)="18a099257f4bf4730a231d746671158b8def120f76f3ce6855f4cc8564e6b3729104a4645f9584531bb481e4d98701254b07b7d4d549aeae50c402b30c4d9cee2d9c59ee7b17f5a9e6ea9d1e298f258620b5d2b2e32bc48270d84305134d81b629a2ab6eec1f37e4b99c881508fd047a7c09c6726b197c061a716b95b0e50419c03817b5ecf9b7daebe373e2d59b598302aec5fc713098c971487f0b2dac392c707524ddac0ed2bf2e3dc441c4cb785aead681e34c8bb3816546cd4061d8a14dcda6fc46adc906aca401eec1ba74f00d8171baa3706eed1e15914d7230c5fee3e3e7eb", &(0x7f0000000480)="62fee145319bd0ad1ddd43d4fc7f7faa04bd62c700b86af32489e638822153bb67f3019a463253c0d989b2503938d7d301d68455dc4ec81a60a6db3d6b24aa76f6c860701b01e98b17e2e718fbbbd318d3612d009555763bf0ba681e1a8f6c18ce90f2af7948d650ab03e34b40b4512267f3e496d2f5872fe30c323b724d3a3fea9efc7f248f78a93578cdfedcbf429e1286c960770210e5a9a51596f47012fc1b06d20792f59d28ddb306f8ce239c3705587d62085423fef76c7135e2bc1c4a918a82940522212023e74debec3617c330a9bbb94bbf598066f242de3d", 0x2, 0x0, 0x1}, 0x50) 1.630425327s ago: executing program 2 (id=4897): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x7a, 0xa, 0x0, 0xff00, 0x0, 0x71, 0x10, 0x8f}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) r1 = socket(0xa, 0x5, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r2, &(0x7f0000000900)=[{{&(0x7f0000000480)={0xa, 0x4e24, 0x0, @local, 0x4724}, 0x1c, 0x0, 0x0, &(0x7f0000000780)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x1}}}, @dstopts_2292={{0x18, 0x29, 0x4, {0x32}}}], 0x30}}], 0x1, 0x20000000) listen(r1, 0x100) listen(r1, 0x48c) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000080)=r0, 0x4) r3 = socket$kcm(0xa, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r5, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) recvfrom$llc(r5, &(0x7f0000000340)=""/203, 0xcb, 0x2, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write(r0, &(0x7f0000000440)="ebf89326a9d456ff12ee894192306e90663b65", 0x13) write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a) sendfile(r5, r6, 0x0, 0xffffffff000) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000280)=""/52, 0x34}, {&(0x7f00000004c0)=""/211, 0xd3}, {&(0x7f00000005c0)=""/53, 0x35}, {&(0x7f00000006c0)=""/8, 0x8}, {&(0x7f0000000300)=""/42, 0x2a}], 0x5, &(0x7f0000000740)=""/247, 0xf7}, 0x5}], 0x1, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x4}}}, {0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xa4}, 0x1, 0x0, 0x0, 0x40010}, 0x0) preadv(r4, 0xffffffffffffffff, 0x1, 0x4, 0x0) setsockopt$sock_attach_bpf(r3, 0x29, 0x21, &(0x7f0000000100), 0x120) socket$inet6_mptcp(0xa, 0x1, 0x106) r8 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r8, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014) connect$llc(r8, &(0x7f00000000c0)={0x1a, 0x321, 0x40, 0x6, 0x81, 0x3, @random="3050e9ae9a3c"}, 0x10) accept(r2, 0x0, &(0x7f0000000a00)) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x20, 0x1411, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x13}]}, 0x20}}, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x140c, 0x300, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) 1.444393354s ago: executing program 4 (id=4898): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd8}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd8}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/22], 0x50) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/22], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={r2, &(0x7f0000000140), &(0x7f00000001c0)=""/127}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000003880)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c9f4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75055df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83766b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b556381768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225c380fac12f8205d182f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42ddd5f393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05bea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d96ee1b84bb64b14aebc6b5194c55dd6890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b07838a3ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8dc0d472672286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8455029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a82a6ef09d0ed9829dec16ab67a4f59a504e09f55ab82bbd405087a17a229a149c53ee9145500db213cb36489a10957739e481a756e65bde579bbbfb404213f661eeaaffacbcfbfd60b1a715c366da2b37ac7e9e3033f8ec04db1c2412e02ccd0617d9fb646c4897750d068c936c3558a94b05d7c65c0d458c0d70d0aa864bc1e324d3f69b1b4061627da875a4b5c2668ab0990623fe6f3b54cd1c79da4baf256f88750c18486330589473e267fa44e220cf40db662b570c2a2fbba9a34a3dd7bbd8368fe506daa62b45797d4b397905a69e58eb436c08cc78963197adb1b16ad83a1a9b420e74c6bcdf1ed0b306141a83bf1268e954ad069257fbfaa1a7ea582badc1a7f2a5b0965f3535872d85c0bc3a233a3ea85df6a8ed76f0f803d54b7bef77d8ea71621f8a78dd17c3b58c5c7476ed6191acbb949e77f7cac81c543f7751e5e1000"/4545], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0b00000005000000010001000a00000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r5}, 0xc) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000480)={@ifindex, r0, 0x2f}, 0x20) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000001c0)={0x0, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001580)={@fallback=r0, r3, 0x2f, 0x2038, 0x4, @void, @void, @value=r6}, 0x20) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001580)={@fallback=r0, r3, 0x2f, 0x2038, 0x4, @void, @void, @value=r6}, 0x20) 1.438466514s ago: executing program 1 (id=4899): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) r3 = socket$packet(0x11, 0x2, 0x300) bind$packet(r3, &(0x7f00000001c0)={0x11, 0xf5, 0x0, 0x1, 0x0, 0x6, @random="0000eeff00"}, 0x14) recvmsg(r1, &(0x7f00000007c0)={&(0x7f0000000140)=@nfc, 0x80, &(0x7f0000000700)=[{&(0x7f0000000200)=""/167, 0xa7}, {&(0x7f0000000300)=""/27, 0x1b}, {&(0x7f0000000600)=""/249, 0xf9}], 0x3, &(0x7f0000000740)=""/80, 0x50}, 0x40000000) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000), 0x8) close(r0) r4 = socket(0x2, 0x80805, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa080045000060"], 0x0) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f00000002c0)={0x8400001e}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00011100ffffffffffffff81"], 0x30}}, 0x0) sendmmsg$inet_sctp(r4, &(0x7f0000003380)=[{&(0x7f0000000080)=@in={0x2, 0x4e24, @local}, 0x10, &(0x7f00000004c0)=[{&(0x7f00000003c0)="04", 0x1}], 0x1, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000c10000840000000000000051a00e000100ffff"], 0x18}], 0x1, 0x4000004) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, 0x0, 0x0) 1.347388011s ago: executing program 4 (id=4900): socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x4) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha384\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) r1 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in=@dev={0xac, 0x14, 0x14, 0x3e}, @in=@local, 0x0, 0x0, 0x4e21, 0xffff, 0x2}, {0x0, 0x4, 0x1, 0x0, 0x52b, 0xb}, {0x8001ff, 0x8, 0x4053e5, 0x20}, 0x6, 0x0, 0x1, 0x0, 0x2, 0x1}, {{@in6=@local, 0x4d4, 0x32}, 0x2, @in=@local, 0x3507, 0x1, 0x3, 0x0, 0x6, 0x176000}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000002a80)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="2c000000130001002bbd7000f8dbdf2504004f8008003300", @ANYRES32=0x0, @ANYBLOB='\x00'/16], 0x2c}], 0x1, 0x0, 0x0, 0x8000}, 0x8880) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x100010, r2, 0xa23b7000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r4, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r3], 0x38}}, 0x10) 1.21160289s ago: executing program 0 (id=4901): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0xffe4, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0xfffffe16}], 0x3}, 0xc854) (async) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x4c, 0x4) (async) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="8800000000010104040000000000000002000000240001801400018008000100ac1e000108000200ac141e000c0002800500010000000000240002800c00028005000100000000001400018008000100e00000020800020000000000080007400000000024000e801400018008000100ac14142a081414380c000280050001"], 0x88}}, 0x0) (async) r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000004c0)=ANY=[@ANYBLOB="0a000000090000000800000002"], 0x48) (async) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x18) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x3, 0x7, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@map_fd={0x18, 0x3, 0x1, 0x0, r2}, @cb_func={0x18, 0x4, 0x4, 0x0, 0xfffffffffffffffb}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000}, 0x94) 1.125230726s ago: executing program 4 (id=4902): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1802000075000000000000000200040085000000280000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000000850000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfed8, 0x0, 0x0, 0x10, 0x100000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd84550d3abc8b1c72ca1", 0x0, 0x36b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32=r4, @ANYBLOB="00000016010000001800120008000100736974000c0002000800030036"], 0x38}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES64=r5], 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000000) sendmsg$NLBL_UNLABEL_C_STATICADD(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r5, &(0x7f00000007c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x48, r6, 0x204, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_PHY={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008081) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="48000000100039042cbd7000eaffffff000003e4", @ANYRES32=r4, @ANYBLOB="83000400040000002800128008000100736974001c00028006000d00ff07000008000300e000"], 0x48}, 0x1, 0x0, 0x0, 0x24048014}, 0x4040) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000000)=ANY=[], 0x10448) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008200000018030000", @ANYRES32, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a6000000850000002300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_buf(r10, 0x1, 0x49, 0x0, &(0x7f0000000080)) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r11, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000640)=ANY=[@ANYRES16=r10, @ANYRESDEC=r8, @ANYRESOCT=r7, @ANYRES32=r3, @ANYBLOB="e1b8962b50639bc8a136d49a6f3cf4887056a54660cf4be10693fd0065619286", @ANYRES16=r3, @ANYBLOB="ab39f6efbc313616ae7f781d0d7a588b44f1e20e8d9e2cbe70ce2aa3f3e46ec2bda06344acd62270a582a5f17701663c413ff743a90d6f543bceb3dcfa67", @ANYRESDEC=r3], 0x0, 0xfffffffc, 0x0, 0x0, 0x41100, 0x23, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r12, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) sendmsg$IEEE802154_START_REQ(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x44, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x12}, @IEEE802154_ATTR_COORD_REALIGN={0x5, 0x1b, 0x9}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}, @IEEE802154_ATTR_BCN_ORD={0x5}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_PAN_COORD={0x5, 0x19, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x18000}, 0x0) 944.001248ms ago: executing program 0 (id=4903): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffbfff, 0x1, 0x1}, 0x48) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)=ANY=[@ANYBLOB="380100000209010800000000000000000700000c08000540000000140c00048008000140000000010800034000000000fffa5400020006000340000100002c00018014000300fc02000000000000000000000000000014000400000000000000000000000000000000011400018008000100000000000800020000000000060003400004000008000640000000000800064000000000080005400000000e0c00048008000140000066798400020006000340000300002c00018014000300fe8000000000000000000000000000bb14000400fc0100000000000000fd23681900000114000180080001000a01010008000200ac1414aa0600034000000000060003400004000006000340000000000c000280050001002100000014000180080001000a01010208000200ac1e000100"/312], 0x138}, 0x1, 0x0, 0x0, 0x20008890}, 0x200000f1) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000440)={0x0, @in6={{0xa, 0x4e23, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}}, [0x4, 0x4160, 0x8000000000000001, 0x9, 0x3, 0x0, 0x8cdc, 0x7fffffffffffffff, 0x2, 0x6d, 0x1, 0x9, 0x4, 0x7ff, 0x2]}, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='veno', 0x4) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x20, 0x1, 0x0, 0x25dfdbfb, "", [@nested={0x101, 0x117, 0x0, 0x1, [@typed={0xc, 0x16, 0x0, 0x0, @u64=0xfac06}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c", @typed={0x4, 0xeb}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001dc0), r3) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000001e00)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r3, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000001e40)={0x1c, r4, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000900)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r3, &(0x7f00000009c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, r4, 0x10, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x4004000) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGPGRP(r7, 0x8940, 0x0) (async) r8 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000340)=[@in6={0xa, 0x4e22, 0x1000, @dev={0xfe, 0x80, '\x00', 0x1e}, 0xb2}, @in6={0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}], 0x38) r9 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000800)=@bpf_tracing={0x1a, 0x1, &(0x7f0000000400)=@raw=[@generic={0xa, 0x0, 0xd, 0x5, 0x8}], &(0x7f0000000700)='GPL\x00', 0x7, 0x15, &(0x7f0000000740)=""/21, 0x41100, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000780)={0x5, 0x8, 0x5}, 0x10, 0x215bb, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)=[r0, r0], 0x0, 0x10, 0x7}, 0x94) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000008c0)=@newlink={0x20, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x65205, 0xc900}}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x0) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_MSG_GETSETELEM(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x30, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) (async) sendmmsg$inet(r8, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000faffbfff00000000400000008500ffbf1100000095000000000000005bef79b192e34cf13e24d6def54c1f6570"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), r7) 675.698256ms ago: executing program 4 (id=4904): bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000380)={@map, 0xffffffffffffffff, 0x38, 0x4004}, 0x20) r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r0, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f00000001c0)={0x77359400}, 0x10) epoll_create(0x3ff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000340)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r1, &(0x7f0000003bc0)=[{{0x0, 0x0, &(0x7f0000003e00)=[{&(0x7f0000000080)="ef", 0x1}], 0x1, &(0x7f0000000380)=ANY=[], 0x1e0}}], 0x1, 0x5d2dd0c54751f8e3) write(r0, &(0x7f0000000000)='\"', 0x1) recvmmsg(r0, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) 667.701007ms ago: executing program 3 (id=4905): r0 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000380)) ioctl$EXT4_IOC_GETFSUUID(r0, 0x8008662c, &(0x7f00000003c0)) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x68, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x5, 0xd, 0x3, 0x8}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x100, 0x100, 0x9, 0x1, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0x8, r2}, 0x38) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r2}, 0x38) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="219a9e7275ad194a20108b9aea25ba0da6844bd9eac87d49ddaa6ffcef6c6c66f683a4cee761a1f9d19c7a0700e8a704cb4340fa6003d76f4f4ba39fdb5c3ba3a2adf82f54694a6e53a624b5b5e157b7258e3ba8b578a781f21d19e4125506affe4c87cfdf97f7de2ac068c864ddd6beccd559673ed2c3abddda6d4c73bf7eac53a0b8c4f2fa630bd8111f487e094c6ce7dac513605eab194d01dba578cd567f56ace498344f8ffa629dea760486280890b32aaaefc2749aa225650ad0b308166d2fe51d3cd8c4aec5cab077a99774c35efbda553a285f46f4f1567bd0e860adfca0a4c5993309a192094cc59357c2093298306d55c4125e5de73fde02c08f05a5ff8e85edc8e2416a5490287be674be795fba3090940171a8b8db4f7f0dcf57a2e6a3484eee08a5b45eef3fbddf0d205240bd72afe616ed2018db124a77e3ce83ac7d82aec671124ba566b299d7b4796d33466f4c08c560415eac", @ANYRESOCT=r2, @ANYBLOB="f88735350e7ce7ae0050194759681976029da0adf4a33b9f51ddea44538eb880b2d69893ff901e6f80e4696b3cf67c27c96360af776ce6d12ac23362bfff041fbc8053cbddbe2ea7d66b11e375ed640d550597c4ff5ed251607affd0dd77384d28afeb9461bcca180bbe65e1d8cc96d86a74e41994e90929af61984fa2137bac2112f53565a4aa63d0be34207061b6a28fe4a7014c3fb1540dc86145c942", @ANYRES32=r2, @ANYRESOCT, @ANYRESHEX=r1, @ANYRESHEX=r1, @ANYRESDEC=r1, @ANYRES16=r1, @ANYRESOCT=r1], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000001280), 0xb47, r3}, 0x38) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0x62f, 0x7ffffd, 0x0, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x3, 0x10000, 0x10000000, 0x7}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004}, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f00000002c0)={{0xffffffffffffffff, &(0x7f0000000080)='gact\x00', 0x2000, &(0x7f00000000c0)={@_ha_fsid={[0x2, 0x4]}, {0x5, 0x3, 0x7ff, 0x9}}, 0x7, &(0x7f0000000100)={@_ha_fsid}, &(0x7f00000001c0)=0x1}, {[0xdfa, 0x7, 0x40, 0x3]}, 0x7, 0x86, &(0x7f0000000200)=""/134}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000500)={0x14, 0x1, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4008014}, 0x800) ioctl$PPPOEIOCSFWD(r5, 0x4008b100, &(0x7f0000000340)={0x18, 0x0, {0x2, @empty, 'rose0\x00'}}) 621.791839ms ago: executing program 0 (id=4906): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.empty_time\x00', 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x4e22, @remote}, {0x2, 0x4e20, @loopback}, {0x2, 0x4e24, @loopback}, 0x48, 0x0, 0x0, 0x0, 0x8000, &(0x7f0000000040)='ip6_vti0\x00', 0x8, 0x1, 0x6}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e24, 0x5, @empty, 0x70000000}}}, 0x3a) r1 = accept$unix(r0, &(0x7f0000000140)=@abs, &(0x7f00000001c0)=0x6e) recvmsg$unix(r1, &(0x7f0000000400)={&(0x7f0000000200)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f0000000280)=""/91, 0x5b}, {&(0x7f0000000300)=""/5, 0x5}, {&(0x7f0000000340)=""/83, 0x53}], 0x3}, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000440)={0x5c, @broadcast, 0x4e22, 0x4, 'none\x00', 0x0, 0x10000, 0x3c}, 0x2c) sendto$unix(r0, &(0x7f0000000480)="0b75b6d9f6f686e75989a675", 0xc, 0x4000, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r2, 0x8008f511, &(0x7f0000000540)) ioctl$int_in(r0, 0x5421, &(0x7f0000000580)=0x6) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f00000005c0)={{0x2, 0x4e22, @broadcast}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x24, {0x2, 0x4e20, @private=0xa010101}, 'team0\x00'}) r3 = openat$cgroup_ro(r0, &(0x7f0000000640)='memory.current\x00', 0x0, 0x0) sendmsg$nl_netfilter(r3, &(0x7f0000000840)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000800)={&(0x7f00000006c0)={0x118, 0xf, 0x1, 0x401, 0x70bd2d, 0x25dfdbff, {0x7, 0x0, 0x5}, [@typed={0x8, 0xb7, 0x0, 0x0, @ipv4=@local}, @generic="f852bed1d06301a558a4f7511fa2ccd069d461f0a2f6dcaed879a35d2d6bb224a3e9b121573fa153603de21ef981055df3b1ee82c40df02bb62cd11458c46d0f6086", @generic="02fc3415e8987d971201bcc385f07fb7af2e7809c8753cc378e8a80fdbecec114d6cce3109910f3940446a8e215c8c6988ccb28d7b0fd47c58470f46b9600ac4c3b35a6868a07abd3e7899366e06d5957bd7ab4ac9a0c4217902fe04ae6b74caa36962bc06735cc9f20dc025e7b3c4fc2abbdc6e503ed6599b3a19750a0c62140c8b1cdafaa4fafa95ed68a7c6fcf6268c32ec4ffeb6d8bc706b8105703cb55bac525460a1cd6394455d9667d89e072c42b3764130dd32da"]}, 0x118}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000008c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000940)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r4, &(0x7f0000000a40)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x6c, r5, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x2e, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40}, 0x80) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000a80)=0x4, 0x4) r8 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000b00), r0) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000c40)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b40)={0xa0, r8, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@SEG6_ATTR_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @SEG6_ATTR_DST={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x6}, @SEG6_ATTR_DST={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}, @SEG6_ATTR_DST={0x14, 0x1, @private2}, @SEG6_ATTR_DST={0x14, 0x1, @private2}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6b1}, @SEG6_ATTR_SECRET={0x18, 0x4, [0xb, 0x7, 0x6, 0x1, 0x812f]}]}, 0xa0}}, 0x10) sendmsg(r2, &(0x7f00000012c0)={&(0x7f0000000c80)=@sco, 0x80, &(0x7f0000000f40)=[{&(0x7f0000000d00)="8bc993c8c5f333161ac09e99c0942e8bef21518b402230a3de2deb19ee8657c6f04f728321867c25b93f3eb7e1e645a03b", 0x31}, {&(0x7f0000000d40)="1aa5f455430b40b74b6f9b65634616f47b05e6cd53d4d5347b2c5bd486aa29f6ec19080033c00aee782611a4f7a8da9163b02bdab81ac55f00d1794f80d240949279d0397f1d054e6918ed942d07354a322860da27d9a88c71f0bd05f371c46a61a28e329b18dda2411b8a3ff10c7ea4ebde6efef1fdb51e8f7744e77421a960aa030fda9f14ccd4d06f8bfa4d4b811a8e849d82bc79766c2425daa8fad834c1110b6f3f1a596d59f734800ea760f639a7918f29b65c00e9fd8268053e1bb78eff7131731d205803dd425a9c03c9e1d811ca2bdf36fcd5690ec902649f864446a4931e70a06495", 0xe7}, {&(0x7f0000000e40)="b22eee54a890d05278c0b4b946cca3e4f8cec9b9b806fdf6ececbfd9de86f8ea4f25b68a285c576b98ab2090f80af56f0a3942ff3af4ceceb2980b669353aa031f47102953ce8e7df67928c8bd118e90e7e80db154244a1080c209940fc09353a0ce995f5ad64fa77971eb150be88047af821da67366b5a8352569a2f4ca2482c30cc681bd63b5235db5071b8a2e1d6a3b87cfb9cf69ae4c948abfa29112cd3b8eb46b0240c767f1756bbb06cb1fc53ae1b6c14840d421cc725db53ede04141d8d2f916a95db56aeb91e75f69e93bdaaf29f3d4e95fceb35170bd964afc3d237a4354efdf8570994b3afd81952bf6295dd2fdcee7a339cd1c14006f41cdb", 0xfe}], 0x3, &(0x7f0000000f80)=[{0x18, 0x104, 0x7fff, "29e3"}, {0x10, 0x128, 0x6}, {0x70, 0x11, 0xfffffff8, "592e17105ac03d91bedf8dd456f7a19603d5c7ffe702e5cd59aa0053e8d88e0f6962b493f0be20d5a614e2ac98e556d8377f3575abc6363a02484bf1a7d9f3dbf01546757c44fdbd7c2ccd57581bac12c9339aef6c9c7689fa3f"}, {0x38, 0x112, 0xfffff000, "9075110903542e0e322fa94b321ad9274ca5850191e4478b0f86ab96d241372af488c0"}, {0x88, 0x0, 0x7, "fd81a799375ecb4ff4d12280a056d4f77ee5e154375398dfaf47e9e4acbbf281da5a3309088f833e3a171f1957f85ea35a196f53c4a4ed222fee8f2b7b5e0808b839547eba7d604101c8aa38a384b4cc5f799e95ac5d7cfa5d639b4831cce205b9af5fbdf62218654207d40f61ab34fc362818"}, {0x50, 0x29, 0xfffffffe, "0728db86a0748d94489c9d585b411c481b6c9306738531ee832b529a077c6311f284e6687fd58eece0869090b42091f085326c98b3f613e0cf44db"}, {0x60, 0x10f, 0xfff, "7436c2c66255ee11032869bd1f3482ef8d92817316c867730abe052872364c59332397933c161be484ce95439b9b30e1b54595e58515246ee182e67abaa8160a94a9d57be735ebb4315e481c33"}, {0x100, 0x102, 0x5, "025eb9891bdb9ae86fc182b649eacfb89e7b25a1ce6ee5f3ab9aa2507ac9cc8b1b97bfc695cf842a5a8fc4b25c10a45073bb332ad52a970abd9881755f8ef83ca239600a7b1998148c4af139a45003d996c7c8cd3ad0bb3921a5e5eb9de73c230d5a023d90ead8f06e779964544f790a239e6fa3fa9dc6a668aa70379edb24ac33d89d25cb0e5963a8341866b9f36bdc25c03913baed02a005f7ad805561d6a8c58eb67dd6a39d33f3f50fbfd50d5059d87d2acc5f1ea6aefcdb498cba67f859c4d803106ba2ec8d2cf0e17b5a012531c9289dafc44847dd603bdfbc7dea144e9b19f9795b79d59d79"}], 0x308}, 0x400) sendmsg$NFC_CMD_SE_IO(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001480)={&(0x7f0000001340)={0x130, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NFC_ATTR_SE_INDEX={0x8, 0x15, 0xc0}, @NFC_ATTR_SE_INDEX={0x8, 0x15, 0xc0}, @NFC_ATTR_SE_APDU={0xb5, 0x19, "6a00fdbfc30debaec4fc652a1f6248072f30ab7cc4cf6989e77647810f98927731def05c6dcf672529a0818d35af958948a2286ed9c3c8a4e41f02bd00941c6cfd5c56003d9c945b99c852e47bf4692ca728dd4e1b8123c9ec71ff4814c830e8a5fd9e6aa406c1242e76ca543b9ca807c6f2c319aaf8c21d5df0872a713853f98aeda6eff8c20cf5b5810a03437495dfa60552ff9234424577e7e515a815a2e0459616df281e7cb01b3315617e8943bcac"}, @NFC_ATTR_SE_INDEX={0x8, 0x15, 0x1}, @NFC_ATTR_SE_APDU={0x42, 0x19, "214b65110e6fe87e497182e36f83c720ab5337141a94c49a799bb26446170b0147b8deea1914ac2ee3950f37398f759f977f30a87e8bc5441d105813fb73"}, @NFC_ATTR_SE_INDEX={0x8, 0x15, 0x2}]}, 0x130}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000001540), r3) sendmsg$TIPC_CMD_GET_NODES(r3, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0xedad8efc9ef55a0b}, 0xc, &(0x7f00000015c0)={&(0x7f0000001580)={0x1c, r9, 0x200, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c840}, 0x4000000) r10 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8914, &(0x7f0000001640)={'macvlan0\x00', 0x4000}) sendmsg$NL802154_CMD_GET_SEC_DEV(r4, &(0x7f0000001740)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x2c, r5, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x4805) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000001900)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000018c0)={&(0x7f0000001840)={0x64, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY={0x24, 0x50, 0x0, 0x1, [@NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x44005) 409.467278ms ago: executing program 1 (id=4907): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x6c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x1ff, 0x4, 0x0, 0x0, 0xfffffffd, 0x8}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x18, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0xfffffbff, 0x81, 0x4, 0x4}}]}]}}}]}, 0x6c}}, 0x0) sendto$packet(r2, 0x0, 0x0, 0x830, &(0x7f0000000440)={0x11, 0x0, r5, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xe}}, 0x14) sendmsg$NL80211_CMD_STOP_AP(r0, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="00032dbd70e0fd1cdc2ededb0008d0ceb3c0"], 0x14}, 0x1, 0x0, 0x0, 0x850}, 0x4040) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in, @in6=@private2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@mcast1, 0x0, 0x3c}, @in=@broadcast, {0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x4, 0xfffffffffffffff8}, {0x0, 0x3}, 0x0, 0x0, 0xa}, 0x5, 0x5}}, 0xf8}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x34, r1, 0x10, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xe}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x23}]}, 0x34}}, 0x4048040) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x220002, 0x0) r8 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1}, 0x100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000800)=@delchain={0x47c, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x8}, {0x0, 0x1}, {0x0, 0x8}}, [@TCA_RATE={0x6, 0x5, {0x5, 0x5}}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x440, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x9c, 0x1, [@m_simple={0x38, 0x1e, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x8, 0x3, 'bpf\x00'}]}, {0x4}, {0xc, 0x7, {0x0, 0x79d0f023c2b305dd}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x60, 0x15, 0x0, 0x0, {{0xd}, {0x4}, {0x2d, 0x6, "726786f30e509174574dc37f3b098ea66afe225634df06865f963558e69516e656d1b4d3ec4c23aaed"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_ACT={0x370, 0x1, [@m_ctinfo={0x100, 0x4, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x53}, @TCA_CTINFO_ACT={0x18, 0x3, {0x2, 0x7f, 0x10000000, 0x82c}}]}, {0xb1, 0x6, "c14309d56e11f3e88ad36b866a06cff47631fe31f29c2d83a2e6f0bf13045227d5cfc3c4f57b9a903cf86c567461f60a0fb69f562613042765a016443f0181bfeba7e917511c20f8585f40c15cc948ecdd08e5acfddde4c4d1eeb8e4156045960e71ed491970a569097578137069861cf0a28baddf976ebf5e96eca138cadcea7bfb921158875a49e4975a5dbb3ab54f13ee0f5254fe6f752f120208ad930afb01c2417b4953f4774567f9bbf1"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x4, 0x2}}}}, @m_skbmod={0x84, 0x4, 0x0, 0x0, {{0xb}, {0x54, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0x6}, @TCA_SKBMOD_DMAC={0xa, 0x3, @broadcast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @local}, @TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}, @TCA_SKBMOD_SMAC={0xa}, @TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @remote}]}, {0x5, 0x6, "cc"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_nat={0x178, 0x1b, 0x0, 0x0, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xff, 0x1, 0xffffffffffffffff, 0x0, 0xefb}, @loopback, @empty, 0xffffff00, 0x800}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0x4, 0x6, 0x8, 0x9}, @local, @dev={0xac, 0x14, 0x14, 0x1c}, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x357a, 0x9, 0x7, 0x101, 0x5}, @broadcast, @remote}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5f2, 0x40, 0x5, 0x1, 0x1}, @broadcast, @remote, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5, 0x7, 0x20000000, 0x7, 0x59c3}, @loopback, @loopback, 0xff}}]}, {0x85, 0x6, "eef24a41a52f4314740d880a9749ccbff0e34c74cfcac1e63977a597552daff459d49bffeac63ea994857207934fd2d00f52f25f0f3d8c80b3a218a170d8b1961a361663d049269537cb537e3789e52bb3db1eec99b6cdd8dd022491e57495f8bd3687340df10a1e43f1a2790d3910c094f2c7203385622c8498933c3e883b83b3"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_sample={0x70, 0xc, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x7ff}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x9}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x3, 0x5, 0x5, 0x5, 0x8}}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x9}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x5}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xc00}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x47c}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r9 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0xd18c9b35, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030036000b05d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000680)={'gre0\x00', &(0x7f0000000580)={'syztnl0\x00', r5, 0x8000, 0x40, 0xfffff060, 0x1, {{0x35, 0x4, 0x1, 0x3c, 0xd4, 0x64, 0x0, 0xc, 0x29, 0x0, @local, @multicast2, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x1c, 0x4a, 0x1, 0x2, [{@multicast1, 0x7}, {@local, 0x2}, {@local, 0x3ff}]}, @lsrr={0x83, 0xb, 0x7e, [@private=0xa010101, @remote]}, @timestamp_prespec={0x44, 0x14, 0xf9, 0x3, 0x4, [{@multicast2, 0x5a75}, {@rand_addr=0x64010102, 0x2}]}, @timestamp_addr={0x44, 0xc, 0x1f, 0x1, 0x6, [{@rand_addr=0x64010101, 0x1}]}, @timestamp_prespec={0x44, 0x1c, 0xd4, 0x3, 0x9, [{@broadcast, 0xfffffffc}, {@multicast1, 0x7}, {@remote, 0x8}]}, @timestamp_addr={0x44, 0x2c, 0xcb, 0x1, 0xf, [{@local, 0xea}, {@dev={0xac, 0x14, 0x14, 0x38}, 0x3a1e7}, {@private=0xa010100, 0x2}, {@empty, 0x250}, {@empty, 0x8000}]}, @rr={0x7, 0x17, 0x88, [@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010100, @broadcast, @empty]}, @lsrr={0x83, 0x13, 0x43, [@empty, @rand_addr=0x64010100, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000100ffdbdf360000000000000000"], 0x18}, 0x1, 0x0, 0x0, 0x48080}, 0x8c0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r11, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x1002, 0xffffffff, 0x200000, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x1004) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r10, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="00032bbd7000fddbdf257700000008000300", @ANYRES32=r13, @ANYBLOB="0800ef00040000000500ee000b0000000800ef0008000000943ea3395a56dfc41d6a0800ef00060000000500ee000c000200"], 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x4000000) 300.560791ms ago: executing program 2 (id=4908): r0 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x9}, &(0x7f0000000040)=0x8) (rerun: 32) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f00000000c0)={r2, 0x200}, 0x8) (async, rerun: 64) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="7c00000010003704030000000300000000000000", @ANYRES32=r1, @ANYBLOB="0b1b0500000000005c0012800b00010069703667726500004c00028008000100", @ANYRES32=r1, @ANYBLOB="14000600fe8000000000000000000000000000bb14000700fe"], 0x7c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) (async, rerun: 64) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000003c0)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@dev}}, &(0x7f00000004c0)=0xe8) (async) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000500)={{{@in=@multicast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000000600)=0xe8) sendmsg$nl_xfrm(r0, &(0x7f0000000980)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000940)={&(0x7f0000000640)=@acquire={0x2f8, 0x17, 0x100, 0x70bd27, 0x25dfdbff, {{@in=@multicast2, 0x4d5, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1c}, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@empty, 0x4e24, 0x6, 0x4e20, 0x6, 0xa, 0x10, 0xa0, 0x6, r1, r3}, {{@in=@empty, @in=@broadcast, 0x4e24, 0x0, 0x4e24, 0xc, 0x2, 0x20, 0x0, 0x3a, r1, r4}, {0x2, 0x1, 0x6, 0x4, 0x400, 0x1, 0x9, 0xe}, {0x6, 0x2, 0x9, 0x9}, 0x4, 0x0, 0x1, 0x1, 0x0, 0x3}, 0x7ff, 0x56f, 0x9, 0x70bd2c}, [@algo_auth={0xf4, 0x1, {{'sha256\x00'}, 0x560, "6f5e443d3691aba74443886c94c9090dd9bba2da3b3260be5e2f823617e530e8b46e3e611ec8c0de471a71b20d83cfdf25fa1ff57407111577f1f4c78439c458152715d0d75ab9087be357b1e2b7bfb2e86b1af933ac5bcf364d57629868b3e7648ed684449191f53ebce1388b2a3b683e67a5b0907cb192dc2c7711c88f75bb73706cb1f4b5d3e2d7d8327ef354a8265633fd3824d858a59d8b7857112f42cb8b90884b49579e81b0fdbf8b"}}, @algo_auth_trunc={0x9e, 0x14, {{'blake2b-384\x00'}, 0x290, 0x0, "27ec71a0d3587c99ae5c8e2d12e8aaf881098e9b55ad2f6631b93b4b6d0b11161fc466affeef6f35c2398c072306bdcd30b99df0470df932ab3119734dea9b8f2b0f236119d6019ffebb6144af48290d3df2"}}, @replay_thresh={0x8, 0xb, 0x5}, @XFRMA_SET_MARK={0x8, 0x1d, 0xffffffff}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd26, 0x70bd2a, 0x70bd27, 0x70bd2c, 0xffffffff, [0xda, 0x9, 0x5, 0x0]}}]}, 0x2f8}, 0x1, 0x0, 0x0, 0x40}, 0x4004000) 295.57946ms ago: executing program 3 (id=4909): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="6000000002060108000000000000000005000003050005000a000000050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c697000140007800800064000000200080008"], 0x60}, 0x1, 0x0, 0x0, 0x410}, 0x40c0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)={0x18, 0x25, 0x301, 0x270bd24, 0x25dfdbff, {0x1}, [@typed={0x4, 0x135}]}, 0x18}, 0x1, 0x0, 0x0, 0x44048}, 0x0) 101.862148ms ago: executing program 3 (id=4910): r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000012c0)={0x30, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r1}, @nested={0xb, 0x2, 0x0, 0x1, [@generic="976b6408686030"]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @uid}]}]}, 0x30}], 0x1}, 0x0) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, 0x0, 0x0) syz_emit_ethernet(0xae, &(0x7f0000000000)={@multicast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "081f20", 0x78, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x20}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96489269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "020000000400000126000400"}, {0x18, 0x1, '\x00\x00\x00\x00\x00\x00'}]}}}}}}, 0x0) 607.287µs ago: executing program 0 (id=4911): r0 = socket(0x10, 0x803, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x0, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x22}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f00000006c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) sendmmsg$inet(r2, &(0x7f00000058c0)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000008c0)="ff4d293d1a4b4da02e8686301abb5d5b70e962696a643fed4781cc4d9d56f01754f6ab3c31c1b574d21894e0bc6f878ffb07c844ba5f207fe4c8fe75a29d64e804eb84451c344e99e3627f6a6a248269362cf13e821b56a248d2704540b5ff8fe6bcaa9df5a8f2df6d7002a734a443fe3d6805a645771bc1e7d3fe3d45e32ed5f9e2", 0x82}], 0x1, &(0x7f0000000940)=ANY=[], 0x120}}], 0x1, 0x4008c51) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000b40)={{{@in=@broadcast, @in=@empty, 0x4e21, 0x4, 0x4e20, 0x0, 0x2}, {0x40, 0xae, 0xffffffff, 0x9, 0x9, 0x9, 0x9, 0x5}, {0x10000, 0x7, 0x8}, 0x2, 0x6e6bbf, 0x1, 0x2a515e8a9e1e315e, 0x1}, {{@in6=@loopback, 0x4d2, 0x3c}, 0xa, @in=@multicast2, 0x3503, 0x4, 0x0, 0x48, 0x54, 0x1ff, 0x1}}, 0xe8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x8, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x25}, [@jmp={0x6, 0x0, 0x7, 0x0, 0x0, 0x1, 0x25}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit]}, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xfeffff, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x3}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002c00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000500), 0x0, 0x100, 0x60000000, 0x0, 0x5b, &(0x7f0000000000), &(0x7f0000002c80)="8dc92a8ff39080a675b6565efa3ed46f2a2756e43abbfd8c44686c04d6a0c42f2599fc2b73f432c834dac249597b646035045af99decf86f5b32dc0404e599f56091e15e581ff6805ee283c0313298a5b8ba1c84f1850c217b5a2c"}, 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x0) r6 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000200), 0x4) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="6400000000010104000000000000000002000000240001801400018008000100e000000108000200000004000c0002800500010000000000240002800c00028005000100000000001400018008000100e000000108000200e000"], 0x64}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000080)={0x0, 0xfffffe92, &(0x7f00000000c0)={&(0x7f00000008c0)={0x14, 0x0, 0x1, 0x201, 0x0, 0x0, {0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 0s ago: executing program 1 (id=4912): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$int_out(r0, 0x5460, &(0x7f0000000080)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000010000107000040000000001a0a0000000600010011"], 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="02000000c94d8996457564bbef52cb8d4fa4fa29377d2243fa7127b5de9fcc45d6990e641b6c7c2d38ee0160", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1801000000009500008533a9221f61b397247c08328d5078a2d36cc02a66"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) socket$inet6(0xa, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) socket$alg(0x26, 0x5, 0x0) unshare(0x6020400) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r3, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x18000000000002a0, 0x38, 0x0, &(0x7f0000000140)="b9ff0300600d698cff9e14f086dd", 0x0, 0x63, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = epoll_create1(0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f00000007c0)={&(0x7f0000000200), 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x80, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x80}, 0x1, 0x0, 0x0, 0x1}, 0x20004010) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010700000080000000006700000008000300d91426bc6d244bddcaf5bb8f7ab80487ba08f1db579b0b5654cb20c4296cc5bd26b3aa6a68e398a2bfc4197853c84c28160105348fc831c8b02e048d9e422e7a932653f430b75ad25ce8a40147a68682276e74000000005bc56595d57cb03c5c0151af89b280bf30646cb1a7c27b3f7173fafb9697348011049cb37060a1f36278d2524b96cce09aeb13f47de0d82fa17ab152411a6d96dfe8599e50be0e8de3eace68874686138117679ad9af27134b833ba4fd0882162e1491fe99a2008252a0826548f5e1dcf5d0755eb024c8378a69f4685f219850a45ca3ba78cffb0c1e6eb608751d841e99c266de451001bacca99a46402c2c9f002a07a6ac9e3add75c64ad333df22ac198456da2aa65353fd711d1c37bf9fd0a43eed344fc49714ab4a459c6b18af73fcda6cbbfbee2283bc51b8c0a1d808927313e7addc0c2052c37e8c1b386d817687934f7a165c0001c6d0b768cacce54bbb4d3b968655a720e2f83d9aa277e53f7af442b0383dfc492f35774d295e1de0279e2793fffd615f6822917e4f172c48d8f27ad962997809f8aabf99e8d0635d6808079e373d1d03e426f24fead40374be018277c5a3dbd968229a5da441ea435511fdba91a38f910f2622d80fa67a021241cdd84a05485a5f9f39ab029e93ddcdd9320bd3abb51ed4dc1fceeda42ae96dc52c7d90f48b972313c626da15a1fbc6e82f2b289eda352f", @ANYRES32=r10, @ANYBLOB="0800c300000000000800c40000000000"], 0x2c}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000240)={0x30000000}) epoll_create1(0x0) kernel console output (not intermixed with test programs): cks suppressed [ 498.985451][T20388] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3597'. [ 498.996010][T20383] 8021q: adding VLAN 0 to HW filter on device bond1 [ 499.046646][T20395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3598'. [ 499.143032][T20395] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 499.191065][T20401] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 499.243242][ T5637] IPVS: starting estimator thread 0... [ 499.254423][T20399] ip6gre1: entered allmulticast mode [ 499.330146][T20411] netlink: 'syz.3.3603': attribute type 13 has an invalid length. [ 499.338834][T20408] IPVS: using max 37 ests per chain, 88800 per kthread [ 499.523391][T20418] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3605'. [ 499.544446][ T5761] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 499.638585][T20426] geneve2: entered allmulticast mode [ 499.780834][T20431] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 499.842044][T20438] lo: Caught tx_queue_len zero misconfig [ 499.851664][ T5761] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 500.100149][T20451] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3614'. [ 500.123728][T20450] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3614'. [ 500.165343][T20458] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3616'. [ 500.494535][T20473] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3620'. [ 500.533039][T20473] openvswitch: netlink: Flow actions attr not present in new flow. [ 500.566627][T20476] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3621'. [ 500.588620][T20475] netlink: 264 bytes leftover after parsing attributes in process `syz.3.3621'. [ 500.635091][T20485] netlink: 'syz.1.3623': attribute type 1 has an invalid length. [ 500.669262][T20485] bond2: entered promiscuous mode [ 500.676826][T20485] 8021q: adding VLAN 0 to HW filter on device bond2 [ 500.690941][T20485] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3623'. [ 500.700379][T20485] bond2: entered allmulticast mode [ 500.726344][T20485] bond2: (slave bridge3): making interface the new active one [ 500.737580][T20485] bridge3: entered promiscuous mode [ 500.744609][T20485] bridge3: entered allmulticast mode [ 500.754798][T20485] bond2: (slave bridge3): Enslaving as an active interface with an up link [ 501.304234][T20529] netlink: 'syz.3.3636': attribute type 1 has an invalid length. [ 501.349987][T20529] bond3: entered promiscuous mode [ 501.359158][T20514] netlink: 'syz.1.3634': attribute type 1 has an invalid length. [ 501.375184][T20529] 8021q: adding VLAN 0 to HW filter on device bond3 [ 501.384211][T20536] bond3: entered allmulticast mode [ 501.456454][T20514] bond3: entered promiscuous mode [ 501.470043][T20514] 8021q: adding VLAN 0 to HW filter on device bond3 [ 501.509424][T20520] bond3: left promiscuous mode [ 501.516564][T20520] bond3: entered allmulticast mode [ 501.574060][T20525] bond3: (slave bridge4): making interface the new active one [ 501.581816][T20525] bridge4: entered allmulticast mode [ 501.587609][T20525] bond3: (slave bridge4): Enslaving as an active interface with an up link [ 501.611825][T20529] bond3: (slave bridge5): making interface the new active one [ 501.619640][T20529] bridge5: entered promiscuous mode [ 501.625140][T20529] bridge5: entered allmulticast mode [ 501.633525][T20529] bond3: (slave bridge5): Enslaving as an active interface with an up link [ 501.721939][T20546] bridge_slave_0: left allmulticast mode [ 501.735574][T20546] bridge_slave_0: left promiscuous mode [ 501.750962][T20546] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.783576][T20546] bridge_slave_1: left allmulticast mode [ 501.815491][T20546] bridge_slave_1: left promiscuous mode [ 501.837556][T20546] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.876570][T20546] bond0: (slave bond_slave_0): Releasing backup interface [ 501.945234][T20546] bond0: (slave bond_slave_1): Releasing backup interface [ 502.014407][T20546] team0: Port device team_slave_0 removed [ 502.044818][T20546] team0: Port device team_slave_1 removed [ 502.052889][T20546] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 502.060427][T20546] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 502.072201][T20546] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 502.081477][T20546] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 502.110491][T20546] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 502.512322][T20571] bridge0: port 2(bridge_slave_1) entered disabled state [ 502.520025][T20571] bridge0: port 1(bridge_slave_0) entered disabled state [ 502.730192][T20571] macsec0: left promiscuous mode [ 502.982155][T20594] bond4: entered promiscuous mode [ 503.002429][T20594] 8021q: adding VLAN 0 to HW filter on device bond4 [ 503.059487][T16531] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.082954][T16531] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.101625][T16531] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.175114][T16531] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.198725][T20601] lo speed is unknown, defaulting to 1000 [ 503.288747][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 503.435942][T20636] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 504.023433][T20649] bridge5: entered promiscuous mode [ 504.029774][T20649] bridge5: entered allmulticast mode [ 504.054915][T20649] team0: Port device bridge5 added [ 504.076534][T20666] bridge0: port 1(team0) entered blocking state [ 504.100280][T20666] bridge0: port 1(team0) entered disabled state [ 504.100925][T20649] __nla_validate_parse: 15 callbacks suppressed [ 504.100940][T20649] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3660'. [ 504.130467][T20666] team0: entered allmulticast mode [ 504.137336][T20666] team_slave_1: entered allmulticast mode [ 504.147693][T20666] team0: entered promiscuous mode [ 504.152854][T20666] team_slave_1: entered promiscuous mode [ 504.159465][T20630] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 504.164639][T20666] bridge0: port 1(team0) entered blocking state [ 504.176424][T20666] bridge0: port 1(team0) entered forwarding state [ 504.249600][ T5633] Bluetooth: hci4: command 0x0405 tx timeout [ 504.624166][T20680] tipc: Started in network mode [ 504.657159][T20680] tipc: Node identity 6201cd1a36d7, cluster identity 4711 [ 504.687425][T20680] tipc: Enabled bearer , priority 0 [ 504.816361][T20695] openvswitch: netlink: Message has 1 unknown bytes. [ 504.842834][T20695] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 504.866371][T20683] syzkaller0: entered promiscuous mode [ 504.883061][T20704] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 504.892641][T20704] IPv6: NLM_F_CREATE should be set when creating new route [ 504.911222][T20683] syzkaller0: entered allmulticast mode [ 504.923544][T20683] tipc: Resetting bearer [ 504.963886][T20695] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3670'. [ 504.983108][T20676] tipc: Resetting bearer [ 507.357274][T20676] tipc: Disabling bearer [ 507.374008][T20695] bond0: Unable to set up delay as MII monitoring is disabled [ 507.386208][ T5627] Bluetooth: hci4: link tx timeout [ 507.394711][ T5627] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 507.416225][ T5633] Bluetooth: hci4: link tx timeout [ 507.422026][ T5633] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 507.459190][ T5761] tipc: Node number set to 1423363354 [ 507.466956][T20689] lo speed is unknown, defaulting to 1000 [ 507.521234][T20720] IPVS: length: 219 != 8 [ 507.560060][ T5633] Bluetooth: hci4: link tx timeout [ 507.566225][ T5633] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 507.594959][ T5633] Bluetooth: hci4: link tx timeout [ 507.600509][ T5633] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 507.959304][T20746] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3680'. [ 507.960338][T20744] IPVS: set_ctl: invalid protocol: 108 172.30.1.2:20002 [ 508.034064][T20714] lo speed is unknown, defaulting to 1000 [ 508.130972][ T5633] Bluetooth: hci4: link tx timeout [ 508.138208][ T5633] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 508.366348][ T5633] Bluetooth: hci4: link tx timeout [ 508.372939][ T5633] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 508.470793][ T5633] Bluetooth: hci4: link tx timeout [ 508.476051][ T5633] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 509.327908][T20785] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3687'. [ 509.377250][ T5633] Bluetooth: hci4: link tx timeout [ 509.382963][ T5633] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 509.436300][T20788] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3688'. [ 509.450017][ T5633] Bluetooth: hci4: command 0x0405 tx timeout [ 509.467872][T20788] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3688'. [ 509.490269][T20790] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3689'. [ 509.492301][T20788] netlink: 58 bytes leftover after parsing attributes in process `syz.4.3688'. [ 509.560684][T20788] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3688'. [ 509.833699][T20806] netlink: 'syz.3.3694': attribute type 32 has an invalid length. [ 509.842885][T20805] xt_CT: You must specify a L4 protocol and not use inversions on it [ 509.932528][T20805] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3693'. [ 510.212586][T20826] lo speed is unknown, defaulting to 1000 [ 510.331974][T20836] syzkaller0: entered promiscuous mode [ 510.350202][T20836] syzkaller0: entered allmulticast mode [ 510.380829][T20836] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3700'. [ 510.814483][T20854] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3702'. [ 511.316502][T20874] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3709'. [ 511.366558][T20874] ip6gre2: entered promiscuous mode [ 511.396850][T20874] ip6gre2: entered allmulticast mode [ 511.454370][T16525] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 511.462790][T16525] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 511.489986][ T5637] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 511.793004][T20890] : entered promiscuous mode [ 511.804821][T20890] openvswitch: : Dropping previously announced user features [ 512.249212][ T5637] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 512.488698][ T5637] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 514.317319][T20876] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 514.580605][T20920] __nla_validate_parse: 2 callbacks suppressed [ 514.580623][T20920] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3718'. [ 514.632886][T20924] netlink: 136 bytes leftover after parsing attributes in process `syz.1.3721'. [ 514.647934][T20926] netlink: 'syz.3.3724': attribute type 1 has an invalid length. [ 514.660699][T20926] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3724'. [ 514.679616][T20926] bridge0: port 2(bridge_slave_1) entered disabled state [ 514.687190][T20926] bridge0: port 1(bridge_slave_0) entered disabled state [ 514.844729][T20929] lo speed is unknown, defaulting to 1000 [ 514.869910][T20940] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3725'. [ 514.879079][T20940] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3725'. [ 514.961089][T20940] ip6tnl2: entered allmulticast mode [ 515.143435][T20949] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 515.471093][T20961] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3732'. [ 515.534881][T20961] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3732'. [ 515.567214][T20929] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3723'. [ 515.768746][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 515.789713][T20979] netlink: 324 bytes leftover after parsing attributes in process `syz.2.3738'. [ 515.949264][T20985] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3740'. [ 516.861591][ T9] IPVS: starting estimator thread 0... [ 516.895179][T21034] macvtap0: entered promiscuous mode [ 516.901244][T21034] macvtap0: entered allmulticast mode [ 516.906633][T21034] veth1_vlan: entered allmulticast mode [ 516.948970][T21042] IPVS: using max 39 ests per chain, 93600 per kthread [ 517.199176][T21055] set match dimension is over the limit! [ 517.650164][T21036] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 517.704672][T21078] tipc: Enabled bearer , priority 0 [ 517.792062][T21078] syzkaller0: entered promiscuous mode [ 517.797956][T21078] syzkaller0: entered allmulticast mode [ 517.843103][T21078] tipc: Resetting bearer [ 517.866164][T21077] tipc: Resetting bearer [ 517.917924][T21077] tipc: Disabling bearer [ 518.054427][T21095] netlink: 'syz.3.3768': attribute type 12 has an invalid length. [ 518.069033][T21095] netlink: 'syz.3.3768': attribute type 29 has an invalid length. [ 518.204045][T21102] netlink: 'syz.2.3769': attribute type 10 has an invalid length. [ 518.233759][T21102] veth0_vlan: left promiscuous mode [ 518.244389][T21102] veth0_vlan: entered promiscuous mode [ 518.255198][T21102] team0: Device veth0_vlan failed to register rx_handler [ 518.265035][T21100] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.340392][T21109] bond0: option arp_validate: invalid value (55553) [ 518.347346][ T12] bond0: (slave bond_slave_0): interface is now down [ 518.355901][T21111] FAULT_INJECTION: forcing a failure. [ 518.355901][T21111] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 518.361086][ T12] bond0: (slave bond_slave_1): interface is now down [ 518.371904][T21111] CPU: 0 UID: 0 PID: 21111 Comm: syz.2.3772 Not tainted syzkaller #0 PREEMPT(full) [ 518.371925][T21111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 518.371935][T21111] Call Trace: [ 518.371943][T21111] [ 518.371949][T21111] dump_stack_lvl+0xe8/0x150 [ 518.371977][T21111] should_fail_ex+0x412/0x560 [ 518.372002][T21111] _copy_from_user+0x2d/0xb0 [ 518.372026][T21111] ___sys_sendmsg+0x1c6/0x360 [ 518.372042][T21111] ? __lock_acquire+0x6b5/0x2cf0 [ 518.372064][T21111] ? __pfx____sys_sendmsg+0x10/0x10 [ 518.372111][T21111] ? __fget_files+0x2a/0x420 [ 518.372130][T21111] ? __fget_files+0x3a0/0x420 [ 518.372157][T21111] __x64_sys_sendmsg+0x1bd/0x2a0 [ 518.372175][T21111] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 518.372198][T21111] ? __pfx_ksys_write+0x10/0x10 [ 518.372227][T21111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.372244][T21111] do_syscall_64+0x15f/0xf80 [ 518.372266][T21111] ? trace_irq_disable+0x3b/0x140 [ 518.372289][T21111] ? clear_bhb_loop+0x40/0x90 [ 518.372307][T21111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.372322][T21111] RIP: 0033:0x7f7864b9ce59 [ 518.372338][T21111] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 518.372350][T21111] RSP: 002b:00007f7862df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 518.372367][T21111] RAX: ffffffffffffffda RBX: 00007f7864e15fa0 RCX: 00007f7864b9ce59 [ 518.372378][T21111] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 518.372388][T21111] RBP: 00007f7862df6090 R08: 0000000000000000 R09: 0000000000000000 [ 518.372397][T21111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 518.372405][T21111] R13: 00007f7864e16038 R14: 00007f7864e15fa0 R15: 00007ffc6a687f98 [ 518.372432][T21111] [ 518.569315][ T12] bond0: now running without any active interface! [ 518.732973][T21128] netlink: 'syz.0.3776': attribute type 21 has an invalid length. [ 519.371134][T21164] netlink: 'syz.1.3784': attribute type 1 has an invalid length. [ 519.544633][T21164] 8021q: adding VLAN 0 to HW filter on device bond5 [ 519.731194][T21172] bridge5: port 1(gretap2) entered blocking state [ 519.760519][T21172] bridge5: port 1(gretap2) entered disabled state [ 519.792244][T21172] gretap2: entered allmulticast mode [ 519.814669][T21172] gretap2: entered promiscuous mode [ 520.068652][T21193] xt_hashlimit: max too large, truncated to 1048576 [ 520.741439][T21219] __nla_validate_parse: 21 callbacks suppressed [ 520.741455][T21219] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3792'. [ 520.880287][T21227] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3792'. [ 520.967192][T21231] netlink: 444 bytes leftover after parsing attributes in process `syz.1.3792'. [ 521.802984][T21267] netlink: 'syz.4.3802': attribute type 1 has an invalid length. [ 521.951125][T21267] 8021q: adding VLAN 0 to HW filter on device bond2 [ 521.992885][T21284] netlink: 'syz.3.3806': attribute type 4 has an invalid length. [ 522.061424][T21279] netlink: 'syz.3.3806': attribute type 4 has an invalid length. [ 522.074259][T21282] bond2: (slave ip6gretap1): making interface the new active one [ 522.087132][T21282] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 522.145749][T21288] geneve1: entered promiscuous mode [ 522.434469][T21310] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3816'. [ 522.472612][T21310] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3816'. [ 522.501216][T21310] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3816'. [ 522.582216][T21319] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3819'. [ 522.703586][T21313] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3817'. [ 522.787562][T21313] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3817'. [ 522.975482][T21347] bridge_slave_0: left allmulticast mode [ 522.985026][T21347] bridge_slave_0: left promiscuous mode [ 522.993797][T21347] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.998071][T21343] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3825'. [ 523.014098][T21347] bridge_slave_1: left allmulticast mode [ 523.022030][T21347] bridge_slave_1: left promiscuous mode [ 523.033497][T21347] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.086121][T21347] bond0: (slave bond_slave_0): Releasing backup interface [ 523.109618][T21347] bond0: (slave bond_slave_1): Releasing backup interface [ 523.132662][T21347] team0: Port device team_slave_0 removed [ 523.151975][T21347] team0: Port device team_slave_1 removed [ 523.160151][T21347] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 523.211643][T21349] vlan0: entered promiscuous mode [ 523.241485][T21348] lo speed is unknown, defaulting to 1000 [ 523.476927][T21365] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 523.604124][T21376] sctp: [Deprecated]: syz.4.3831 (pid 21376) Use of struct sctp_assoc_value in delayed_ack socket option. [ 523.604124][T21376] Use struct sctp_sack_info instead [ 523.930093][ T5633] Bluetooth: hci5: command 0x0405 tx timeout [ 524.627290][T21416] netlink: 'syz.4.3843': attribute type 11 has an invalid length. [ 524.733309][T21419] macsec1: entered promiscuous mode [ 524.752820][T21419] virt_wifi0: entered promiscuous mode [ 524.856095][T21419] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 525.048610][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 525.590200][T21451] xt_connbytes: Forcing CT accounting to be enabled [ 525.601126][T21451] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 525.686555][T21453] bond3: entered promiscuous mode [ 525.801337][T21464] netlink: 'syz.4.3858': attribute type 1 has an invalid length. [ 525.925746][T21464] 8021q: adding VLAN 0 to HW filter on device bond3 [ 526.037437][T21469] bond3: (slave veth3): Enslaving as an active interface with a down link [ 526.074007][T21480] __nla_validate_parse: 5 callbacks suppressed [ 526.074024][T21480] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3864'. [ 526.136019][T21458] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 526.146405][T21480] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3864'. [ 526.172126][T21458] bond3: (slave batadv0): making interface the new active one [ 526.193958][T21458] batadv0: entered promiscuous mode [ 526.214438][T21458] bond3: (slave batadv0): Enslaving as an active interface with an up link [ 526.258854][T21478] bond3 (unregistering): (slave veth3): Releasing active interface [ 526.293282][T21478] bond3 (unregistering): (slave batadv0): Releasing active interface [ 526.320656][T21478] bond3 (unregistering): Released all slaves [ 526.362986][T21493] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3868'. [ 526.387873][T21480] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3864'. [ 526.501737][T21497] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 526.733175][T21509] FAULT_INJECTION: forcing a failure. [ 526.733175][T21509] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 526.769561][T21509] CPU: 1 UID: 0 PID: 21509 Comm: syz.4.3874 Not tainted syzkaller #0 PREEMPT(full) [ 526.769585][T21509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 526.769594][T21509] Call Trace: [ 526.769601][T21509] [ 526.769607][T21509] dump_stack_lvl+0xe8/0x150 [ 526.769633][T21509] should_fail_ex+0x412/0x560 [ 526.769680][T21509] _copy_to_user+0x31/0xb0 [ 526.769706][T21509] simple_read_from_buffer+0xe1/0x170 [ 526.769731][T21509] proc_fail_nth_read+0x1bb/0x230 [ 526.769804][T21509] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 526.769826][T21509] ? rw_verify_area+0x2a6/0x4d0 [ 526.769847][T21509] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 526.769868][T21509] vfs_read+0x20c/0xa70 [ 526.769894][T21509] ? __pfx___mutex_lock+0x10/0x10 [ 526.769911][T21509] ? __pfx_vfs_read+0x10/0x10 [ 526.769933][T21509] ? __fget_files+0x2a/0x420 [ 526.769955][T21509] ? __fget_files+0x3a0/0x420 [ 526.769971][T21509] ? __fget_files+0x2a/0x420 [ 526.769998][T21509] ksys_read+0x150/0x270 [ 526.770024][T21509] ? __pfx_ksys_read+0x10/0x10 [ 526.770060][T21509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.770078][T21509] do_syscall_64+0x15f/0xf80 [ 526.770098][T21509] ? trace_irq_disable+0x3b/0x140 [ 526.770121][T21509] ? clear_bhb_loop+0x40/0x90 [ 526.770141][T21509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.770156][T21509] RIP: 0033:0x7ff7e1b5d68e [ 526.770172][T21509] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 526.770185][T21509] RSP: 002b:00007ff7e2a7dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 526.770201][T21509] RAX: ffffffffffffffda RBX: 00007ff7e2a7e6c0 RCX: 00007ff7e1b5d68e [ 526.770213][T21509] RDX: 000000000000000f RSI: 00007ff7e2a7e0a0 RDI: 0000000000000006 [ 526.770222][T21509] RBP: 00007ff7e2a7e090 R08: 0000000000000000 R09: 0000000000000000 [ 526.770232][T21509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.770241][T21509] R13: 00007ff7e1e16038 R14: 00007ff7e1e15fa0 R15: 00007ffe0cdb7348 [ 526.770269][T21509] [ 527.218133][T21522] x_tables: duplicate underflow at hook 2 [ 527.426895][T21542] netlink: 'syz.1.3886': attribute type 1 has an invalid length. [ 527.435467][T21543] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3883'. [ 527.447466][T21543] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3883'. [ 527.469178][T21543] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3883'. [ 527.724288][T21558] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3890'. [ 527.970700][T21572] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 528.177986][T21584] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3897'. [ 528.191253][T21579] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3896'. [ 528.440246][T21597] xt_l2tp: missing protocol rule (udp|l2tpip) [ 528.860548][T21621] bond3: entered promiscuous mode [ 528.866199][T21621] 8021q: adding VLAN 0 to HW filter on device bond3 [ 528.876439][T21621] bridge0: port 1(bond3) entered blocking state [ 528.883702][T21621] bridge0: port 1(bond3) entered disabled state [ 528.891560][T21621] bond3: entered allmulticast mode [ 528.944015][T21624] lo speed is unknown, defaulting to 1000 [ 529.059978][T21633] xt_TCPMSS: Only works on TCP SYN packets [ 529.144167][T21635] netlink: 'syz.2.3911': attribute type 5 has an invalid length. [ 529.476515][T21653] xt_hashlimit: max too large, truncated to 1048576 [ 530.022851][T21664] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.126672][T21664] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.211209][T21664] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.316462][T21664] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.606115][T21694] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 530.615857][T21693] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 530.624930][T16528] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.659702][T21691] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 530.720091][T21695] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 530.770922][T16528] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.808070][T21691] bond0: Caught tx_queue_len zero misconfig [ 530.822523][T16528] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.846489][T16531] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.097146][T21719] IPVS: set_ctl: invalid protocol: 60 172.20.20.187:20000 [ 531.226199][T21726] __nla_validate_parse: 11 callbacks suppressed [ 531.226217][T21726] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3937'. [ 531.365458][T21730] openvswitch: netlink: Flow key attr not present in new flow. [ 531.378176][T21732] syzkaller0: entered promiscuous mode [ 531.385899][T21732] syzkaller0: entered allmulticast mode [ 531.506280][T21739] bridge: RTM_NEWNEIGH with invalid state 0x10 [ 531.671224][ T29] audit: type=1800 audit(1778989517.672:11): pid=21752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3944" name="memory.events" dev="tmpfs" ino=791 res=0 errno=0 [ 531.822731][T21757] bridge0: port 2(bridge_slave_1) entered blocking state [ 531.830026][T21757] bridge0: port 2(bridge_slave_1) entered forwarding state [ 531.837572][T21757] bridge0: port 1(bridge_slave_0) entered blocking state [ 531.844767][T21757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 531.873566][T21758] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.884563][T21759] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3946'. [ 531.947221][T21757] vlan3: left promiscuous mode [ 531.955134][T21757] bond1: left promiscuous mode [ 531.963859][T21757] bridge2: left promiscuous mode [ 531.976823][T21757] netdevsim netdevsim3 eth0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 531.989432][T21757] 8021q: adding VLAN 0 to HW filter on device eth0 [ 531.999406][ T5739] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 532.009658][T21757] netdevsim netdevsim3 eth1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 532.021006][T21757] 8021q: adding VLAN 0 to HW filter on device eth1 [ 532.048841][T21757] netdevsim netdevsim3 eth2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 532.073845][T21757] 8021q: adding VLAN 0 to HW filter on device eth2 [ 532.089801][ T5739] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 532.109948][T21757] netdevsim netdevsim3 eth3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 532.122793][T21757] 8021q: adding VLAN 0 to HW filter on device eth3 [ 532.136770][T21757] bond3: left promiscuous mode [ 532.144255][T21757] bridge5: left promiscuous mode [ 532.156270][T21757] macvtap0: left promiscuous mode [ 532.185716][ T1124] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 20002 - 0 [ 532.211684][ T1124] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 20002 - 0 [ 532.242457][ T1124] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 20002 - 0 [ 532.276011][ T1124] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 20002 - 0 [ 532.284135][T21761] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3948'. [ 532.407462][T21770] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3951'. [ 532.462570][T21771] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3951'. [ 532.843955][T21803] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3960'. [ 532.990184][T21810] netlink: 'syz.2.3964': attribute type 1 has an invalid length. [ 533.004908][T21810] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 533.103353][T21821] syzkaller0: entered promiscuous mode [ 533.123320][T21821] syzkaller0: entered allmulticast mode [ 533.322086][T21831] lo speed is unknown, defaulting to 1000 [ 533.456110][T21837] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3973'. [ 533.559375][T21842] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3975'. [ 533.580310][T21842] FAULT_INJECTION: forcing a failure. [ 533.580310][T21842] name failslab, interval 1, probability 0, space 0, times 0 [ 533.622865][T21842] CPU: 1 UID: 0 PID: 21842 Comm: syz.4.3975 Not tainted syzkaller #0 PREEMPT(full) [ 533.622889][T21842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 533.622899][T21842] Call Trace: [ 533.622906][T21842] [ 533.622916][T21842] dump_stack_lvl+0xe8/0x150 [ 533.622941][T21842] should_fail_ex+0x412/0x560 [ 533.622968][T21842] should_failslab+0xa8/0x100 [ 533.622994][T21842] __kmalloc_noprof+0xe8/0x760 [ 533.623016][T21842] ? sock_kmalloc+0xd6/0x160 [ 533.623039][T21842] sock_kmalloc+0xd6/0x160 [ 533.623058][T21842] __ipv6_sock_mc_join+0x408/0x750 [ 533.623182][T21842] inet6_addr_add+0x3cf/0xb20 [ 533.623253][T21842] inet6_rtm_newaddr+0xa17/0xe30 [ 533.623309][T21842] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 533.623338][T21842] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 533.623440][T21842] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 533.623459][T21842] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 533.623480][T21842] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 533.623499][T21842] ? netlink_sendmsg+0x5d4/0xb40 [ 533.623517][T21842] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 533.623535][T21842] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 533.623557][T21842] ? __lock_acquire+0x6b5/0x2cf0 [ 533.623589][T21842] netlink_rcv_skb+0x232/0x4b0 [ 533.623606][T21842] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 533.623628][T21842] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 533.623656][T21842] ? netlink_deliver_tap+0x2e/0x1b0 [ 533.623672][T21842] ? netlink_deliver_tap+0x2e/0x1b0 [ 533.623694][T21842] netlink_unicast+0x75c/0x8e0 [ 533.623728][T21842] netlink_sendmsg+0x813/0xb40 [ 533.623755][T21842] ? __pfx_netlink_sendmsg+0x10/0x10 [ 533.623775][T21842] ? aa_sock_msg_perm+0xf1/0x1b0 [ 533.623798][T21842] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 533.623839][T21842] ____sys_sendmsg+0x972/0x9f0 [ 533.623856][T21842] ? __might_fault+0xaf/0x130 [ 533.623882][T21842] ? __pfx_____sys_sendmsg+0x10/0x10 [ 533.623907][T21842] ? import_iovec+0x73/0xa0 [ 533.623933][T21842] ___sys_sendmsg+0x2a5/0x360 [ 533.623949][T21842] ? __lock_acquire+0x6b5/0x2cf0 [ 533.623970][T21842] ? __pfx____sys_sendmsg+0x10/0x10 [ 533.624023][T21842] ? __fget_files+0x2a/0x420 [ 533.624041][T21842] ? __fget_files+0x3a0/0x420 [ 533.624071][T21842] __x64_sys_sendmsg+0x1bd/0x2a0 [ 533.624090][T21842] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 533.624116][T21842] ? __pfx_ksys_write+0x10/0x10 [ 533.624147][T21842] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.624164][T21842] do_syscall_64+0x15f/0xf80 [ 533.624186][T21842] ? trace_irq_disable+0x3b/0x140 [ 533.624209][T21842] ? clear_bhb_loop+0x40/0x90 [ 533.624229][T21842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.624244][T21842] RIP: 0033:0x7ff7e1b9ce59 [ 533.624260][T21842] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 533.624274][T21842] RSP: 002b:00007ff7e2a7e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 533.624291][T21842] RAX: ffffffffffffffda RBX: 00007ff7e1e15fa0 RCX: 00007ff7e1b9ce59 [ 533.624302][T21842] RDX: 0000000020004c04 RSI: 0000200000000080 RDI: 0000000000000003 [ 533.624311][T21842] RBP: 00007ff7e2a7e090 R08: 0000000000000000 R09: 0000000000000000 [ 533.624321][T21842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 533.624330][T21842] R13: 00007ff7e1e16038 R14: 00007ff7e1e15fa0 R15: 00007ffe0cdb7348 [ 533.624359][T21842] [ 533.872461][T21852] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3977'. [ 533.983939][T21857] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3978'. [ 534.390860][T21866] tipc: Enabling of bearer rejected, failed to enable media [ 534.618288][T21871] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 534.872753][T21892] netlink: 'syz.2.3991': attribute type 1 has an invalid length. [ 534.894128][T21894] netlink: 'syz.3.3990': attribute type 1 has an invalid length. [ 534.902927][T21892] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 534.946836][T21903] netlink: 'syz.3.3990': attribute type 3 has an invalid length. [ 534.967461][T21903] netlink: 'syz.3.3990': attribute type 3 has an invalid length. [ 535.112979][T21903] bond4: entered promiscuous mode [ 535.139229][T21903] bond4: entered allmulticast mode [ 535.144854][T21903] 8021q: adding VLAN 0 to HW filter on device bond4 [ 535.220278][T21921] FAULT_INJECTION: forcing a failure. [ 535.220278][T21921] name failslab, interval 1, probability 0, space 0, times 0 [ 535.259398][T21921] CPU: 0 UID: 0 PID: 21921 Comm: syz.2.3999 Not tainted syzkaller #0 PREEMPT(full) [ 535.259420][T21921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 535.259427][T21921] Call Trace: [ 535.259436][T21921] [ 535.259443][T21921] dump_stack_lvl+0xe8/0x150 [ 535.259465][T21921] should_fail_ex+0x412/0x560 [ 535.259488][T21921] should_failslab+0xa8/0x100 [ 535.259510][T21921] __kmalloc_cache_noprof+0x88/0x660 [ 535.259529][T21921] ? __ipv6_dev_mc_inc+0x44f/0xa50 [ 535.259548][T21921] __ipv6_dev_mc_inc+0x44f/0xa50 [ 535.259571][T21921] __ipv6_sock_mc_join+0x503/0x750 [ 535.259603][T21921] inet6_addr_add+0x3cf/0xb20 [ 535.259631][T21921] inet6_rtm_newaddr+0xa17/0xe30 [ 535.259663][T21921] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 535.259677][T21921] ? __dev_queue_xmit+0x2b6/0x3950 [ 535.259813][T21921] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 535.259846][T21921] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 535.259862][T21921] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 535.259883][T21921] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 535.259901][T21921] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 535.259917][T21921] ? ref_tracker_free+0x693/0x840 [ 535.259937][T21921] ? __pfx_ref_tracker_free+0x10/0x10 [ 535.259963][T21921] netlink_rcv_skb+0x232/0x4b0 [ 535.259979][T21921] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 535.259999][T21921] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 535.260025][T21921] ? netlink_deliver_tap+0x2e/0x1b0 [ 535.260038][T21921] ? netlink_deliver_tap+0x2e/0x1b0 [ 535.260057][T21921] netlink_unicast+0x75c/0x8e0 [ 535.260086][T21921] netlink_sendmsg+0x813/0xb40 [ 535.260109][T21921] ? __pfx_netlink_sendmsg+0x10/0x10 [ 535.260126][T21921] ? aa_sock_msg_perm+0xf1/0x1b0 [ 535.260145][T21921] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 535.260166][T21921] ____sys_sendmsg+0x972/0x9f0 [ 535.260180][T21921] ? __might_fault+0xaf/0x130 [ 535.260203][T21921] ? __pfx_____sys_sendmsg+0x10/0x10 [ 535.260224][T21921] ? import_iovec+0x73/0xa0 [ 535.260245][T21921] ___sys_sendmsg+0x2a5/0x360 [ 535.260258][T21921] ? __lock_acquire+0x6b5/0x2cf0 [ 535.260277][T21921] ? __pfx____sys_sendmsg+0x10/0x10 [ 535.260320][T21921] ? __fget_files+0x2a/0x420 [ 535.260335][T21921] ? __fget_files+0x3a0/0x420 [ 535.260360][T21921] __x64_sys_sendmsg+0x1bd/0x2a0 [ 535.260375][T21921] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 535.260398][T21921] ? __pfx_ksys_write+0x10/0x10 [ 535.260423][T21921] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.260438][T21921] do_syscall_64+0x15f/0xf80 [ 535.260458][T21921] ? clear_bhb_loop+0x40/0x90 [ 535.260475][T21921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.260488][T21921] RIP: 0033:0x7f7864b9ce59 [ 535.260501][T21921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.260512][T21921] RSP: 002b:00007f7862df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 535.260527][T21921] RAX: ffffffffffffffda RBX: 00007f7864e15fa0 RCX: 00007f7864b9ce59 [ 535.260536][T21921] RDX: 0000000020004c04 RSI: 0000200000000080 RDI: 0000000000000003 [ 535.260544][T21921] RBP: 00007f7862df6090 R08: 0000000000000000 R09: 0000000000000000 [ 535.260552][T21921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.260560][T21921] R13: 00007f7864e16038 R14: 00007f7864e15fa0 R15: 00007ffc6a687f98 [ 535.260584][T21921] [ 535.747752][T21937] tipc: Enabled bearer , priority 0 [ 535.797499][T21940] netlink: 'syz.3.4006': attribute type 1 has an invalid length. [ 535.848283][T21937] syzkaller0: entered promiscuous mode [ 535.855473][T21937] syzkaller0: entered allmulticast mode [ 535.865695][T21937] tipc: Resetting bearer [ 536.019178][T21935] tipc: Resetting bearer [ 537.853690][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 538.410285][T21935] tipc: Disabling bearer [ 538.544058][T21972] FAULT_INJECTION: forcing a failure. [ 538.544058][T21972] name failslab, interval 1, probability 0, space 0, times 0 [ 538.557501][T21972] CPU: 1 UID: 0 PID: 21972 Comm: syz.4.4014 Not tainted syzkaller #0 PREEMPT(full) [ 538.557523][T21972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 538.557532][T21972] Call Trace: [ 538.557538][T21972] [ 538.557545][T21972] dump_stack_lvl+0xe8/0x150 [ 538.557571][T21972] should_fail_ex+0x412/0x560 [ 538.557599][T21972] should_failslab+0xa8/0x100 [ 538.557623][T21972] __kmalloc_cache_noprof+0x88/0x660 [ 538.557645][T21972] ? ipv6_add_addr+0x55e/0x1100 [ 538.557676][T21972] ipv6_add_addr+0x55e/0x1100 [ 538.557703][T21972] ? __pfx_ipv6_add_addr+0x10/0x10 [ 538.557727][T21972] ? inet6_addr_add+0x3d9/0xb20 [ 538.557760][T21972] inet6_addr_add+0x454/0xb20 [ 538.557793][T21972] inet6_rtm_newaddr+0xa17/0xe30 [ 538.557823][T21972] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 538.557851][T21972] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 538.557899][T21972] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 538.557919][T21972] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 538.557948][T21972] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 538.557967][T21972] ? netlink_sendmsg+0x5d4/0xb40 [ 538.557986][T21972] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 538.558006][T21972] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 538.558029][T21972] ? __lock_acquire+0x6b5/0x2cf0 [ 538.558060][T21972] netlink_rcv_skb+0x232/0x4b0 [ 538.558077][T21972] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 538.558101][T21972] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 538.558131][T21972] ? netlink_deliver_tap+0x2e/0x1b0 [ 538.558148][T21972] ? netlink_deliver_tap+0x2e/0x1b0 [ 538.558170][T21972] netlink_unicast+0x75c/0x8e0 [ 538.558204][T21972] netlink_sendmsg+0x813/0xb40 [ 538.558234][T21972] ? __pfx_netlink_sendmsg+0x10/0x10 [ 538.558253][T21972] ? aa_sock_msg_perm+0xf1/0x1b0 [ 538.558277][T21972] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 538.558301][T21972] ____sys_sendmsg+0x972/0x9f0 [ 538.558317][T21972] ? __might_fault+0xaf/0x130 [ 538.558340][T21972] ? __pfx_____sys_sendmsg+0x10/0x10 [ 538.558364][T21972] ? import_iovec+0x73/0xa0 [ 538.558390][T21972] ___sys_sendmsg+0x2a5/0x360 [ 538.558405][T21972] ? __lock_acquire+0x6b5/0x2cf0 [ 538.558427][T21972] ? __pfx____sys_sendmsg+0x10/0x10 [ 538.558478][T21972] ? __fget_files+0x2a/0x420 [ 538.558496][T21972] ? __fget_files+0x3a0/0x420 [ 538.558526][T21972] __x64_sys_sendmsg+0x1bd/0x2a0 [ 538.558545][T21972] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 538.558572][T21972] ? __pfx_ksys_write+0x10/0x10 [ 538.558602][T21972] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.558620][T21972] do_syscall_64+0x15f/0xf80 [ 538.558644][T21972] ? trace_irq_disable+0x3b/0x140 [ 538.558666][T21972] ? clear_bhb_loop+0x40/0x90 [ 538.558687][T21972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.558703][T21972] RIP: 0033:0x7ff7e1b9ce59 [ 538.558719][T21972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 538.558732][T21972] RSP: 002b:00007ff7e2a7e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 538.558749][T21972] RAX: ffffffffffffffda RBX: 00007ff7e1e15fa0 RCX: 00007ff7e1b9ce59 [ 538.558761][T21972] RDX: 0000000020004c04 RSI: 0000200000000080 RDI: 0000000000000003 [ 538.558772][T21972] RBP: 00007ff7e2a7e090 R08: 0000000000000000 R09: 0000000000000000 [ 538.558782][T21972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.558792][T21972] R13: 00007ff7e1e16038 R14: 00007ff7e1e15fa0 R15: 00007ffe0cdb7348 [ 538.558822][T21972] [ 538.943996][ T24] tipc: Node number set to 3458161712 [ 539.225785][T22010] __nla_validate_parse: 11 callbacks suppressed [ 539.225802][T22010] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4023'. [ 539.454749][T22025] netlink: 'syz.0.4028': attribute type 4 has an invalid length. [ 539.478078][T22025] netlink: 17 bytes leftover after parsing attributes in process `syz.0.4028'. [ 539.719655][T22030] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4029'. [ 540.487366][T22052] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4036'. [ 540.544265][T22055] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4037'. [ 540.580358][T22055] sctp: [Deprecated]: syz.0.4037 (pid 22055) Use of struct sctp_assoc_value in delayed_ack socket option. [ 540.580358][T22055] Use struct sctp_sack_info instead [ 540.750211][T22052] vlan0: left promiscuous mode [ 540.847625][T22056] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4036'. [ 540.874167][T22056] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4036'. [ 541.500017][T22080] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 541.534019][T22078] lo speed is unknown, defaulting to 1000 [ 541.534935][T22080] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 541.834966][T22090] syzkaller1: entered promiscuous mode [ 541.849204][T22090] syzkaller1: entered allmulticast mode [ 541.922950][T22092] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4049'. [ 541.953056][T22092] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4049'. [ 541.994291][T22092] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4049'. [ 542.006864][T16531] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.039321][T16531] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.064858][T16531] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.189576][T16531] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.329671][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 542.932605][T22095] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 543.184241][T22121] netlink: 'syz.2.4055': attribute type 1 has an invalid length. [ 543.410495][T22138] netlink: 'syz.2.4061': attribute type 1 has an invalid length. [ 543.534204][T22133] bond2: (slave geneve2): making interface the new active one [ 543.566557][T22133] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 543.835188][T22159] netlink: 'syz.2.4066': attribute type 1 has an invalid length. [ 543.910197][T22159] bond3: entered promiscuous mode [ 543.916268][T22159] 8021q: adding VLAN 0 to HW filter on device bond3 [ 544.408558][ T5627] Bluetooth: hci1: command 0x0406 tx timeout [ 545.083486][T22192] netpci0: tun_chr_ioctl cmd 1074025678 [ 545.089843][T22192] netpci0: group set to 0 [ 545.207722][T22197] can: request_module (can-proto-5) failed. [ 545.259728][T22200] netpci0: tun_chr_ioctl cmd 1074025673 [ 545.265509][T22192] netpci0: tun_chr_ioctl cmd 1074025678 [ 545.272803][T22192] netpci0: group set to 0 [ 545.542997][T22205] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 546.390316][T22141] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 546.555688][T22219] __nla_validate_parse: 8 callbacks suppressed [ 546.555705][T22219] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4080'. [ 546.584120][T22219] netlink: 580 bytes leftover after parsing attributes in process `syz.2.4080'. [ 546.653515][T22227] netlink: 'syz.1.4084': attribute type 1 has an invalid length. [ 546.777530][T22235] netlink: 71 bytes leftover after parsing attributes in process `syz.0.4085'. [ 546.824953][T22227] bond7: entered promiscuous mode [ 546.837587][T22227] 8021q: adding VLAN 0 to HW filter on device bond7 [ 546.899409][T22235] team0 (unregistering): Port device team_slave_0 removed [ 546.970897][T22247] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4086'. [ 547.066330][T22235] team0 (unregistering): Port device team_slave_1 removed [ 547.109753][T22236] bond7: (slave veth5): making interface the new active one [ 547.117360][T22236] veth5: entered promiscuous mode [ 547.134123][T22236] bond7: (slave veth5): Enslaving as an active interface with an up link [ 547.593541][T22267] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4094'. [ 547.737616][T22276] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 548.014066][T22291] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 548.342115][T22305] netlink: 'syz.3.4107': attribute type 1 has an invalid length. [ 548.352214][T22305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4107'. [ 548.592829][T22314] 8021q: VLANs not supported on vcan0 [ 548.781517][T22325] veth1: entered promiscuous mode [ 548.803333][T22325] veth1: entered allmulticast mode [ 548.824469][T22327] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4111'. [ 548.835524][T22327] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4111'. [ 548.880216][T22328] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4111'. [ 549.017900][T22335] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4116'. [ 549.067016][T22335] netlink: 'syz.3.4116': attribute type 1 has an invalid length. [ 549.194087][T22344] 8021q: adding VLAN 0 to HW filter on device bond6 [ 549.204285][T22344] bond5: (slave bond6): making interface the new active one [ 549.213297][T22344] bond5: (slave bond6): Enslaving as an active interface with an up link [ 549.292161][T22335] bond5: (slave gretap1): Enslaving as a backup interface with an up link [ 549.383581][T22360] Bluetooth: MGMT ver 1.23 [ 550.220249][T22393] team1: entered promiscuous mode [ 550.236738][T22393] team1: entered allmulticast mode [ 550.249107][T22393] 8021q: adding VLAN 0 to HW filter on device team1 [ 550.295052][T22402] IPVS: set_ctl: invalid protocol: 50 224.0.0.2:0 [ 550.431679][T22405] syzkaller1: entered promiscuous mode [ 550.449081][T22405] syzkaller1: entered allmulticast mode [ 551.005037][T22426] tipc: Enabled bearer , priority 0 [ 551.190000][T22426] syzkaller0: entered promiscuous mode [ 551.195541][T22426] syzkaller0: entered allmulticast mode [ 551.203361][T22426] tipc: Resetting bearer [ 551.271904][T22432] tipc: Resetting bearer [ 551.813602][ T5739] IPVS: starting estimator thread 0... [ 551.918969][T22464] IPVS: using max 31 ests per chain, 74400 per kthread [ 554.193767][T22432] tipc: Disabling bearer [ 554.254719][T22460] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 554.298951][ T5739] tipc: Node number set to 1084791613 [ 554.330808][T22473] __nla_validate_parse: 11 callbacks suppressed [ 554.330826][T22473] netlink: 164 bytes leftover after parsing attributes in process `syz.0.4153'. [ 554.393432][T22475] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.4155'. [ 554.456893][T22481] netlink: 'syz.4.4156': attribute type 13 has an invalid length. [ 554.469531][T22481] netlink: 'syz.4.4156': attribute type 17 has an invalid length. [ 554.589369][T22490] block nbd0: not configured, cannot reconfigure [ 554.613978][T22493] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4162'. [ 554.665546][T22497] netlink: 'syz.2.4161': attribute type 1 has an invalid length. [ 554.680207][T22497] netlink: 'syz.2.4161': attribute type 1 has an invalid length. [ 554.692376][T22481] 8021q: adding VLAN 0 to HW filter on device bond0 [ 554.703748][T22481] 8021q: adding VLAN 0 to HW filter on device team0 [ 554.720700][T22502] netlink: 'syz.3.4162': attribute type 7 has an invalid length. [ 554.737085][T22502] netlink: 'syz.3.4162': attribute type 8 has an invalid length. [ 554.746611][T22502] netlink: 'syz.3.4162': attribute type 8 has an invalid length. [ 554.757057][T22502] netlink: 'syz.3.4162': attribute type 4 has an invalid length. [ 554.768578][T22481] veth1: left promiscuous mode [ 554.775192][T22481] veth1: left allmulticast mode [ 554.783291][T22502] netlink: 'syz.3.4162': attribute type 7 has an invalid length. [ 554.796710][T22502] netlink: 207236 bytes leftover after parsing attributes in process `syz.3.4162'. [ 554.912525][T22481] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 554.936464][T22481] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 554.975029][T22481] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 554.987055][T22519] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4166'. [ 555.072160][T22503] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 555.086571][T22503] syzkaller1: linktype set to 260 [ 555.143990][T22519] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4166'. [ 555.409709][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807b625400: rx timeout, send abort [ 555.423250][T22539] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4169'. [ 555.701895][T22552] netlink: 'syz.4.4172': attribute type 3 has an invalid length. [ 555.741963][T22552] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 555.798983][T22555] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4174'. [ 555.893565][T22559] gretap0: entered promiscuous mode [ 555.909824][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807b627800: rx timeout, send abort [ 555.911334][T22559] vlan2: entered promiscuous mode [ 555.920317][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807b625400: abort rx timeout. Force session deactivation [ 555.997223][T22566] xt_hashlimit: size too large, truncated to 1048576 [ 556.186029][T22574] IPVS: set_ctl: invalid protocol: 50 0.0.0.0:20003 [ 556.419452][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807b627800: abort rx timeout. Force session deactivation [ 556.558132][T22605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4187'. [ 556.672557][T22605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4187'. [ 556.687965][T22618] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 557.337324][T22665] veth1_vlan: left promiscuous mode [ 557.343817][T22665] veth0_vlan: left promiscuous mode [ 557.351198][T22665] veth0_vlan: entered promiscuous mode [ 557.361895][T22665] veth1_vlan: entered promiscuous mode [ 557.374073][T22665] veth0_macvtap: left promiscuous mode [ 557.380951][T22665] veth0_macvtap: entered promiscuous mode [ 557.387944][T22665] veth1_macvtap: entered promiscuous mode [ 557.399049][T22665] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 557.432165][ T139] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.449377][ T139] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.465088][ T139] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.475399][ T139] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 557.722723][T16531] bridge_slave_1: left allmulticast mode [ 557.741713][T16531] bridge_slave_1: left promiscuous mode [ 557.758666][T16531] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.801854][T16531] bridge_slave_0: left allmulticast mode [ 557.814154][T16531] bridge_slave_0: left promiscuous mode [ 557.820957][T16531] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.828115][T22689] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 557.891754][T16531] bond5: left allmulticast mode [ 558.123790][T16531] erspan0 (unregistering): left promiscuous mode [ 558.243437][T16531] bond6 (unregistering): (slave gretap1): Releasing active interface [ 558.383013][T16531] bond3 (unregistering): (slave bridge2): Releasing backup interface [ 558.391506][T16531] bridge2 (unregistering): left promiscuous mode [ 558.708854][T16531] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 558.717758][T16531] bond_slave_0: left allmulticast mode [ 558.725284][T16531] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 558.736118][T16531] bond_slave_1: left allmulticast mode [ 558.746882][T16531] bond0 (unregistering): Released all slaves [ 558.758896][T16531] bond1 (unregistering): (slave veth3): Releasing backup interface [ 558.768219][T16531] bond1 (unregistering): (slave batadv1): Releasing backup interface [ 558.777387][T16531] bond1 (unregistering): Released all slaves [ 558.792408][T16531] bond2 (unregistering): (slave lo): Releasing backup interface [ 558.804550][T16531] bond2 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 558.817840][T16531] bond2 (unregistering): Released all slaves [ 558.832218][T16531] bond3 (unregistering): Released all slaves [ 558.846234][T16531] bond4 (unregistering): Released all slaves [ 558.861147][T16531] bond5 (unregistering): Released all slaves [ 558.875343][T16531] bond6 (unregistering): Released all slaves [ 558.902039][T16531] bond7 (unregistering): Released all slaves [ 558.917293][T16531] bond8 (unregistering): Released all slaves [ 558.932777][T16531] bond9 (unregistering): Released all slaves [ 559.038064][T16531] tipc: Left network mode [ 559.659502][T22616] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 559.867278][T16531] hsr_slave_0: left promiscuous mode [ 559.879398][T16531] hsr_slave_1: left promiscuous mode [ 559.901096][T16531] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 559.930642][T16531] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 560.017983][T22727] __nla_validate_parse: 6 callbacks suppressed [ 560.018001][T22727] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4217'. [ 560.085553][T22732] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4217'. [ 560.477117][T16531] team_slave_1 (unregistering): left promiscuous mode [ 560.485262][T16531] team0 (unregistering): Port device team_slave_1 removed [ 560.625224][T22717] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 560.647739][T22722] netlink: 'syz.2.4215': attribute type 5 has an invalid length. [ 560.670910][T22724] bridge0: port 1(team0) entered disabled state [ 560.692266][T22724] team0 (unregistering): left allmulticast mode [ 560.704063][T22724] team_slave_1: left allmulticast mode [ 560.714365][T22724] team0 (unregistering): left promiscuous mode [ 560.730168][T22724] team_slave_1: left promiscuous mode [ 560.740468][T22724] bridge0: port 1(team0) entered disabled state [ 560.773785][T22724] team0 (unregistering): Port device team_slave_1 removed [ 560.790310][T22724] team0 (unregistering): Port device bridge5 removed [ 560.866784][T22727] team1: entered promiscuous mode [ 560.878503][T22727] team1: entered allmulticast mode [ 560.892095][T22727] 8021q: adding VLAN 0 to HW filter on device team1 [ 560.942822][T22732] team2: entered promiscuous mode [ 560.947975][T22732] team2: entered allmulticast mode [ 560.954075][T22732] 8021q: adding VLAN 0 to HW filter on device team2 [ 560.988975][T22748] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4212'. [ 561.142713][T22765] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4222'. [ 561.349278][T22772] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4227'. [ 561.442900][T22780] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4229'. [ 561.492762][T22780] ip6tnl2: entered promiscuous mode [ 561.525372][T16531] IPVS: stop unused estimator thread 0... [ 561.567492][T22783] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4227'. [ 561.630420][T22792] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4227'. [ 561.816560][ T29] audit: type=1804 audit(1778989547.812:12): pid=22802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4233" name="/newroot/246/memory.events" dev="tmpfs" ino=1283 res=1 errno=0 [ 561.843072][T22799] syzkaller0: entered promiscuous mode [ 561.885603][T22799] syzkaller0: entered allmulticast mode [ 561.905136][ T29] audit: type=1800 audit(1778989547.812:13): pid=22802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4233" name="memory.events" dev="tmpfs" ino=1283 res=0 errno=0 [ 561.970509][T22799] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4232'. [ 562.177230][T22813] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.4234'. [ 562.235549][T22815] geneve2: entered promiscuous mode [ 562.322825][T22814] lo speed is unknown, defaulting to 1000 [ 562.957450][T22816] lo speed is unknown, defaulting to 1000 [ 563.336736][T22844] netlink: 'syz.2.4244': attribute type 1 has an invalid length. [ 563.567839][T22844] bond4: entered promiscuous mode [ 563.598508][T22844] bond4: entered allmulticast mode [ 563.633948][T22844] 8021q: adding VLAN 0 to HW filter on device bond4 [ 563.701565][T22845] macvlan2: entered promiscuous mode [ 563.720333][T22845] macvlan2: entered allmulticast mode [ 563.735108][T22845] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 564.622208][T22876] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 564.668156][ T5731] team_slave_0: entered promiscuous mode [ 564.675936][ T5731] team_slave_1: entered promiscuous mode [ 564.713821][T22890] pimreg9: entered allmulticast mode [ 564.735926][T22887] lo speed is unknown, defaulting to 1000 [ 565.239804][T22902] netlink: 'syz.0.4258': attribute type 1 has an invalid length. [ 565.326833][T22907] __nla_validate_parse: 4 callbacks suppressed [ 565.326849][T22907] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4260'. [ 565.346174][T22906] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4261'. [ 565.357348][T22902] 8021q: adding VLAN 0 to HW filter on device bond4 [ 565.378933][T22899] vlan1: entered allmulticast mode [ 565.384060][T22899] bond4: entered allmulticast mode [ 565.404694][T22906] 8021q: adding VLAN 0 to HW filter on device bond4 [ 565.422432][T22902] bond4: (slave geneve2): making interface the new active one [ 565.431521][T22902] geneve2: entered allmulticast mode [ 565.439009][T22902] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 565.456282][T22894] lo speed is unknown, defaulting to 1000 [ 565.468773][T22911] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4261'. [ 565.484514][T22907] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4260'. [ 565.500909][T22906] 8021q: adding VLAN 0 to HW filter on device bond4 [ 565.511022][T22906] bond4: (slave vti0): The slave device specified does not support setting the MAC address [ 565.531002][T22906] bond4: (slave vti0): Error -95 calling set_mac_address [ 565.723573][T22915] netlink: 'syz.0.4264': attribute type 13 has an invalid length. [ 565.749565][T22918] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 565.780482][T22915] hsr0: left promiscuous mode [ 565.823061][T22918] sch_tbf: burst 3 is lower than device ip6tnl0 mtu (1452) ! [ 566.286349][T22919] lo speed is unknown, defaulting to 1000 [ 566.430571][T22933] xt_l2tp: v2 sid > 0xffff: 8388608 [ 566.502561][T22931] tipc: Started in network mode [ 566.517935][T22931] tipc: Node identity 080211000001, cluster identity 4711 [ 566.527496][T22931] tipc: Enabled bearer , priority 0 [ 566.544142][T22931] mac80211_hwsim hwsim51 syzkaller0: entered promiscuous mode [ 566.552039][T22931] mac80211_hwsim hwsim51 syzkaller0: entered allmulticast mode [ 566.612396][T22931] veth5: entered promiscuous mode [ 567.317280][T22951] FAULT_INJECTION: forcing a failure. [ 567.317280][T22951] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 567.336647][T22951] CPU: 0 UID: 0 PID: 22951 Comm: syz.1.4274 Not tainted syzkaller #0 PREEMPT(full) [ 567.336671][T22951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 567.336681][T22951] Call Trace: [ 567.336688][T22951] [ 567.336695][T22951] dump_stack_lvl+0xe8/0x150 [ 567.336719][T22951] should_fail_ex+0x412/0x560 [ 567.336744][T22951] _copy_to_user+0x31/0xb0 [ 567.336769][T22951] simple_read_from_buffer+0xe1/0x170 [ 567.336793][T22951] proc_fail_nth_read+0x1bb/0x230 [ 567.336808][T22951] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 567.336821][T22951] ? rw_verify_area+0x2a6/0x4d0 [ 567.336833][T22951] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 567.336845][T22951] vfs_read+0x20c/0xa70 [ 567.336861][T22951] ? __pfx___mutex_lock+0x10/0x10 [ 567.336871][T22951] ? __pfx_vfs_read+0x10/0x10 [ 567.336884][T22951] ? __fget_files+0x2a/0x420 [ 567.336897][T22951] ? __fget_files+0x3a0/0x420 [ 567.336906][T22951] ? __fget_files+0x2a/0x420 [ 567.336921][T22951] ksys_read+0x150/0x270 [ 567.336934][T22951] ? __pfx_ksys_read+0x10/0x10 [ 567.336951][T22951] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.336961][T22951] do_syscall_64+0x15f/0xf80 [ 567.336974][T22951] ? trace_irq_disable+0x3b/0x140 [ 567.336987][T22951] ? clear_bhb_loop+0x40/0x90 [ 567.336998][T22951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.337007][T22951] RIP: 0033:0x7f19d515d68e [ 567.337018][T22951] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 567.337027][T22951] RSP: 002b:00007f19d6124fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 567.337037][T22951] RAX: ffffffffffffffda RBX: 00007f19d61256c0 RCX: 00007f19d515d68e [ 567.337044][T22951] RDX: 000000000000000f RSI: 00007f19d61250a0 RDI: 0000000000000006 [ 567.337049][T22951] RBP: 00007f19d6125090 R08: 0000000000000000 R09: 0000000000000000 [ 567.337054][T22951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 567.337060][T22951] R13: 00007f19d5416038 R14: 00007f19d5415fa0 R15: 00007ffc8f960558 [ 567.337076][T22951] [ 567.586269][ T24] tipc: Node number set to 134418688 [ 567.752882][T22957] erspan0: entered promiscuous mode [ 567.816129][T22956] erspan0: left promiscuous mode [ 567.953595][T16525] vlan0: left allmulticast mode [ 567.966499][T16525] bridge_slave_1: left allmulticast mode [ 567.977762][T16525] vlan0: left promiscuous mode [ 567.983649][T16525] bridge_slave_1: left promiscuous mode [ 567.989983][T16525] bridge0: port 1(vlan0) entered disabled state [ 568.045240][T22973] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 568.080879][T22972] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4280'. [ 568.263730][T22981] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4282'. [ 568.370277][T22984] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4282'. [ 569.230807][T16525] bond3 (unregistering): (slave gretap2): Releasing active interface [ 569.260556][T16525] bond7 (unregistering): (slave gretap3): Releasing active interface [ 569.290879][T16525] bond8 (unregistering): (slave ipip0): Releasing backup interface [ 569.299148][T16525] ipip0 (unregistering): left promiscuous mode [ 569.326946][T16525] bond14 (unregistering): (slave geneve2): Releasing active interface [ 569.409359][ T5633] Bluetooth: hci4: link tx timeout [ 569.414652][ T5633] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 569.437372][T16525] bond3 (unregistering): (slave bridge1): Releasing active interface [ 569.604608][T16525] bond5 (unregistering): (slave bridge4): Removing an active aggregator [ 569.618511][T16525] bond5 (unregistering): (slave bridge4): Releasing backup interface [ 569.626639][T16525] bond5 (unregistering): (slave bridge4): the permanent HWaddr of slave - d6:a0:bd:38:d4:95 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 569.686786][T16525] bond5 (unregistering): (slave bridge5): Releasing backup interface [ 570.002886][T16525] bond0 (unregistering): Released all slaves [ 570.014140][T16525] bond1 (unregistering): Released all slaves [ 570.027841][T16525] bond2 (unregistering): Released all slaves [ 570.046108][T16525] bond3 (unregistering): Released all slaves [ 570.059435][T16525] bond4 (unregistering): Released all slaves [ 570.073404][T16525] bond5 (unregistering): Released all slaves [ 570.086745][T16525] bond6 (unregistering): Released all slaves [ 570.114121][T16525] bond7 (unregistering): Released all slaves [ 570.127731][T16525] bond8 (unregistering): Released all slaves [ 570.142235][T16525] bond9 (unregistering): Released all slaves [ 570.164197][T16525] bond10 (unregistering): (slave bond11): Releasing backup interface [ 570.176204][T16525] bond10 (unregistering): Released all slaves [ 570.191103][T16525] bond11 (unregistering): Released all slaves [ 570.205845][T16525] bond12 (unregistering): (slave veth3): Releasing backup interface [ 570.222882][T16525] bond12 (unregistering): Released all slaves [ 570.240748][T16525] bond13 (unregistering): Released all slaves [ 570.257518][T16525] bond14 (unregistering): Released all slaves [ 570.271817][T16525] bond15 (unregistering): Released all slaves [ 570.288933][T16525] bond16 (unregistering): (slave bond17): Releasing backup interface [ 570.297717][T16525] bond16 (unregistering): Released all slaves [ 570.312716][T16525] bond17 (unregistering): Released all slaves [ 570.334067][T22981] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 570.347078][T22983] bond5 (unregistering): Released all slaves [ 570.551656][T16525] tipc: Left network mode [ 570.699660][T16525] IPVS: stopping backup sync thread 9494 ... [ 570.847582][T23010] syzkaller0: entered promiscuous mode [ 570.853750][T23010] syzkaller0: entered allmulticast mode [ 571.292957][T23033] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4295'. [ 571.310429][T23033] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4295'. [ 571.316558][T23028] syzkaller1: entered promiscuous mode [ 571.352897][T23035] netlink: 'syz.3.4295': attribute type 2 has an invalid length. [ 571.358226][T23028] syzkaller1: entered allmulticast mode [ 571.380405][T23035] netlink: 'syz.3.4295': attribute type 1 has an invalid length. [ 571.389196][T23035] netlink: 108 bytes leftover after parsing attributes in process `syz.3.4295'. [ 571.399611][T23028] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 571.451832][ T5633] Bluetooth: hci4: command 0x0405 tx timeout [ 571.885885][T23058] xt_CT: No such helper "netbios-ns" [ 572.052012][T23076] netlink: 'syz.1.4306': attribute type 1 has an invalid length. [ 572.173731][T23076] 8021q: adding VLAN 0 to HW filter on device bond8 [ 572.296780][T23093] netlink: 100 bytes leftover after parsing attributes in process `syz.3.4309'. [ 572.310284][T23083] bond8: (slave veth11): Enslaving as an active interface with a down link [ 572.374895][T23087] bond8: (slave dummy0): making interface the new active one [ 572.401604][T23087] dummy0: entered promiscuous mode [ 572.426742][T23087] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 572.467672][T23102] netlink: 'syz.4.4311': attribute type 58 has an invalid length. [ 572.478180][T23102] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4311'. [ 572.551140][T23106] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4313'. [ 572.760280][T23122] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4314'. [ 572.910609][T23127] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4316'. [ 573.022259][T23135] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 573.180092][T23141] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4318'. [ 573.303314][T16525] hsr_slave_0: left promiscuous mode [ 573.626772][T16525] hsr_slave_1: left promiscuous mode [ 573.640367][T16525] batman_adv: batadv0: Interface deactivated: dummy0 [ 573.651993][T16525] batman_adv: batadv0: Removing interface: dummy0 [ 574.454166][T23197] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4327'. [ 574.891211][T23222] xt_hashlimit: overflow, try lower: 18446744073709551615/32 [ 575.128424][ T5633] Bluetooth: hci2: command 0x0405 tx timeout [ 575.335973][T16532] smc: removing ib device syz0 [ 575.369859][T16532] smbdirect: ib_dev[syz0] removed [ 575.395841][T23174] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 575.411729][ T24] lo speed is unknown, defaulting to 1000 [ 575.419469][T23174] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 575.432027][ T24] syz0: Port: 1 Link DOWN [ 575.452721][T23174] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 576.694945][T23273] netlink: 'syz.1.4343': attribute type 9 has an invalid length. [ 576.722290][T23272] netlink: 'syz.3.4342': attribute type 1 has an invalid length. [ 577.009292][T23278] __nla_validate_parse: 4 callbacks suppressed [ 577.009308][T23278] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4344'. [ 577.361061][T23295] netlink: 'syz.2.4349': attribute type 21 has an invalid length. [ 577.377867][T23278] : entered promiscuous mode [ 577.410674][T23295] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4349'. [ 577.594803][T23292] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4348'. [ 577.653521][T23307] netlink: 'syz.3.4350': attribute type 4 has an invalid length. [ 577.680572][T23295] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4349'. [ 577.690319][T23307] netlink: 'syz.3.4350': attribute type 8 has an invalid length. [ 577.714570][T23307] netlink: 'syz.3.4350': attribute type 1 has an invalid length. [ 577.734553][T23307] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4350'. [ 577.770997][T23307] NCSI netlink: No device for ifindex 0 [ 577.814481][T23300] syzkaller1: entered promiscuous mode [ 577.828307][T23300] syzkaller1: entered allmulticast mode [ 578.170471][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 578.381525][T23338] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4347'. [ 578.492017][T16525] IPVS: stop unused estimator thread 0... [ 578.902411][T23357] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 578.944204][T23362] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 578.961499][T23361] netlink: 14 bytes leftover after parsing attributes in process `syz.2.4359'. [ 579.142434][T23361] bond0 (unregistering): Released all slaves [ 579.246868][T23376] pim6reg1: entered promiscuous mode [ 579.279704][T23372] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4362'. [ 579.295541][T23376] pim6reg1: entered allmulticast mode [ 579.319414][T23372] xt_TCPMSS: Only works on TCP SYN packets [ 579.414730][T23373] bond3: left allmulticast mode [ 579.425949][T23383] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4364'. [ 579.438462][T23373] bond3: left promiscuous mode [ 579.455323][T23373] bridge0: port 1(bond3) entered disabled state [ 579.686794][T23386] erspan1: entered promiscuous mode [ 579.709587][T23403] ipt_REJECT: TCP_RESET invalid for non-tcp [ 579.717215][T23386] erspan1: entered allmulticast mode [ 579.749322][T23397] netlink: 'syz.3.4367': attribute type 12 has an invalid length. [ 579.954611][T23407] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4370'. [ 580.311184][T23394] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 580.424386][T23433] syzkaller0: entered promiscuous mode [ 580.433712][T23433] syzkaller0: entered allmulticast mode [ 580.875577][T23455] netlink: 'syz.3.4376': attribute type 1 has an invalid length. [ 581.290962][T23433] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 581.486920][T23472] netlink: 'syz.4.4380': attribute type 32 has an invalid length. [ 581.535256][T23475] tipc: Enabled bearer , priority 26 [ 581.791532][ T29] audit: type=1804 audit(1778989567.782:14): pid=23486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4387" name="/newroot/270/memory.events" dev="tmpfs" ino=1401 res=1 errno=0 [ 581.843409][T23486] bond5: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 581.865544][ T29] audit: type=1800 audit(1778989567.782:15): pid=23486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4387" name="memory.events" dev="tmpfs" ino=1401 res=0 errno=0 [ 581.892213][T23486] bond5 (unregistering): Released all slaves [ 582.061887][T23506] netlink: 'syz.2.4393': attribute type 11 has an invalid length. [ 582.294537][T23517] syzkaller0: entered promiscuous mode [ 582.308483][T23517] syzkaller0: entered allmulticast mode [ 582.806155][T23548] tipc: Enabled bearer , priority 0 [ 582.837149][T23548] syzkaller0: entered promiscuous mode [ 582.847043][T23552] __nla_validate_parse: 5 callbacks suppressed [ 582.847059][T23552] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4402'. [ 582.850755][T23548] syzkaller0: entered allmulticast mode [ 582.902879][T23548] tipc: Resetting bearer [ 582.991777][T23549] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4401'. [ 583.623911][T23546] tipc: Resetting bearer [ 583.756333][T23581] netlink: 'syz.3.4407': attribute type 1 has an invalid length. [ 583.956551][T23574] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4407'. [ 583.969585][T23546] tipc: Disabling bearer [ 584.091826][T23582] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4409'. [ 584.114497][T23582] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4409'. [ 584.133442][T23582] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 584.166606][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 584.181158][T23597] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4413'. [ 584.299761][T23607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4415'. [ 584.299880][T23584] bond7 (unregistering): Released all slaves [ 584.343584][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 584.361050][T23610] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4416'. [ 584.373674][T16525] dummy0: left promiscuous mode [ 584.392607][T23597] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4413'. [ 584.462275][T23610] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 584.492138][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 584.503894][T23597] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4413'. [ 584.544660][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 584.587622][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 584.658208][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 584.684390][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 584.716203][T23597] netlink: 'syz.4.4413': attribute type 13 has an invalid length. [ 585.330538][T23653] bond5: entered promiscuous mode [ 585.336258][T23653] 8021q: adding VLAN 0 to HW filter on device bond5 [ 585.375519][T23653] vlan4: entered allmulticast mode [ 585.381561][T23653] bond5: entered allmulticast mode [ 585.406079][T23653] bond5: (slave bridge0): making interface the new active one [ 585.419453][T23653] bridge0: entered promiscuous mode [ 585.424954][T23653] bridge0: entered allmulticast mode [ 585.432873][T23653] bond5: (slave bridge0): Enslaving as an active interface with an up link [ 585.715456][T23669] tipc: Enabled bearer , priority 26 [ 586.495308][T23720] hmac(sh: entered promiscuous mode [ 586.681320][T23733] openvswitch: netlink: Flow key attr not present in new flow. [ 587.109352][T23763] SET target dimension over the limit! [ 587.116953][T23763] sock: sock_timestamping_bind_phc: sock not bind to device [ 587.191936][T23766] veth0_macvtap: left promiscuous mode [ 587.430004][T23772] validate_nla: 31 callbacks suppressed [ 587.430040][T23772] netlink: 'syz.0.4464': attribute type 2 has an invalid length. [ 587.535218][T23780] bridge0: port 1(veth1_virt_wifi) entered blocking state [ 587.563041][T23780] bridge0: port 1(veth1_virt_wifi) entered disabled state [ 587.592568][T23780] veth1_virt_wifi: entered allmulticast mode [ 587.601720][T23781] netlink: 'syz.0.4464': attribute type 10 has an invalid length. [ 587.652050][T23780] veth1_virt_wifi: entered promiscuous mode [ 588.173401][T23805] netlink: 'syz.0.4474': attribute type 106 has an invalid length. [ 588.690953][T23827] __nla_validate_parse: 41 callbacks suppressed [ 588.690988][T23827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4482'. [ 589.198868][T23850] sctp: [Deprecated]: syz.3.4487 (pid 23850) Use of struct sctp_assoc_value in delayed_ack socket option. [ 589.198868][T23850] Use struct sctp_sack_info instead [ 589.227390][T23850] sctp: [Deprecated]: syz.3.4487 (pid 23850) Use of struct sctp_assoc_value in delayed_ack socket option. [ 589.227390][T23850] Use struct sctp_sack_info instead [ 589.418031][T23851] syzkaller1: entered promiscuous mode [ 589.515362][T23851] syzkaller1: entered allmulticast mode [ 589.684980][T23865] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4489'. [ 589.730212][T23864] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4490'. [ 589.915632][T23877] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4492'. [ 589.938105][T23877] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4492'. [ 590.283613][T23896] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 590.322734][T23900] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4497'. [ 590.346141][T23900] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4497'. [ 590.362865][T23900] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4497'. [ 590.373849][T23900] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4497'. [ 590.496885][T23910] vxcan0: tx address claim with dest, not broadcast [ 590.602173][T23869] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 591.081352][T23928] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4503'. [ 591.223837][T23936] x_tables: duplicate underflow at hook 2 [ 591.274953][T23925] syzkaller1: entered promiscuous mode [ 591.314072][T23925] syzkaller1: entered allmulticast mode [ 591.557134][T23945] ip6gre1: entered promiscuous mode [ 591.588257][T23945] ip6gre1: entered allmulticast mode [ 591.630704][T23949] netlink: 'syz.0.4506': attribute type 6 has an invalid length. [ 592.207661][T23958] nbd: device at index 64 is going down [ 592.525540][T23874] udevd[23874]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 592.596400][T23968] udevd[23968]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 592.680353][T23964] bridge0: port 2(bridge_slave_1) entered disabled state [ 592.688790][T23964] bridge0: port 1(bridge_slave_0) entered disabled state [ 592.815498][T23988] netlink: 'syz.2.4515': attribute type 1 has an invalid length. [ 592.973747][T23964] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 592.990650][T23964] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 593.730694][T24010] --map-set only usable from mangle table [ 593.803943][T23983] ip6gre1: left allmulticast mode [ 593.823753][T23983] ip6gre2: left promiscuous mode [ 593.836759][T23983] ip6gre2: left allmulticast mode [ 593.854980][T23983] bond3: left promiscuous mode [ 593.874877][T23983] bond4: left promiscuous mode [ 593.888631][T23983] bond4: left allmulticast mode [ 593.952208][T23993] gretap1: entered allmulticast mode [ 593.962787][T23993] bond0: (slave gretap1): making interface the new active one [ 593.975453][T23993] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 593.994048][T16530] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.043931][T16530] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.101405][T16530] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.125164][T16530] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.152782][T16530] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.187853][T16530] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.199062][T24024] __nla_validate_parse: 5 callbacks suppressed [ 594.199095][T24024] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4525'. [ 594.211823][T24026] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4522'. [ 594.227005][T16532] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.241139][T16532] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.301470][T24023] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 594.341058][T24024] FAULT_INJECTION: forcing a failure. [ 594.341058][T24024] name failslab, interval 1, probability 0, space 0, times 0 [ 594.380901][T24024] CPU: 0 UID: 0 PID: 24024 Comm: syz.1.4525 Not tainted syzkaller #0 PREEMPT(full) [ 594.380926][T24024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 594.380935][T24024] Call Trace: [ 594.380942][T24024] [ 594.380949][T24024] dump_stack_lvl+0xe8/0x150 [ 594.380973][T24024] should_fail_ex+0x412/0x560 [ 594.380997][T24024] should_failslab+0xa8/0x100 [ 594.381024][T24024] __kmalloc_cache_noprof+0x88/0x660 [ 594.381046][T24024] ? __ipv6_dev_mc_inc+0x44f/0xa50 [ 594.381069][T24024] __ipv6_dev_mc_inc+0x44f/0xa50 [ 594.381096][T24024] __ipv6_sock_mc_join+0x503/0x750 [ 594.381130][T24024] inet6_addr_add+0x3cf/0xb20 [ 594.381163][T24024] inet6_rtm_newaddr+0xa17/0xe30 [ 594.381192][T24024] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 594.381210][T24024] ? __dev_queue_xmit+0x2b6/0x3950 [ 594.381235][T24024] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 594.381273][T24024] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 594.381292][T24024] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 594.381317][T24024] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 594.381337][T24024] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 594.381356][T24024] ? ref_tracker_free+0x693/0x840 [ 594.381380][T24024] ? __pfx_ref_tracker_free+0x10/0x10 [ 594.381411][T24024] netlink_rcv_skb+0x232/0x4b0 [ 594.381428][T24024] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 594.381452][T24024] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 594.381481][T24024] ? netlink_deliver_tap+0x2e/0x1b0 [ 594.381495][T24024] ? netlink_deliver_tap+0x2e/0x1b0 [ 594.381517][T24024] netlink_unicast+0x75c/0x8e0 [ 594.381550][T24024] netlink_sendmsg+0x813/0xb40 [ 594.381577][T24024] ? __pfx_netlink_sendmsg+0x10/0x10 [ 594.381596][T24024] ? aa_sock_msg_perm+0xf1/0x1b0 [ 594.381619][T24024] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 594.381642][T24024] ____sys_sendmsg+0x972/0x9f0 [ 594.381658][T24024] ? __might_fault+0xaf/0x130 [ 594.381682][T24024] ? __pfx_____sys_sendmsg+0x10/0x10 [ 594.381708][T24024] ? import_iovec+0x73/0xa0 [ 594.381733][T24024] ___sys_sendmsg+0x2a5/0x360 [ 594.381748][T24024] ? __lock_acquire+0x6b5/0x2cf0 [ 594.381770][T24024] ? __pfx____sys_sendmsg+0x10/0x10 [ 594.381820][T24024] ? __fget_files+0x2a/0x420 [ 594.381838][T24024] ? __fget_files+0x3a0/0x420 [ 594.381866][T24024] __x64_sys_sendmsg+0x1bd/0x2a0 [ 594.381894][T24024] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 594.381919][T24024] ? __pfx_ksys_write+0x10/0x10 [ 594.381939][T24024] ? handle_softirqs+0x715/0x840 [ 594.381964][T24024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.381981][T24024] do_syscall_64+0x15f/0xf80 [ 594.382013][T24024] ? clear_bhb_loop+0x40/0x90 [ 594.382033][T24024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.382048][T24024] RIP: 0033:0x7f19d519ce59 [ 594.382064][T24024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 594.382077][T24024] RSP: 002b:00007f19d6125028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 594.382094][T24024] RAX: ffffffffffffffda RBX: 00007f19d5415fa0 RCX: 00007f19d519ce59 [ 594.382105][T24024] RDX: 0000000020004c04 RSI: 0000200000000080 RDI: 0000000000000003 [ 594.382115][T24024] RBP: 00007f19d6125090 R08: 0000000000000000 R09: 0000000000000000 [ 594.382123][T24024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 594.382132][T24024] R13: 00007f19d5416038 R14: 00007f19d5415fa0 R15: 00007ffc8f960558 [ 594.382161][T24024] [ 594.387543][T24032] netlink: 'syz.3.4527': attribute type 1 has an invalid length. [ 594.395010][T16532] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.483552][T24035] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4527'. [ 594.579979][T16532] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.797535][T16532] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.814173][T16532] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.845264][T24045] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4529'. [ 595.220339][T24061] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4532'. [ 595.332045][T24060] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4535'. [ 595.432816][T24074] netlink: 'syz.3.4538': attribute type 1 has an invalid length. [ 595.447849][T24071] tipc: Enabled bearer , priority 0 [ 595.527489][T24074] bond7: entered promiscuous mode [ 595.533511][T24074] bond7: entered allmulticast mode [ 595.540541][T24074] 8021q: adding VLAN 0 to HW filter on device bond7 [ 595.549459][T24071] syzkaller0: entered promiscuous mode [ 595.581551][T24071] syzkaller0: entered allmulticast mode [ 595.593522][T24080] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4539'. [ 595.610406][T24077] erspan1: entered allmulticast mode [ 595.620123][T24077] bond7: (slave erspan1): making interface the new active one [ 595.627750][T24077] erspan1: entered promiscuous mode [ 595.639314][T24077] bond7: (slave erspan1): Enslaving as an active interface with an up link [ 595.653768][T24080] FAULT_INJECTION: forcing a failure. [ 595.653768][T24080] name failslab, interval 1, probability 0, space 0, times 0 [ 595.670645][T24080] CPU: 0 UID: 0 PID: 24080 Comm: syz.2.4539 Not tainted syzkaller #0 PREEMPT(full) [ 595.670665][T24080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 595.670673][T24080] Call Trace: [ 595.670679][T24080] [ 595.670686][T24080] dump_stack_lvl+0xe8/0x150 [ 595.670711][T24080] should_fail_ex+0x412/0x560 [ 595.670739][T24080] should_failslab+0xa8/0x100 [ 595.670764][T24080] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 595.670787][T24080] ? __alloc_skb+0x1d0/0x7d0 [ 595.670817][T24080] ? __local_bh_enable_ip+0xd0/0x130 [ 595.670839][T24080] __alloc_skb+0x1d0/0x7d0 [ 595.670863][T24080] inet6_ifmcaddr_notify+0xfa/0x1e0 [ 595.670882][T24080] ? __pfx_inet6_ifmcaddr_notify+0x10/0x10 [ 595.670899][T24080] ? mld_del_delrec+0x35f/0xcd0 [ 595.670923][T24080] __ipv6_dev_mc_inc+0x8a9/0xa50 [ 595.670952][T24080] __ipv6_sock_mc_join+0x503/0x750 [ 595.670987][T24080] inet6_addr_add+0x3cf/0xb20 [ 595.671020][T24080] inet6_rtm_newaddr+0xa17/0xe30 [ 595.671050][T24080] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 595.671077][T24080] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 595.671111][T24080] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 595.671129][T24080] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 595.671145][T24080] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 595.671164][T24080] ? netlink_sendmsg+0x5d4/0xb40 [ 595.671178][T24080] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 595.671196][T24080] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 595.671214][T24080] ? __lock_acquire+0x6b5/0x2cf0 [ 595.671241][T24080] netlink_rcv_skb+0x232/0x4b0 [ 595.671256][T24080] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 595.671276][T24080] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 595.671303][T24080] ? netlink_deliver_tap+0x2e/0x1b0 [ 595.671317][T24080] ? netlink_deliver_tap+0x2e/0x1b0 [ 595.671336][T24080] netlink_unicast+0x75c/0x8e0 [ 595.671366][T24080] netlink_sendmsg+0x813/0xb40 [ 595.671389][T24080] ? __pfx_netlink_sendmsg+0x10/0x10 [ 595.671408][T24080] ? aa_sock_msg_perm+0xf1/0x1b0 [ 595.671431][T24080] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 595.671452][T24080] ____sys_sendmsg+0x972/0x9f0 [ 595.671467][T24080] ? __might_fault+0xaf/0x130 [ 595.671490][T24080] ? __pfx_____sys_sendmsg+0x10/0x10 [ 595.671510][T24080] ? import_iovec+0x73/0xa0 [ 595.671534][T24080] ___sys_sendmsg+0x2a5/0x360 [ 595.671545][T24080] ? __lock_acquire+0x6b5/0x2cf0 [ 595.671565][T24080] ? __pfx____sys_sendmsg+0x10/0x10 [ 595.671608][T24080] ? __fget_files+0x2a/0x420 [ 595.671626][T24080] ? __fget_files+0x3a0/0x420 [ 595.671653][T24080] __x64_sys_sendmsg+0x1bd/0x2a0 [ 595.671669][T24080] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 595.671693][T24080] ? __pfx_ksys_write+0x10/0x10 [ 595.671720][T24080] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.671734][T24080] do_syscall_64+0x15f/0xf80 [ 595.671755][T24080] ? trace_irq_disable+0x3b/0x140 [ 595.671772][T24080] ? clear_bhb_loop+0x40/0x90 [ 595.671791][T24080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.671810][T24080] RIP: 0033:0x7f7864b9ce59 [ 595.671825][T24080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.671835][T24080] RSP: 002b:00007f7862df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 595.671852][T24080] RAX: ffffffffffffffda RBX: 00007f7864e15fa0 RCX: 00007f7864b9ce59 [ 595.671861][T24080] RDX: 0000000020004c04 RSI: 0000200000000080 RDI: 0000000000000003 [ 595.671868][T24080] RBP: 00007f7862df6090 R08: 0000000000000000 R09: 0000000000000000 [ 595.671877][T24080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 595.671886][T24080] R13: 00007f7864e16038 R14: 00007f7864e15fa0 R15: 00007ffc6a687f98 [ 595.671910][T24080] [ 595.674655][T24081] syz.3.4538 (24081) used obsolete PPPIOCDETACH ioctl [ 596.126511][T24071] tipc: Enabling of bearer rejected, already enabled [ 596.166824][T24069] tipc: Resetting bearer [ 596.235495][T24069] tipc: Disabling bearer [ 596.271552][T24096] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4542'. [ 596.302691][T24095] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4543'. [ 596.477659][T24102] openvswitch: netlink: VXLAN extension message has 12 unknown bytes. [ 596.563432][T24103] gretap0: entered promiscuous mode [ 596.597784][T24103] netlink: 144 bytes leftover after parsing attributes in process `syz.3.4545'. [ 596.966189][T16532] nci: nci_rsp_packet: unknown rsp opcode 0x606 [ 597.207847][T24141] FAULT_INJECTION: forcing a failure. [ 597.207847][T24141] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 597.223589][T24141] CPU: 1 UID: 0 PID: 24141 Comm: syz.4.4551 Not tainted syzkaller #0 PREEMPT(full) [ 597.223612][T24141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 597.223621][T24141] Call Trace: [ 597.223627][T24141] [ 597.223633][T24141] dump_stack_lvl+0xe8/0x150 [ 597.223653][T24141] should_fail_ex+0x412/0x560 [ 597.223674][T24141] _copy_from_user+0x2d/0xb0 [ 597.223692][T24141] kstrtouint_from_user+0xd6/0x180 [ 597.223708][T24141] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 597.223735][T24141] proc_fail_nth_write+0x8e/0x210 [ 597.223752][T24141] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 597.223771][T24141] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 597.223787][T24141] vfs_write+0x29a/0xb90 [ 597.223810][T24141] ? __pfx_vfs_write+0x10/0x10 [ 597.223827][T24141] ? __fget_files+0x2a/0x420 [ 597.223844][T24141] ? __fget_files+0x3a0/0x420 [ 597.223856][T24141] ? __fget_files+0x2a/0x420 [ 597.223876][T24141] ksys_write+0x150/0x270 [ 597.223890][T24141] ? __irq_exit_rcu+0xca/0x220 [ 597.223905][T24141] ? __pfx_ksys_write+0x10/0x10 [ 597.223919][T24141] ? handle_softirqs+0x715/0x840 [ 597.223937][T24141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.223950][T24141] do_syscall_64+0x15f/0xf80 [ 597.223968][T24141] ? clear_bhb_loop+0x40/0x90 [ 597.223983][T24141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.223995][T24141] RIP: 0033:0x7ff7e1b5d68e [ 597.224007][T24141] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 597.224017][T24141] RSP: 002b:00007ff7e2a7dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 597.224030][T24141] RAX: ffffffffffffffda RBX: 00007ff7e2a7e6c0 RCX: 00007ff7e1b5d68e [ 597.224038][T24141] RDX: 0000000000000001 RSI: 00007ff7e2a7e0a0 RDI: 0000000000000004 [ 597.224046][T24141] RBP: 00007ff7e2a7e090 R08: 0000000000000000 R09: 0000000000000000 [ 597.224053][T24141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 597.224060][T24141] R13: 00007ff7e1e16038 R14: 00007ff7e1e15fa0 R15: 00007ffe0cdb7348 [ 597.224082][T24141] [ 597.710411][T24122] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 597.910716][T24151] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 598.945301][T24202] netlink: 'syz.3.4568': attribute type 2 has an invalid length. [ 599.375219][T24216] __nla_validate_parse: 10 callbacks suppressed [ 599.375254][T24216] netlink: 156 bytes leftover after parsing attributes in process `syz.0.4572'. [ 599.575694][T24227] netlink: 332 bytes leftover after parsing attributes in process `syz.3.4574'. [ 599.697498][T24233] netlink: 144 bytes leftover after parsing attributes in process `syz.2.4576'. [ 599.710030][T24235] netlink: 'syz.1.4577': attribute type 1 has an invalid length. [ 599.719357][T24235] netlink: 280 bytes leftover after parsing attributes in process `syz.1.4577'. [ 599.750477][T24233] netlink: 144 bytes leftover after parsing attributes in process `syz.2.4576'. [ 599.834282][T24239] xt_hashlimit: size too large, truncated to 1048576 [ 599.860104][T24239] xt_hashlimit: max too large, truncated to 1048576 [ 600.124972][T24243] dvmrp0: entered allmulticast mode [ 600.217347][ T139] nci: nci_rx_work: unknown MT 0x7 [ 600.224539][T24254] netlink: 'syz.4.4579': attribute type 4 has an invalid length. [ 600.565124][T24259] xt_hashlimit: size too large, truncated to 1048576 [ 600.889184][T24259] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 601.009280][T24270] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4583'. [ 601.249084][T24273] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4584'. [ 603.113163][T24247] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 603.678111][T24306] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4594'. [ 605.137620][T24364] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4610'. [ 605.215802][T24369] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 605.258253][T24370] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 605.315412][T24361] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4608'. [ 605.358144][T24378] netlink: 240 bytes leftover after parsing attributes in process `syz.4.4609'. [ 605.370102][T24361] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4608'. [ 605.501063][T24382] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4615'. [ 605.517778][T24382] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4615'. [ 605.555805][T24385] IPVS: set_ctl: invalid protocol: 136 127.0.0.1:20003 [ 605.606288][T16532] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.633018][T16532] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.659870][T16532] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.680574][T16532] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.691029][T24390] netlink: 'syz.0.4618': attribute type 4 has an invalid length. [ 605.733010][T24390] netlink: 'syz.0.4618': attribute type 4 has an invalid length. [ 605.863848][T24394] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4620'. [ 605.871942][T24397] tipc: Enabling of bearer rejected, already enabled [ 605.919453][T24399] netlink: 'syz.0.4622': attribute type 1 has an invalid length. [ 605.972906][T24397] veth9: entered promiscuous mode [ 606.394699][T24417] netlink: 'syz.0.4627': attribute type 1 has an invalid length. [ 606.495206][T24427] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4630'. [ 606.604522][T24436] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4631'. [ 606.626065][T24413] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 606.680744][T24413] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 606.787293][T24424] syzkaller0: entered promiscuous mode [ 606.793962][T24424] syzkaller0: entered allmulticast mode [ 606.862708][T24442] tipc: Enabled bearer , priority 0 [ 606.890160][T24447] IPv6: syztnl2: Disabled Multicast RS [ 606.995982][T24432] tipc: Resetting bearer [ 607.103254][T24419] tipc: Resetting bearer [ 607.156344][T24419] tipc: Disabling bearer [ 607.204901][T24458] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4635'. [ 607.284807][T24461] netlink: 'syz.3.4638': attribute type 1 has an invalid length. [ 607.406505][T24461] bond8: entered promiscuous mode [ 607.423621][T24461] bond8: entered allmulticast mode [ 607.436204][T24461] 8021q: adding VLAN 0 to HW filter on device bond8 [ 607.495464][T24473] IPVS: ip_vs_add_dest(): server weight less than zero [ 607.512265][T24473] sctp: [Deprecated]: syz.4.4640 (pid 24473) Use of int in maxseg socket option. [ 607.512265][T24473] Use struct sctp_assoc_value instead [ 607.666400][T24480] lo: Caught tx_queue_len zero misconfig [ 608.069479][T16531] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.087991][T24492] netlink: 'syz.2.4644': attribute type 7 has an invalid length. [ 608.097466][T16531] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.117242][T16531] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.167498][T16531] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.366416][T24499] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 608.796890][T24518] sctp: [Deprecated]: syz.1.4652 (pid 24518) Use of int in maxseg socket option. [ 608.796890][T24518] Use struct sctp_assoc_value instead [ 608.888805][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 609.023939][T24529] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 609.036985][T24529] netlink: zone id is out of range [ 609.068912][T24529] netlink: zone id is out of range [ 609.074210][T24529] netlink: zone id is out of range [ 609.079988][T24529] netlink: zone id is out of range [ 609.119233][T24529] netlink: zone id is out of range [ 609.133612][T24529] netlink: zone id is out of range [ 609.167358][T24529] netlink: zone id is out of range [ 609.192081][T24529] netlink: zone id is out of range [ 609.212793][T24529] netlink: zone id is out of range [ 609.461909][T24544] lo speed is unknown, defaulting to 1000 [ 609.515939][T24544] lo speed is unknown, defaulting to 1000 [ 609.522539][T24544] lo speed is unknown, defaulting to 1000 [ 610.237034][T24558] netlink: 'syz.4.4662': attribute type 2 has an invalid length. [ 610.470843][T24544] infiniband sqz0: set active [ 610.477908][ T5761] lo speed is unknown, defaulting to 1000 [ 610.501598][T24544] infiniband sqz0: added lo [ 610.551257][T24544] smbdirect: ib_dev[sqz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 610.567133][T24544] smbdirect: ib_dev[sqz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 610.585270][T24544] smbdirect: ib_dev[sqz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 610.639328][T24544] RDS/IB: sqz0: added [ 610.643434][T24544] smc: adding ib device sqz0 with port count 1 [ 610.651634][T24544] smc: ib device sqz0 port 1 has no pnetid [ 610.659219][ T5761] lo speed is unknown, defaulting to 1000 [ 610.666180][T24544] lo speed is unknown, defaulting to 1000 [ 610.784901][T24575] __nla_validate_parse: 15 callbacks suppressed [ 610.784920][T24575] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4667'. [ 610.974220][T24579] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4667'. [ 611.019120][T24544] lo speed is unknown, defaulting to 1000 [ 611.036582][T24579] nbd: device at index 64 is going down [ 611.173036][T24155] udevd[24155]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 611.564298][T24591] bond7 (unregistering): Released all slaves [ 612.043513][T24544] lo speed is unknown, defaulting to 1000 [ 612.162777][T24604] netlink: 72 bytes leftover after parsing attributes in process `syz.4.4673'. [ 612.508120][T24612] netlink: 'syz.4.4676': attribute type 1 has an invalid length. [ 612.671713][T24612] 8021q: adding VLAN 0 to HW filter on device bond7 [ 612.774925][T24615] bond7: (slave ip6erspan0): making interface the new active one [ 612.802165][T24615] bond7: (slave ip6erspan0): Enslaving as an active interface with an up link [ 612.815445][T24544] lo speed is unknown, defaulting to 1000 [ 613.244609][T24544] lo speed is unknown, defaulting to 1000 [ 613.306371][T24632] bond7: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 613.327956][T24636] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4681'. [ 613.363914][T24632] bond7 (unregistering): Released all slaves [ 613.565311][T16532] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 613.576806][T16532] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 613.588157][T16532] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 613.602072][T16532] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 614.041986][T24664] net_ratelimit: 14 callbacks suppressed [ 614.042003][T24664] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 614.200365][T24668] syzkaller1: entered promiscuous mode [ 614.206050][T24668] syzkaller1: entered allmulticast mode [ 614.320212][T24678] netlink: 'syz.2.4694': attribute type 1 has an invalid length. [ 614.339443][T24678] netlink: 280 bytes leftover after parsing attributes in process `syz.2.4694'. [ 614.425216][T24684] xt_hashlimit: size too large, truncated to 1048576 [ 614.426514][T24683] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4696'. [ 614.439083][T24684] xt_hashlimit: max too large, truncated to 1048576 [ 615.421453][T24714] netlink: 'syz.3.4704': attribute type 8 has an invalid length. [ 615.537536][T24719] netlink: 'syz.0.4705': attribute type 1 has an invalid length. [ 615.615272][T24716] netlink: 'syz.1.4703': attribute type 16 has an invalid length. [ 615.671556][T24716] netlink: 'syz.1.4703': attribute type 17 has an invalid length. [ 615.699768][T24722] IPVS: set_ctl: invalid protocol: 41 127.0.0.1:20003 [ 615.737601][T24724] IPVS: set_ctl: invalid protocol: 41 127.0.0.1:20003 [ 615.960954][T24716] syz_tun: left promiscuous mode [ 615.979658][T24728] netlink: 'syz.0.4708': attribute type 3 has an invalid length. [ 615.997849][T24730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4707'. [ 616.017946][T24716] 0ªX¹¦À: left allmulticast mode [ 616.077763][T24734] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4708'. [ 616.104504][T24716] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 616.436947][T24741] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4709'. [ 616.447415][T24740] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4710'. [ 616.552017][T24746] macsec1: entered allmulticast mode [ 616.573812][T24746] batadv0: entered allmulticast mode [ 616.615341][T24746] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 616.647479][T24746] batadv0: left allmulticast mode [ 617.112609][T24767] sch_tbf: burst 1 is lower than device syzkaller0 mtu (1514) ! [ 617.256132][T24769] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4716'. [ 617.296590][T24769] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4716'. [ 617.355770][T24769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4716'. [ 617.394932][T24769] netlink: 'syz.1.4716': attribute type 14 has an invalid length. [ 617.413162][T24777] netlink: 'syz.0.4718': attribute type 2 has an invalid length. [ 617.417995][T24769] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4716'. [ 617.501130][T24782] netlink: 'syz.4.4720': attribute type 41 has an invalid length. [ 617.921705][T24810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4728'. [ 617.961504][T24812] netlink: 'syz.1.4729': attribute type 1 has an invalid length. [ 617.964581][T24810] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4728'. [ 618.022360][T24812] bond9: entered promiscuous mode [ 618.042034][T24812] 8021q: adding VLAN 0 to HW filter on device bond9 [ 618.095961][T24817] bond9: left promiscuous mode [ 618.113864][T24817] bond9: entered allmulticast mode [ 618.316497][T24827] IPv6: addrconf: prefix option has invalid lifetime [ 618.386504][T24829] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 618.493040][T24831] syzkaller0: entered promiscuous mode [ 618.523362][T24831] syzkaller0: entered allmulticast mode [ 618.543062][T24838] vlan0: entered promiscuous mode [ 618.572168][T24842] netlink: 'syz.1.4738': attribute type 1 has an invalid length. [ 618.658038][T24845] xt_hashlimit: size too large, truncated to 1048576 [ 618.715291][T24845] xt_hashlimit: max too large, truncated to 1048576 [ 618.821760][T24854] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 618.829128][T24854] IPv6: NLM_F_CREATE should be set when creating new route [ 618.836461][T24854] IPv6: NLM_F_CREATE should be set when creating new route [ 618.946083][T24855] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 618.986186][T24855] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 619.024358][T24855] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 619.107597][T24855] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 619.264160][T24867] x_tables: duplicate underflow at hook 3 [ 619.714154][T24879] openvswitch: netlink: Multiple metadata blocks provided [ 619.876789][T24887] IPVS: set_ctl: invalid protocol: 44 224.0.0.2:20002 [ 620.101739][T24896] netlink: 'syz.0.4753': attribute type 1 has an invalid length. [ 620.229348][T24909] xt_hashlimit: size too large, truncated to 1048576 [ 620.248586][T24909] xt_hashlimit: max too large, truncated to 1048576 [ 620.683279][T24933] syzkaller0: entered promiscuous mode [ 620.690135][T24933] syzkaller0: entered allmulticast mode [ 620.704367][T24931] netlink: 'syz.1.4764': attribute type 8 has an invalid length. [ 620.715149][T24930] netlink: 'syz.1.4764': attribute type 8 has an invalid length. [ 621.114793][T24956] __nla_validate_parse: 14 callbacks suppressed [ 621.114812][T24956] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4769'. [ 621.165698][T24956] : entered promiscuous mode [ 621.186956][T24956] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4769'. [ 621.283693][T24956] openvswitch: : Dropping previously announced user features [ 621.345922][T24960] lo speed is unknown, defaulting to 1000 [ 621.752657][T24981] netlink: 'syz.2.4773': attribute type 1 has an invalid length. [ 621.772120][T24981] netlink: 280 bytes leftover after parsing attributes in process `syz.2.4773'. [ 621.973633][T24982] xt_hashlimit: size too large, truncated to 1048576 [ 622.005878][T24982] xt_hashlimit: max too large, truncated to 1048576 [ 622.298177][T24989] netlink: 'syz.2.4775': attribute type 1 has an invalid length. [ 622.461279][T24995] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4777'. [ 622.475915][T24995] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4777'. [ 622.487812][T24989] 8021q: adding VLAN 0 to HW filter on device bond5 [ 622.496051][T24995] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.4777'. [ 622.577335][T24992] bond5: (slave veth5): Enslaving as an active interface with a down link [ 622.593389][T25005] netlink: 292 bytes leftover after parsing attributes in process `syz.4.4778'. [ 622.820706][T24993] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 622.865649][T24993] bond5: (slave batadv0): making interface the new active one [ 622.917160][T24993] batadv0: entered promiscuous mode [ 622.946668][T24993] bond5: (slave batadv0): Enslaving as an active interface with an up link [ 623.222842][T25023] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4782'. [ 623.527498][T25036] netlink: 'syz.1.4785': attribute type 1 has an invalid length. [ 623.540563][T25036] netlink: 280 bytes leftover after parsing attributes in process `syz.1.4785'. [ 623.554903][T25033] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4783'. [ 623.575970][T25034] netlink: 'syz.0.4784': attribute type 4 has an invalid length. [ 623.674475][T25039] xt_hashlimit: size too large, truncated to 1048576 [ 623.690735][T25039] xt_hashlimit: max too large, truncated to 1048576 [ 623.894338][T25043] geneve3: entered allmulticast mode [ 624.620396][T16527] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.650312][T16527] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.704606][T16527] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.716510][T16527] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.949825][T25084] netlink: 'syz.1.4798': attribute type 1 has an invalid length. [ 625.082305][T25095] xt_hashlimit: size too large, truncated to 1048576 [ 625.123330][T25095] xt_hashlimit: max too large, truncated to 1048576 [ 625.474430][T25127] netlink: 'syz.1.4804': attribute type 1 has an invalid length. [ 625.633675][T25136] tipc: Enabling of bearer rejected, failed to enable media [ 625.764022][T25143] netlink: 'syz.0.4808': attribute type 8 has an invalid length. [ 625.765927][T25145] netlink: 'syz.0.4808': attribute type 8 has an invalid length. [ 626.022025][T25146] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 627.388647][T25174] netlink: 'syz.0.4814': attribute type 1 has an invalid length. [ 627.408241][T25174] __nla_validate_parse: 36 callbacks suppressed [ 627.408282][T25174] netlink: 280 bytes leftover after parsing attributes in process `syz.0.4814'. [ 627.613134][T25186] xt_hashlimit: size too large, truncated to 1048576 [ 627.623951][T25178] lo speed is unknown, defaulting to 1000 [ 627.654439][T25186] xt_hashlimit: max too large, truncated to 1048576 [ 627.663908][T25192] netlink: 'syz.3.4819': attribute type 4 has an invalid length. [ 627.712918][T25194] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4818'. [ 628.117853][T25199] netlink: 220 bytes leftover after parsing attributes in process `syz.3.4821'. [ 628.210399][T25199] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4821'. [ 629.654609][T25228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4829'. [ 629.883316][T25228] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.894865][T25236] netlink: 'syz.0.4832': attribute type 1 has an invalid length. [ 629.918044][T25236] netlink: 280 bytes leftover after parsing attributes in process `syz.0.4832'. [ 629.929917][T25228] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.979008][T25228] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 630.133545][T25236] xt_hashlimit: size too large, truncated to 1048576 [ 630.174714][T25236] xt_hashlimit: max too large, truncated to 1048576 [ 630.271424][T25228] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 630.288906][T25228] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.328624][T25228] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 630.591584][T25228] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 630.623062][T25228] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.651604][T25228] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 630.771232][T25228] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 630.816617][T25228] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.839193][T25228] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 630.880902][T25263] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4838'. [ 630.901469][T25267] veth1_virt_wifi: left allmulticast mode [ 630.907235][T25267] veth1_virt_wifi: left promiscuous mode [ 630.918800][T25267] bridge0: port 1(veth1_virt_wifi) entered disabled state [ 631.172532][T25280] netlink: 128 bytes leftover after parsing attributes in process `syz.1.4841'. [ 631.196070][T25280] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4841'. [ 631.233184][T25273] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4841'. [ 631.312415][T25282] netlink: 'syz.0.4844': attribute type 1 has an invalid length. [ 631.472803][T25282] bond7: entered promiscuous mode [ 631.490837][T25282] 8021q: adding VLAN 0 to HW filter on device bond7 [ 631.511327][T25270] lo speed is unknown, defaulting to 1000 [ 631.600345][T25291] netlink: 'syz.2.4845': attribute type 13 has an invalid length. [ 631.613565][T25285] bond7: (slave bridge11): making interface the new active one [ 631.644106][T25291] netlink: 'syz.2.4845': attribute type 17 has an invalid length. [ 631.652730][T25285] bridge11: entered promiscuous mode [ 631.671172][T25285] bond7: (slave bridge11): Enslaving as an active interface with an up link [ 631.773213][T25110] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.801192][T25110] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20002 - 0 [ 631.839004][T25110] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 632.213111][T25291] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 632.228724][T25291] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 632.309465][T25291] veth1_vlan: left promiscuous mode [ 632.357715][T25291] vlan0: left promiscuous mode [ 632.376383][T25291] veth1_vlan: entered promiscuous mode [ 632.400089][T25291] veth1_macvtap: left promiscuous mode [ 632.410979][T25291] veth0_macvtap: left promiscuous mode [ 632.417914][T25291] veth0_macvtap: entered promiscuous mode [ 632.441895][T25291] veth1_macvtap: entered promiscuous mode [ 632.465649][T25291] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 632.580992][T25302] __nla_validate_parse: 1 callbacks suppressed [ 632.581032][T25302] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4847'. [ 632.685187][T25313] netlink: 'syz.2.4849': attribute type 2 has an invalid length. [ 632.732532][T25108] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.758611][T25108] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.831452][T25315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4850'. [ 632.850984][T25108] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.868844][T25108] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.986358][T25108] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 632.998046][T25108] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20002 - 0 [ 633.007465][T25108] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 633.015692][T25108] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 633.023860][T25108] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20002 - 0 [ 633.035523][T25108] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 633.051664][T25108] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 633.065386][T25108] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20002 - 0 [ 633.073835][T25108] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 633.735239][T25344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4858'. [ 633.765371][T25344] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4858'. [ 634.184019][T25360] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4864'. [ 634.309070][T25112] batadv0: left promiscuous mode [ 634.408861][T25361] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 634.683678][T25375] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4867'. [ 634.724936][T25383] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4865'. [ 634.758005][T25375] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4867'. [ 634.784803][T25375] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4867'. [ 634.875110][T25375] netlink: 212324 bytes leftover after parsing attributes in process `syz.4.4867'. [ 635.485280][T25418] netlink: 'syz.2.4875': attribute type 30 has an invalid length. [ 636.394085][T25467] xt_hashlimit: size too large, truncated to 1048576 [ 636.601465][T25431] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 636.637214][T25470] netlink: 'syz.2.4887': attribute type 2 has an invalid length. [ 636.943478][T25489] xt_hashlimit: size too large, truncated to 1048576 [ 637.119118][T25498] netlink: 'syz.2.4894': attribute type 49 has an invalid length. [ 637.319650][T25507] netlink: 'syz.1.4896': attribute type 7 has an invalid length. [ 637.331272][T25507] netlink: 'syz.1.4896': attribute type 8 has an invalid length. [ 637.340175][T16530] nci: nci_rx_work: unknown MT 0x6 [ 637.651651][T25521] __nla_validate_parse: 10 callbacks suppressed [ 637.651667][T25521] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4900'. [ 637.874363][T25530] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4902'. [ 638.037965][T25502] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 638.050719][T25533] netlink: 'syz.0.4903': attribute type 1 has an invalid length. [ 638.104689][T25533] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4903'. [ 638.536232][T25549] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4907'. [ 638.641746][T25549] netlink: 'syz.1.4907': attribute type 7 has an invalid length. [ 638.663654][T25549] netlink: 'syz.1.4907': attribute type 8 has an invalid length. [ 638.682033][T25549] netlink: 'syz.1.4907': attribute type 8 has an invalid length. [ 638.702393][T25553] netlink: 'syz.3.4909': attribute type 309 has an invalid length. [ 638.717204][T25549] netlink: 207236 bytes leftover after parsing attributes in process `syz.1.4907'. [ 638.993173][T25561] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4911'. [ 639.047567][T25564] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4908'. [ 639.121782][T25564] ip6gre3: entered promiscuous mode [ 639.136927][T25564] ip6gre3: entered allmulticast mode [ 639.144548][T25564] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4908'. [ 639.144855][T16530] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 639.218690][T16530] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 639.226446][ T5761] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 639.250182][T25564] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4908'. [ 639.279511][ T5761] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 639.293567][ T5740] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 639.322176][T25564] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4908'. [ 639.359045][ T5740] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 639.578856][ T5740] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 639.846089][T25577] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.856243][T25577] bridge0: port 1(bridge_slave_0) entered disabled state [ 639.901213][T25577] team_slave_0: left promiscuous mode [ 639.917677][T25577] team_slave_1: left promiscuous mode [ 640.282527][T25577] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 640.324703][T25577] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 640.419981][T25111] [ 640.422351][T25111] ====================================================== [ 640.429369][T25111] WARNING: possible circular locking dependency detected [ 640.436405][T25111] syzkaller #0 Not tainted [ 640.440817][T25111] ------------------------------------------------------ [ 640.447825][T25111] kworker/u8:29/25111 is trying to acquire lock: [ 640.454143][T25111] ffff8880286a0ff0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 640.463289][T25111] [ 640.463289][T25111] but task is already holding lock: [ 640.470650][T25111] ffff888059d00958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 640.480613][T25111] [ 640.480613][T25111] which lock already depends on the new lock. [ 640.480613][T25111] [ 640.491006][T25111] [ 640.491006][T25111] the existing dependency chain (in reverse order) is: [ 640.500005][T25111] [ 640.500005][T25111] -> #1 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}: [ 640.508247][T25111] _raw_spin_lock+0x2e/0x40 [ 640.513261][T25111] sch_direct_xmit+0x15f/0x4c0 [ 640.518533][T25111] __dev_queue_xmit+0x180f/0x3950 [ 640.524062][T25111] hsr_forward_skb+0x167e/0x2a80 [ 640.529584][T25111] hsr_dev_xmit+0x242/0x360 [ 640.534602][T25111] dev_hard_start_xmit+0x2cd/0x830 [ 640.540221][T25111] __dev_queue_xmit+0x14d9/0x3950 [ 640.545751][T25111] ip6_output+0x340/0x550 [ 640.550583][T25111] NF_HOOK+0x177/0x4f0 [ 640.555161][T25111] mld_sendpack+0x8b4/0xe40 [ 640.560166][T25111] mld_ifc_work+0x835/0xe70 [ 640.565172][T25111] process_scheduled_works+0xb5d/0x1860 [ 640.571226][T25111] worker_thread+0xa53/0xfc0 [ 640.576326][T25111] kthread+0x389/0x470 [ 640.580901][T25111] ret_from_fork+0x514/0xb70 [ 640.586044][T25111] ret_from_fork_asm+0x1a/0x30 [ 640.591319][T25111] [ 640.591319][T25111] -> #0 (&hsr->seqnr_lock){+.-.}-{3:3}: [ 640.599035][T25111] __lock_acquire+0x15a5/0x2cf0 [ 640.604395][T25111] lock_acquire+0x106/0x350 [ 640.609410][T25111] _raw_spin_lock_bh+0x36/0x50 [ 640.614681][T25111] hsr_dev_xmit+0x237/0x360 [ 640.619688][T25111] dev_hard_start_xmit+0x2cd/0x830 [ 640.625303][T25111] __dev_queue_xmit+0x14d9/0x3950 [ 640.630831][T25111] NF_HOOK+0x33a/0x3c0 [ 640.635407][T25111] arp_xmit+0x16c/0x270 [ 640.640068][T25111] arp_solicit+0xbe0/0xe40 [ 640.644993][T25111] __neigh_event_send+0xf05/0x14d0 [ 640.650690][T25111] neigh_resolve_output+0x198/0x750 [ 640.656397][T25111] ip_finish_output2+0xca9/0x1070 [ 640.661991][T25111] ip_output+0x29f/0x450 [ 640.666742][T25111] iptunnel_xmit+0x621/0xd10 [ 640.671888][T25111] ip_tunnel_xmit+0x193a/0x1f20 [ 640.677326][T25111] __gre_xmit+0x19e/0x240 [ 640.682231][T25111] erspan_xmit+0xa41/0x14d0 [ 640.687288][T25111] dev_hard_start_xmit+0x2cd/0x830 [ 640.692906][T25111] sch_direct_xmit+0x251/0x4c0 [ 640.698181][T25111] __dev_queue_xmit+0x180f/0x3950 [ 640.703714][T25111] alb_send_lp_vid+0x348/0x550 [ 640.709091][T25111] alb_send_learning_packets+0x12c/0x300 [ 640.715234][T25111] bond_alb_monitor+0x3d5/0x17e0 [ 640.720679][T25111] process_scheduled_works+0xb5d/0x1860 [ 640.726729][T25111] worker_thread+0xa53/0xfc0 [ 640.731828][T25111] kthread+0x389/0x470 [ 640.736411][T25111] ret_from_fork+0x514/0xb70 [ 640.741504][T25111] ret_from_fork_asm+0x1a/0x30 [ 640.746778][T25111] [ 640.746778][T25111] other info that might help us debug this: [ 640.746778][T25111] [ 640.756988][T25111] Possible unsafe locking scenario: [ 640.756988][T25111] [ 640.764420][T25111] CPU0 CPU1 [ 640.769768][T25111] ---- ---- [ 640.775113][T25111] lock(&qdisc_xmit_lock_key#4); [ 640.780128][T25111] lock(&hsr->seqnr_lock); [ 640.787137][T25111] lock(&qdisc_xmit_lock_key#4); [ 640.794673][T25111] lock(&hsr->seqnr_lock); [ 640.799163][T25111] [ 640.799163][T25111] *** DEADLOCK *** [ 640.799163][T25111] [ 640.807287][T25111] 11 locks held by kworker/u8:29/25111: [ 640.812810][T25111] #0: ffff88803ac1c940 ((wq_completion)bond7#4){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 640.823848][T25111] #1: ffffc90005bffc40 ((work_completion)(&(&bond->alb_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 640.836707][T25111] #2: ffffffff8e95cda0 (rcu_read_lock){....}-{1:3}, at: bond_alb_monitor+0xf8/0x17e0 [ 640.846267][T25111] #3: ffffffff8e95ce00 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 [ 640.856173][T25111] #4: ffff88807c946228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x11a6/0x3950 [ 640.868771][T25111] #5: ffff888059d00958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 640.879028][T25111] #6: ffffffff8e95cda0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450 [ 640.887891][T25111] #7: ffffffff8e95cda0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3c2/0x1070 [ 640.897620][T25111] #8: ffffffff8e95cda0 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x23/0x270 [ 640.906397][T25111] #9: ffffffff8e95ce00 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 640.916297][T25111] #10: ffffffff8e95cda0 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 640.925503][T25111] [ 640.925503][T25111] stack backtrace: [ 640.931374][T25111] CPU: 0 UID: 0 PID: 25111 Comm: kworker/u8:29 Not tainted syzkaller #0 PREEMPT(full) [ 640.931395][T25111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 640.931405][T25111] Workqueue: bond7 bond_alb_monitor [ 640.931425][T25111] Call Trace: [ 640.931432][T25111] [ 640.931440][T25111] dump_stack_lvl+0xe8/0x150 [ 640.931456][T25111] print_circular_bug+0x2e1/0x300 [ 640.931474][T25111] check_noncircular+0x12e/0x150 [ 640.931492][T25111] __lock_acquire+0x15a5/0x2cf0 [ 640.931508][T25111] ? __siphash_unaligned+0x25f/0x3b0 [ 640.931610][T25111] ? skb_network_protocol+0x23d/0x400 [ 640.931624][T25111] ? hsr_dev_xmit+0x237/0x360 [ 640.931638][T25111] lock_acquire+0x106/0x350 [ 640.931650][T25111] ? hsr_dev_xmit+0x237/0x360 [ 640.931664][T25111] ? __pfx_netif_skb_features+0x10/0x10 [ 640.931679][T25111] ? hsr_dev_xmit+0x237/0x360 [ 640.931689][T25111] _raw_spin_lock_bh+0x36/0x50 [ 640.931706][T25111] ? hsr_dev_xmit+0x237/0x360 [ 640.931717][T25111] hsr_dev_xmit+0x237/0x360 [ 640.931728][T25111] ? hsr_dev_xmit+0x2d/0x360 [ 640.931743][T25111] dev_hard_start_xmit+0x2cd/0x830 [ 640.931759][T25111] __dev_queue_xmit+0x14d9/0x3950 [ 640.931775][T25111] ? __local_bh_enable_ip+0xd0/0x130 [ 640.931788][T25111] ? __dev_queue_xmit+0x2b6/0x3950 [ 640.931801][T25111] ? arpt_do_table+0x256/0x1e30 [ 640.931848][T25111] ? arpt_do_table+0x256/0x1e30 [ 640.931862][T25111] ? __pfx___dev_queue_xmit+0x10/0x10 [ 640.931878][T25111] ? __pfx_arpt_do_table+0x10/0x10 [ 640.931891][T25111] ? trace_kmem_cache_alloc+0x29/0xe0 [ 640.931914][T25111] ? NF_HOOK+0xa2/0x3c0 [ 640.931931][T25111] NF_HOOK+0x33a/0x3c0 [ 640.931946][T25111] ? __pfx_arp_xmit_finish+0x10/0x10 [ 640.931960][T25111] ? NF_HOOK+0xa2/0x3c0 [ 640.931975][T25111] ? __pfx_NF_HOOK+0x10/0x10 [ 640.931988][T25111] ? lock_acquire+0x106/0x350 [ 640.932003][T25111] ? __pfx_arp_xmit_finish+0x10/0x10 [ 640.932017][T25111] ? inet_addr_type_dev_table+0x25/0x190 [ 640.932059][T25111] arp_xmit+0x16c/0x270 [ 640.932074][T25111] ? arp_xmit+0x23/0x270 [ 640.932087][T25111] arp_solicit+0xbe0/0xe40 [ 640.932107][T25111] ? arp_solicit+0x119/0xe40 [ 640.932121][T25111] ? __pfx_arp_solicit+0x10/0x10 [ 640.932141][T25111] ? __pfx_arp_solicit+0x10/0x10 [ 640.932154][T25111] __neigh_event_send+0xf05/0x14d0 [ 640.932176][T25111] neigh_resolve_output+0x198/0x750 [ 640.932193][T25111] ? __pfx_ip_neigh_gw4+0x10/0x10 [ 640.932213][T25111] ? ip_finish_output2+0x3c2/0x1070 [ 640.932230][T25111] ip_finish_output2+0xca9/0x1070 [ 640.932245][T25111] ? ip_skb_dst_mtu+0x80b/0xa50 [ 640.932263][T25111] ? ip_finish_output+0x40e/0x530 [ 640.932278][T25111] ip_output+0x29f/0x450 [ 640.932295][T25111] ? ip_output+0x5b/0x450 [ 640.932309][T25111] iptunnel_xmit+0x621/0xd10 [ 640.932332][T25111] ip_tunnel_xmit+0x193a/0x1f20 [ 640.932355][T25111] ? __pfx_ip_tunnel_xmit+0x10/0x10 [ 640.932372][T25111] ? __pfx_gre_build_header+0x10/0x10 [ 640.932396][T25111] __gre_xmit+0x19e/0x240 [ 640.932409][T25111] ? __pfx___gre_xmit+0x10/0x10 [ 640.932423][T25111] ? iptunnel_handle_offloads+0x2fd/0x630 [ 640.932442][T25111] erspan_xmit+0xa41/0x14d0 [ 640.932462][T25111] ? ret_from_fork_asm+0x1a/0x30 [ 640.932476][T25111] ? __pfx_erspan_xmit+0x10/0x10 [ 640.932495][T25111] dev_hard_start_xmit+0x2cd/0x830 [ 640.932511][T25111] sch_direct_xmit+0x251/0x4c0 [ 640.932533][T25111] ? __pfx_sch_direct_xmit+0x10/0x10 [ 640.932547][T25111] ? kthread+0x310/0x470 [ 640.932566][T25111] __dev_queue_xmit+0x180f/0x3950 [ 640.932581][T25111] ? __dev_queue_xmit+0x2b6/0x3950 [ 640.932600][T25111] ? __pfx___dev_queue_xmit+0x10/0x10 [ 640.932612][T25111] ? rcu_is_watching+0x15/0xb0 [ 640.932628][T25111] ? trace_kmem_cache_alloc+0x29/0xe0 [ 640.932642][T25111] ? kmem_cache_alloc_node_noprof+0x3ce/0x690 [ 640.932665][T25111] ? alb_send_lp_vid+0x14e/0x550 [ 640.932682][T25111] alb_send_lp_vid+0x348/0x550 [ 640.932701][T25111] ? __pfx_alb_send_lp_vid+0x10/0x10 [ 640.932723][T25111] alb_send_learning_packets+0x12c/0x300 [ 640.932739][T25111] ? __pfx_alb_send_learning_packets+0x10/0x10 [ 640.932757][T25111] ? bond_alb_monitor+0xf8/0x17e0 [ 640.932773][T25111] ? netdev_lower_get_next_private_rcu+0x9f/0x100 [ 640.932792][T25111] bond_alb_monitor+0x3d5/0x17e0 [ 640.932808][T25111] ? bond_alb_monitor+0xf8/0x17e0 [ 640.932825][T25111] ? __pfx_bond_alb_monitor+0x10/0x10 [ 640.932840][T25111] ? process_scheduled_works+0xa70/0x1860 [ 640.932854][T25111] ? process_scheduled_works+0xa70/0x1860 [ 640.932866][T25111] process_scheduled_works+0xb5d/0x1860 [ 640.932890][T25111] ? __pfx_process_scheduled_works+0x10/0x10 [ 640.932904][T25111] ? assign_work+0x3d5/0x5e0 [ 640.932919][T25111] worker_thread+0xa53/0xfc0 [ 640.932939][T25111] kthread+0x389/0x470 [ 640.932955][T25111] ? __pfx_worker_thread+0x10/0x10 [ 640.932966][T25111] ? __pfx_kthread+0x10/0x10 [ 640.932982][T25111] ret_from_fork+0x514/0xb70 [ 640.932996][T25111] ? __pfx_ret_from_fork+0x10/0x10 [ 640.933007][T25111] ? __switch_to+0xc79/0x1410 [ 640.933025][T25111] ? __pfx_kthread+0x10/0x10 [ 640.933039][T25111] ret_from_fork_asm+0x1a/0x30 [ 640.933059][T25111] [ 642.083559][T25577] veth1_vlan: left allmulticast mode [ 642.236969][ T5761] lo speed is unknown, defaulting to 1000 [ 642.252881][T25584] tipc: Enabling of bearer rejected, failed to enable media [ 642.264496][ T5761] sqz0: Port: 1 Link DOWN [ 642.268797][T25589] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 642.392539][T16530] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.414931][T16530] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 20002 - 0 [ 642.447103][T16530] netdevsim netdevsim3 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 642.480375][T16530] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.519024][T16530] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 20002 - 0 [ 642.548604][T16530] netdevsim netdevsim3 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 642.559270][ T5761] lo speed is unknown, defaulting to 1000 [ 642.565078][T16530] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.608864][T16530] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 20002 - 0 [ 642.617391][T16530] netdevsim netdevsim3 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 642.649979][T16530] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.663402][T16530] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 20002 - 0 [ 642.672719][T16530] netdevsim netdevsim3 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 642.842588][T25585] bond0: (slave syz_tun): Releasing backup interface [ 642.865015][T25577] syz_tun (unregistering): left allmulticast mode [ 642.885342][T16530] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.896429][T16530] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.934005][T16530] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.944899][T16530] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.978868][T25588] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 643.023959][T16530] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 643.034781][T16530] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.082665][T16530] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 643.093376][T16530] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.197292][T16530] bridge_slave_1: left allmulticast mode [ 643.209484][T16530] bridge_slave_1: left promiscuous mode [ 643.215608][T16530] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.523321][T16530] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 643.531711][T16530] bridge1 (unregistering): left promiscuous mode [ 643.538073][T16530] bridge1 (unregistering): left allmulticast mode [ 643.608494][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 643.621598][T16530] bond2 (unregistering): (slave bridge3): Releasing backup interface [ 643.630176][T16530] bridge3 (unregistering): left promiscuous mode [ 643.636706][T16530] bridge3 (unregistering): left allmulticast mode [ 643.670952][T16530] bond3 (unregistering): (slave bridge4): Releasing backup interface [ 643.679398][T16530] bridge4 (unregistering): left allmulticast mode [ 644.004192][T16530] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 644.014796][T16530] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 644.024623][T16530] bond0 (unregistering): Released all slaves [ 644.033597][T16530] bond1 (unregistering): Released all slaves [ 644.046407][T16530] bond2 (unregistering): Released all slaves [ 644.057923][T16530] bond3 (unregistering): Released all slaves [ 644.070416][T16530] bond4 (unregistering): Released all slaves [ 644.083160][T16530] bond5 (unregistering): Released all slaves [ 644.095821][T16530] bond6 (unregistering): Released all slaves [ 644.109838][T16530] bond7 (unregistering): (slave veth5): Releasing backup interface [ 644.117753][T16530] veth5: left promiscuous mode [ 644.124446][T16530] bond7 (unregistering): Released all slaves [ 644.141381][T16530] bond8 (unregistering): (slave veth11): Releasing active interface [ 644.149773][T16530] dummy0: entered promiscuous mode [ 644.156684][T16530] bond8 (unregistering): (slave dummy0): Releasing active interface [ 644.166372][T16530] bond8 (unregistering): Released all slaves [ 644.178024][T16530] bond9 (unregistering): Released all slaves [ 644.191727][ T5291] 8021q: adding VLAN 0 to HW filter on device eth1 [ 644.245779][T16530] : left promiscuous mode [ 644.332612][T16530] hmac(sh: left promiscuous mode [ 644.360024][T16530] tipc: Disabling bearer [ 644.365269][T16530] tipc: Left network mode [ 644.537470][ T5291] 8021q: adding VLAN 0 to HW filter on device eth2 [ 644.653097][T16530] hsr_slave_0: left promiscuous mode [ 644.691461][T16530] hsr_slave_1: left promiscuous mode [ 644.697853][T16530] batman_adv: 60ªX¹¦À: Interface deactivated: batadv_slave_0 [ 644.705927][T16530] batman_adv: 60ªX¹¦À: Removing interface: batadv_slave_0 [ 644.721486][T16530] batman_adv: 60ªX¹¦À: Interface deactivated: batadv_slave_1 [ 644.733125][T16530] batman_adv: 60ªX¹¦À: Removing interface: batadv_slave_1 [ 644.744475][T16530] virt_wifi0: left promiscuous mode [ 644.750465][T16530] veth1_macvtap: left promiscuous mode [ 644.756010][T16530] veth0_macvtap: left promiscuous mode [ 644.761766][T16530] veth1_vlan: left promiscuous mode [ 644.767019][T16530] veth0_vlan: left promiscuous mode [ 644.974137][ T5291] 8021q: adding VLAN 0 to HW filter on device eth4 [ 645.242865][T16530] IPVS: stop unused estimator thread 0... [ 645.261410][ T5291] 8021q: adding VLAN 0 to HW filter on device eth3