last executing test programs:

2.271366529s ago: executing program 3 (id=3845):
socket$inet6_sctp(0xa, 0x5, 0x84) (async)
socket$inet6_sctp(0xa, 0x5, 0x84)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x8100, 0x0) (async)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x8100, 0x0)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8000) (async)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8000)
openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x80080, 0x0) (async)
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x80080, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0)
sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=0x0, @ANYBLOB="0000008800a10008000000"], 0x34}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000)
sendmsg$nl_route_sched(r1, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000000540)=@newtfilter={0x30c, 0x2c, 0x100, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xf, 0x10}, {0xc, 0xf}, {0xfff7, 0x3}}, [@TCA_CHAIN={0x8, 0xb, 0x20d0e}, @TCA_RATE={0x6, 0x5, {0x8, 0x9}}, @filter_kind_options=@f_route={{0xa}, {0x2bc, 0x2, [@TCA_ROUTE4_ACT={0x19c, 0x6, [@m_mirred={0xa8, 0xb, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4b, 0x2, 0x20000000, 0x7, 0x3}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xffffffff, 0x67, 0x6, 0x3ff, 0x5}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x8c, 0x5, 0x4, 0xcb0}, 0x4}}]}, {0x1b, 0x6, "62add8ab1ab9d4ab660863459a34905a26481635285f92"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_connmark={0xf0, 0x4, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5, 0x4, 0x2, 0xe1a8, 0x1}, 0x100}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x80000000, 0x4, 0x0, 0x1, 0x9}, 0xc82}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1d2, 0x5, 0x3, 0x1, 0x40}, 0xfffd}}]}, {0x6a, 0x6, "93667134e798f190d3acfca4686dd8049bcf48b2fbde0c9d6acb6d135c01718d608a74bd8b77e13d858c65a596b69dc5c0a80eba8be57f5e48cc9a5f9a395c6b214ee895f1c42a85896d0ef96e4bcdd8527fb7ca61289081d3aaa2abd964ae9bbf92f738e6cd"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0x5, 0x1}}, @TCA_ROUTE4_ACT={0x10c, 0x6, [@m_tunnel_key={0x108, 0xa, 0x0, 0x0, {{0xf}, {0x7c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x24}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x100, 0x60ef, 0x4, 0x9, 0xfffffff7}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @private=0xa010102}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @mcast1}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0x7}, @TCA_TUNNEL_KEY_NO_CSUM={0x5}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @loopback}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x39}}]}, {0x5f, 0x6, "4fe5a98e5ebf6f40127ce67958eed1c29374d59ef25e2ca6e6712663f4e10d5898005a0e15bf40cc8b77765cde39476c5f11c2e780bf69e0c372534152a955c5b2b1e3d4a2de2815b3000550fc6591502b536207156d8139cb80a4"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xe, 0x7}}]}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_CHAIN={0x8, 0xb, 0x5}]}, 0x30c}}, 0x0)
r3 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000000)={0x20002010})
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_flow={{0x9}, {0x40c, 0x2, [@TCA_FLOW_POLICE={0x408, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xa1, 0xffffffff, 0xda, 0x6, 0x0, 0x2a, 0x100, 0x73d, 0x3509, 0x3, 0x10000, 0x7, 0x1000, 0x8, 0x3, 0x3, 0x882e, 0x8, 0x6, 0x4, 0x9, 0xfffffffb, 0x2, 0x6, 0x80000000, 0x3fc, 0x9, 0xffff, 0x7a, 0x5, 0x7, 0x7fff, 0xffffff40, 0x9, 0x6, 0x8, 0x2, 0x57, 0x0, 0x4, 0x7fff, 0x9, 0xfffffffb, 0x2, 0xcf9f, 0x0, 0x1, 0x8, 0x1, 0x5, 0xfffffff9, 0x20d5, 0x80000001, 0x6, 0x4, 0x9, 0x8, 0xfffffffd, 0x5, 0x7, 0xc, 0x8, 0x4, 0x3, 0xfffffffe, 0x7, 0x3, 0x800, 0x1, 0x4, 0x2, 0x1, 0x1, 0x801e, 0x7, 0x1, 0x0, 0x8, 0x5, 0x8001, 0x4, 0x1, 0xfff, 0x9, 0x3, 0x7ff, 0xd0, 0x8, 0x0, 0x3, 0x1, 0x9, 0xe, 0x7fff, 0xfffffff8, 0x4, 0x0, 0xb1, 0x3, 0xffffff44, 0x1, 0x8, 0x200, 0x6, 0x556, 0x1, 0x2c, 0x5, 0x80000001, 0x1, 0x0, 0xffffff00, 0x3, 0x2, 0x7, 0x9, 0x1c00, 0x5, 0xa2, 0x3, 0x8, 0x0, 0x5, 0x8001, 0xbfffffff, 0x7, 0x80, 0x7, 0x0, 0x743, 0x5, 0x3, 0x7, 0x200, 0xd06, 0x0, 0x8, 0x3, 0x100, 0x2, 0x8, 0x1, 0x1, 0x8, 0xa, 0x7, 0x6, 0x4, 0x7ff, 0xfe, 0xfffffffe, 0x7, 0xf80, 0x7, 0x5a, 0x2302, 0xffff, 0x3ff, 0x2, 0x5, 0x1, 0x6, 0x3, 0x401, 0x10001, 0x512d, 0x1, 0xe, 0x8, 0xa3c0, 0x4, 0x8000, 0x10001, 0x15a, 0x6, 0x120000, 0x6b2, 0x7fffffff, 0x7, 0x9, 0x80000004, 0x5, 0x7e9, 0x48, 0x9, 0x3, 0x0, 0x5, 0x8, 0xf, 0xff, 0xd, 0x6, 0x9, 0x0, 0x200, 0x9, 0xff, 0x4, 0x7, 0x7, 0x8, 0x80000000, 0x56, 0x4a82, 0xffff0000, 0x7ff, 0x3e1, 0x6, 0x80000000, 0x4c0, 0x2, 0xa, 0x6, 0x2, 0x6, 0x8, 0x8000048, 0x1a, 0x2000000, 0x1ff, 0x844, 0x6, 0x3ff, 0x2, 0x100, 0x6, 0xffffffff, 0x200, 0xc26, 0x4, 0x5, 0x1, 0x7fff, 0xf, 0x401, 0x401, 0x4, 0x7, 0x3565, 0x2, 0x4, 0xebf, 0x9, 0x1000, 0x1, 0x71f, 0x2, 0x7, 0x6e8, 0x8, 0x0, 0x80000000, 0x1, 0x9, 0x2]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x800)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket(0x200000000000011, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r7=>0x0})
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r7, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40)
r8 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) (async)
getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async)
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
connect$can_bcm(0xffffffffffffffff, &(0x7f0000000200), 0x10)
sendmsg$sock(0xffffffffffffffff, &(0x7f0000001940)={&(0x7f00000002c0)=@sco={0x1f, @none}, 0x80, &(0x7f0000000000), 0x5, &(0x7f00000008c0)=[@timestamping={{0x14}}], 0x18}, 0x0)
getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) (async)
getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14)
sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="448000001000030427bd09000000000000000000", @ANYRES32=0x0, @ANYBLOB="40440900000000001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r11, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x20000600}, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x25, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002801400070000000000000000000000000000000001050004000100000008000a00", @ANYRES32=r9], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async)
sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x25, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002801400070000000000000000000000000000000001050004000100000008000a00", @ANYRES32=r9], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0)

1.958423779s ago: executing program 1 (id=3848):
r0 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=@newtfilter={0x30, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004884}, 0x24040084)

1.886250587s ago: executing program 4 (id=3850):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a010400000000004184000a0000010900010073797a31000000002400048020"], 0x80}, 0x1, 0x0, 0x0, 0x4008011}, 0x24000000)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a01000000000000000000050000000900010073797a300000000064000000120a01000000000000000000050000000900010073797a30000000000900020073797a31000000000800030000000006300004800800"], 0xb0}, 0x1, 0x0, 0x0, 0x20004081}, 0x40800)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x1, 0xc}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8864}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20040054)

1.707213638s ago: executing program 1 (id=3851):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x2, 0xc, &(0x7f00000013c0)=ANY=[@ANYBLOB="180200001000000000000000000000001801000020696c2500000000002020207b2af8ff00000000bfa100001800000007010000f8ffffffb702000008000000b70300000000000085000000ae000000870000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2a}, 0x94)

1.591761089s ago: executing program 3 (id=3852):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, <r1=>0xffffffffffffffff}, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0xb0ff, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

1.51966751s ago: executing program 4 (id=3854):
r0 = socket$netlink(0x10, 0x3, 0x0)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x310bb}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x30082, 0x22}}}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000081}, 0x24008000)
connect$netlink(r0, &(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfd}, 0xc)

1.519288266s ago: executing program 1 (id=3855):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_DEL_VIF(r2, 0x0, 0x15, 0x0, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20114}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_XMIT_HASH_POLICY={0x5, 0xe, 0x2}, @IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0x2}]}}}]}, 0x44}}, 0x0)
r4 = socket$inet6_sctp(0xa, 0x5, 0x84)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
unshare(0x400)
r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
r7 = getpid()
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000ac0)={<r8=>0x0, <r9=>0x0}, &(0x7f0000000b00)=0xc)
r10 = getgid()
r11 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000c80)=ANY=[@ANYBLOB="b4040000270000012bbd7000ffdbdf25c1025280f37b14eef577d3d34246e2af1ef013f97d1905b2a2d789916564ebe64afe05cb159e0038a7b122b5cef6b6076a7d988be7f9e0770a18008e800c004d00090000000000000008005000070000005600b5800c009a007b4028402e29270019d0b89d9ff6a88f39e8db17ecfc592812ec6a8179bf1bae3df4f2dbd302b81a87277f2380170400b2800800db00030000000400928005003d000000000008004d00", @ANYRES32=r9, @ANYBLOB="00000902d18004005d800800f100", @ANYRES32=r8, @ANYBLOB="0400118004009180040017800c00f0a52d429baa3530f87f883e874d01229182a9e5303e374490324c0956d0968343e9ca965128c9fd52b1dc1704e6f43a01213198533192267b46f599e6419627cc48af2f959e830a812469b81010cf7e1f80330f7df234966d3676084777e2c22c0504c46242efdbfa65354f0d7521b4f0fdd46a664b88ca002d651aa1ebf92adc75db14cd7c743f459629d9a0a023cd8bf4ca05e72663377aff3f855971fa7a52caa69bf84f2dfdd989155351a01518a25e659701b2a69229c8fe0cb996bb09ede8843a47055628fa89d4b4ab1b68ba7dd0b4ff35a35c9ea8cd229020c8d6a27f536086b51f4a124e36e1160bb433c2eb309f58e7c8ead81ca4a0e7bef83201f81b8a2cf8717b3b1cabaf00f722cd1f7ae51cc4f81b0227b411749091a19d424c6870076ec4c526c71e44c50d56172b11790147b9104b2ef61db789cbc4938796843a7b902c475c939a1ee848498217a5e59c090104000e800400808041b01340ac0f51f620ca80495d3cb763b191f963568d3af528ecb21030abf8466444b96e17a3bd42a9593dc3c3338403eec23e4f33d4285172c3f374396d79e490eb2b00ff91a49d7bd0c3962f7e3d39dc3554576ded725336df1029ef214a6f2735d5ac824a482c6e640e4ee344f4c8d366fa1ebe0b3e54707ffe637d74571b0d326e32c14d881740a377afa82a0000000900fd0068667363000000000000000c00b6001700000000000000336d4d786b48d588edab178ee645a896afe69e7e490f75e299bf14b6076301b52867c370c72cb559f780ad6b284fb4ca4a885d1a609c67ee0ca23f9bb4004d800c004400ffffffffffffffffa40048006c3bea450f25d9261c1499c7ab7bf8b25c622a6dae30b49b60e5a50d96b15009e7b0d5f72077ab611c5afe4a79643c6da0587b7f1c223cb241108e0ebd80c846a2322d7098ab28710493acc1a3fff991f9a238a30dba04d3d31bee650aeffb030c8a43fac3546e5416136bca5452972e04122fb18a6a4710acbb4a77f078541cb0e92d640f817c7a852fcddfaa83066d0fe327d4450dba8f1b6b783e8b1227f205c6c57a7690e3c85538e5d8495f0a60d4976650aafdd7b48026387af500ff5eaea363c46cf1ee6a4e8419c861ba95f34f25c77cb70ab7f697c322a751d9950276537c7b37569b2adf0c00088008007600", @ANYRES32=0x0, @ANYBLOB="08001b00f1000000810001800c00430078030000000000000c00570001000000000000800800b900", @ANYRES32=0x0, @ANYBLOB="0400da8061ccb614bd9662a295f1fb480b5b63c2bdf940bc76036cdcfc96ececdb8462483f4b508fe3766a0de1a03aad8616d3d81a4b6a482f6885fd3e9cc13d6f97fe2e5ea528f39efeed4bdf85dd9c432d6f3dbc243ef0c808cafd8f000000000000"], 0x4b4}], 0x1, &(0x7f0000000b40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [r11]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {r7, r9, r10}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @cred={{0x1c}}], 0xf8, 0x20000854}, 0x24004044)
syz_open_procfs$namespace(r7, &(0x7f00000000c0)='ns/mnt\x00')
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0)
r12 = socket$inet(0x2, 0x3, 0x2)
setsockopt$IP_VS_SO_SET_ZERO(r12, 0x0, 0x48f, &(0x7f0000000040)={0x84, @private=0xa010101, 0x4e20, 0x2, 'nq\x00', 0x18, 0xfd1e, 0x40}, 0x2c)
socket$nl_xfrm(0x10, 0x3, 0x6)
setsockopt(r4, 0x84, 0x7d, &(0x7f0000000180)="02bdd20009d2bb37", 0x8)
r13 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', <r14=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r14, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0xc}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x5fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084)
r15 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x5}, 0x50)
socket$nl_generic(0x10, 0x3, 0x10)
r16 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000003c0)={0x0, 0x3, 0x18}, 0xc)
bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x21, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000002aca00000000000040000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000090000008500000006000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000066f01001b000000180000000000000000000000020000001830000002000000000000000000000018430000fcffffff000000000000000018120000", @ANYRES32, @ANYBLOB="0000000400000000b703000000000000850000000c000000b7000000000000001852000010000000000000000000000095000000000000009ce16313cdf78adaaea9ad50d9697ee48ad4ab5d8c493d935f6436872f452ecd84cfec8b57f29cbd746197ad42dd4f685afa6d189574b88a65e2bd63a860ddf8a2ea9290d1d5667ddec1a510c5c9a0cbbdd6576150b9151c10f7e34b13fa256f996197f4bf37a357487f81979a21a0e386b4d2a9e108c95f4a41c25d01118b61c949403a0210046e01bb8a40ebdaded31356c2a5f700"/221], &(0x7f0000000180)='GPL\x00', 0x1755, 0x0, 0x0, 0x41000, 0x410ff80607b8bc20, '\x00', r14, @fallback=0xb440a2f19062594a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000001c0)={0x4, 0x3, 0x2, 0x10001}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x9, &(0x7f0000000400)=[r15, r16], &(0x7f0000000440)=[{0x3, 0x1, 0xa, 0x1}, {0x2, 0x5, 0x1, 0xa}, {0x3, 0x1, 0xc, 0x4}, {0x3, 0x5, 0x9, 0x2}, {0x4, 0x2, 0x5, 0xc}, {0x5, 0x3, 0x5, 0x8}, {0x4, 0x1, 0x7, 0x6}, {0x5, 0x4, 0x7, 0x4}, {0x5, 0x3, 0xf, 0x8}], 0x10, 0x2}, 0x94)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="640000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00430100000000003c0012800b000100697036746e6c00002c00028014000200ff020000000000000000000000000001140003002001000000000000000000000000000208000500", @ANYRES32=0x0, @ANYBLOB="86333b00780fae112863fa49f1a59415f47ed81df065f4f199a1bb69c427f21e9645553debdf461ca6497782c1e583c5c4859567da905365c116a64b07ad0c4f11cc9d4153ade3953d1aedab17a00a1861fbc3409a99dae03888715a133a436fc4491704be5ddecda4b2da4a8ff0917ef3d304379bbfc9b83e32ad6b1be8673d165513dce6e78be9c8ad6e53ea97875300000000000000000000000000e28f22045bf2a1ace699c2c2a72c44860d6e644a33df35725d08a4d7c68567e6faa61b1f9b12233c401db189dcfaf3eaf0a32b841f9bf19ad84e22750137d3770e9ed6f79f901a6e55ab1ada"], 0x64}}, 0x800)

1.517969838s ago: executing program 2 (id=3856):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0xe84, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0xe58, 0x2, [@TCA_FW_ACT={0xe54, 0x4, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x4, 0x1ff, 0x20000001, 0xc, 0x6}, 0x7f, 0x5}, [{0x2a9, 0x6, 0x1, 0x4, 0x5}, {0x4a7, 0x1ff, 0x4, 0x1, 0x7, 0xdd}, {0x9, 0x7, 0x3ff, 0x7, 0xfffffffd, 0x5}, {0x8, 0x0, 0x6, 0x2, 0x7fff, 0x3}, {0x4f9a, 0x5, 0x1, 0x1, 0x2, 0x8}, {0x0, 0x5, 0x1437, 0x0, 0xee57, 0x9}, {0x77d, 0x8, 0x9, 0x6, 0x8, 0x1}, {0x5, 0x0, 0x0, 0x2, 0x1, 0x7fff}, {0x0, 0x5, 0x4235da1, 0x9, 0x7ec9, 0x8}, {0x10000, 0x2, 0x0, 0x9, 0x3, 0x9}, {0xd, 0xffff0001, 0x0, 0x6, 0x81, 0x4}, {0xfffffffc, 0x4, 0xffff, 0x8, 0xffffffff, 0xfffffffa}, {0x5, 0xd29, 0x101, 0x3, 0x7, 0xc}, {0x0, 0xfffffff7, 0x1, 0x72b2, 0xc874, 0x3}, {0x3, 0xf, 0x8, 0x1, 0x1ff, 0x40}, {0x9b9b, 0xffff, 0x6, 0xb, 0xb3d, 0x812}, {0x5, 0x7, 0x2, 0x5, 0x5, 0x4}, {0x6, 0x0, 0x9, 0x2, 0x82, 0x2}, {0xfffffff7, 0x6, 0x2, 0x9, 0xff}, {0x4, 0x1, 0x371, 0x8, 0xfffffffb, 0xeac}, {0x9, 0x2, 0xd77, 0x8, 0x113, 0x8d3f}, {0x10000, 0xffffffff, 0x4, 0x92a4, 0x9, 0x10}, {0x1a4a13f0, 0x9, 0xe, 0x3, 0xad47, 0x2}, {0x7, 0x5, 0x7, 0xfff, 0x9}, {0x100, 0x4, 0x200, 0x9, 0x1, 0x9df}, {0x9, 0x1, 0x65, 0x9, 0x7}, {0x401, 0xffff, 0x9, 0x44, 0xc, 0x1}, {0x6, 0x10, 0xf, 0x80002, 0x6, 0x44}, {0xf23, 0x3ff, 0x0, 0x4000009, 0xffffffff}, {0x80000000, 0x6, 0x0, 0x6, 0x6, 0xd}, {0x0, 0x9, 0xd, 0x8000, 0x3, 0x2}, {0x800, 0x9, 0x6, 0x3, 0x7, 0x8}, {0x7, 0x8, 0x7358, 0x7, 0x400, 0xffffffff}, {0x4d9, 0x45db8bad, 0xb3dd, 0x81, 0xbc, 0x7ff}, {0x7, 0x1, 0x3, 0x3, 0x3, 0x7a}, {0x5a1b, 0x1, 0x1, 0x7ff, 0x3, 0x1}, {0x3, 0x7, 0x4, 0x4, 0x1c716ddc, 0x2}, {0xffffffa5, 0x7, 0x0, 0x10, 0x3, 0x5}, {0x8219, 0x0, 0x2, 0x6, 0x3, 0x2}, {0x62, 0xf4, 0x5, 0x4, 0x4, 0x6f}, {0x5, 0x4, 0x53, 0x8, 0xc0000000, 0x7}, {0x2, 0x5, 0x2, 0xffff, 0x2, 0x2}, {0x80000001, 0x94c, 0x6, 0xfffffe00, 0x5, 0x7b27}, {0x2, 0x2, 0x1000, 0x9, 0x9}, {0xe, 0x0, 0x9, 0x4, 0xe, 0x9}, {0xdf, 0x7fff, 0x8000, 0x81, 0xff, 0xfffffff8}, {0x2, 0x10000, 0x9, 0x2, 0x2}, {0x2, 0x6, 0x9, 0x1, 0x2, 0x40}, {0xfffffe00, 0x3, 0x74d2, 0x3, 0x80000001, 0x6}, {0xe3f6, 0x8, 0xfffffff7, 0x1, 0x6, 0xc}, {0x8, 0x9, 0x8e, 0x33, 0x10001, 0x22cb}, {0x2, 0x31f1, 0x7, 0x5, 0x7fffffff, 0x1}, {0x9, 0x10001, 0x4, 0x8, 0x7, 0x9}, {0xb, 0x1ff, 0xb, 0x3, 0x5, 0x80000001}, {0x7, 0x7, 0x69b, 0x3, 0x8, 0x339}, {0xee, 0x80000000, 0xfba6, 0x101, 0x5, 0xb}, {0x3, 0x458, 0x6, 0xf, 0x7, 0x8000}, {0x9, 0xfffffffa, 0x1000, 0x8, 0xb, 0xce5a}, {0x400, 0xffff, 0x3, 0xbcbb, 0x7, 0xb}, {0x0, 0xe000, 0xb, 0x8, 0x2, 0x1}, {0x1, 0x0, 0x2, 0x9, 0x0, 0x401}, {0xd, 0x1, 0x2, 0xf, 0x81, 0x5}, {0x6, 0xfff, 0x3, 0x5, 0x3ff, 0x3649}, {0x800007, 0x2, 0x80000000, 0x9, 0x1630, 0x9e73}, {0xb, 0x1b6, 0xc5, 0x3, 0x4, 0xca}, {0x4, 0x5, 0x401, 0x4, 0xfffffff8, 0x40}, {0x8, 0x4594, 0x8, 0x4, 0x0, 0xffff}, {0x100, 0xfffffffb, 0x6, 0x0, 0x9, 0x6}, {0x3, 0xf7b, 0x3, 0x8, 0x6, 0x3}, {0x1, 0x5, 0x3, 0xab9, 0x7, 0x9}, {0xffffffff, 0x4, 0xfc, 0x7, 0x6, 0x10}, {0xf, 0xfffffffe, 0xa000000, 0x1, 0x101, 0x1f3}, {0x7ff, 0x9, 0xfffff001, 0x8001, 0x2, 0x2}, {0x4, 0x10001, 0x6, 0x1, 0x9, 0xfffffff8}, {0x3, 0xa, 0x7, 0x9, 0x10, 0x1}, {0x5, 0x100, 0xffffffff, 0x963, 0x2, 0xc}, {0x6, 0x50, 0x6, 0xa, 0x0, 0x3}, {0x649, 0x2, 0x80000001, 0x8, 0x0, 0x1}, {0x8, 0xfff, 0x6, 0x80000001, 0x7fffffff, 0x3}, {0xa3, 0x81, 0x9fcb, 0x1, 0x8, 0x7fff}, {0x0, 0x2, 0x750c, 0x0, 0x1, 0xfffffffc}, {0x7ff, 0x7, 0x10000, 0x94, 0x4, 0x40000088}, {0x5, 0x10001, 0x7fff, 0x81, 0xfffffff4, 0x7}, {0x5, 0x7, 0x5, 0x2, 0x1ff, 0x80000001}, {0x3, 0x0, 0x3ff, 0x7fffffff, 0x9, 0x7}, {0xdac, 0x0, 0x4, 0x80000001, 0x3, 0x8}, {0x7, 0xffffffff, 0x6, 0x8, 0x80000001, 0xa}, {0x2, 0x4, 0x4, 0x401, 0xe32}, {0x5, 0x10000007, 0x6, 0x8, 0x2, 0x2}, {0x10001, 0x5, 0x3, 0x4, 0x9, 0xfffffffa}, {0x2, 0x3, 0x3, 0x6, 0x800, 0x7}, {0x0, 0x0, 0x3, 0x2, 0x1, 0x3}, {0x3, 0x3, 0xffffffff, 0x3, 0x800, 0xde}, {0x5, 0x66, 0x41d0, 0x8001, 0xc851, 0x3}, {0x6, 0x731, 0xfffffffc, 0x4, 0x3, 0x92c}, {0x4, 0xffff, 0x0, 0x101, 0x4, 0x1}, {0x9, 0xf667, 0x5, 0x0, 0x9, 0x4}, {0x1731, 0xa, 0x9960, 0x9, 0x1, 0x7}, {0xd, 0xfffffffa, 0x1, 0x3, 0x40, 0x2}, {0x1, 0x4, 0x80000000, 0x80000001, 0x2, 0x6}, {0x7, 0x2, 0xffffff3a, 0x4cf, 0x800, 0x6}, {0x8000, 0x6, 0x1, 0x0, 0x100, 0x80000000}, {0x3b, 0x5562334a, 0x2, 0x2, 0x6, 0x81}, {0x5a, 0x96, 0x81, 0x0, 0x101, 0x7}, {0x4, 0xff, 0x9, 0x0, 0x81, 0x29}, {0xa, 0x5, 0x0, 0x9, 0xffffffff, 0xfb4}, {0x80000000, 0x2, 0xffff, 0x39b4, 0x1, 0x800}, {0x61, 0x29, 0x6, 0x1fe4c5d2, 0x1, 0x3}, {0x1, 0xe2, 0x7ff, 0x7ff, 0x7f, 0x29d0}, {0x0, 0x4, 0xc, 0xd594, 0x9, 0x7}, {0x8, 0x0, 0x7, 0x9, 0x7, 0x9}, {0x80e9, 0x7, 0x9, 0x1, 0x1, 0x18000}, {0x400, 0x9, 0x0, 0x6f}, {0x2, 0x1, 0x6, 0x3, 0xfffff71b, 0xce}, {0x1, 0xff, 0xb, 0x4, 0x800, 0x1}, {0x6, 0x2, 0x8, 0xfff, 0x4, 0x7fff}, {0x0, 0x0, 0x7f, 0x401, 0x7, 0x7fff}, {0x7, 0xb, 0x10000, 0x1, 0x8000, 0xfffff830}, {0x3, 0x4, 0x2, 0x1, 0x3, 0x2b4}, {0x3cd2dbce, 0x929a, 0x9dc, 0x0, 0x8, 0xfffffffc}, {0x6, 0x9, 0xe61, 0xc5c3, 0x3, 0x1}, {0x4, 0x2, 0x197a, 0x7, 0x1, 0x8}, {0xff, 0x2c, 0xfffffc01, 0x1, 0x3, 0x100}, {0x0, 0x6, 0x10001, 0x40ce7, 0xec, 0x1000}, {0xffffffff, 0x6, 0xffffffff, 0x9, 0x2, 0x6}, {0xfa, 0x9, 0xbf1d, 0x9, 0x80, 0x5}, {0x1c91, 0x5f27, 0x1, 0x0, 0x6, 0xcf}, {0x37, 0x622, 0x2, 0x1, 0x7, 0x2}], [{0x5}, {0x4}, {}, {0x2}, {0x2}, {0x0, 0x1}, {0x3}, {0x4}, {}, {0x1}, {0x1}, {0x2}, {0x3}, {0x0, 0x1}, {0x5, 0x1}, {0x2}, {0x4, 0x1}, {0x1}, {0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1}, {}, {0x2, 0x1}, {0x2, 0x1}, {0x2}, {0x2, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {}, {0x3}, {0x3, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {}, {0x5, 0x1}, {0x3}, {0x2}, {0x4}, {0x5}, {0x3, 0x1}, {0x2}, {0x1, 0x1}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x2}, {0x4, 0x1}, {0x2}, {0x1, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0xed3229170eca159}, {0x2, 0x1}, {0x1}, {0x3}, {0x3, 0x1}, {}, {0x2, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x3}, {0x4}, {0x3, 0x1}, {0x1}, {0x3}, {0x1, 0x1}, {0x2}, {0x5, 0x1}, {0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x5}, {0x5}, {0x1, 0x1}, {0x4}, {0x4}, {0x5}, {0x54e1b160e6ec45e8, 0x1}, {0x1}, {0x2}, {0x3, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x4, 0x1}, {0x4, 0x1}, {0x5}, {0x0, 0x1}, {0x3}, {0x0, 0x1}, {}, {}, {0x2}, {0x5, 0x1}, {0xfff2}, {0x2}, {0x9baeccaf277094c4, 0x1}, {}, {0x2, 0x1}, {}, {}, {0x8f9fc2e2ef57f2f0}, {0x3, 0x1}, {0x2, 0x1}, {0x2}, {0x3}, {0x3}, {0x2, 0x1}, {0x2, 0x1}, {0x1}, {0x1}], 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0xe84}, 0x1, 0x0, 0x0, 0x81}, 0x800)

1.380403827s ago: executing program 3 (id=3858):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000c80)={0x2, 0x0, @local}, 0x10)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$inet_sctp(0x2, 0x5, 0x84)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r4 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={<r5=>0x0}, &(0x7f0000000080)=0x8)
sendto$inet6(r3, &(0x7f00000004c0)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x5, @loopback}, 0x1c)
shutdown(r3, 0x1)
setsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000140)={r5, 0xca, 0x80000000, 0x5}, 0x10)
setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000180)={r5, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x6, 0x800}, 0x90)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@delsa={0x34, 0x12, 0x1, 0x0, 0x25dfdbff, {@in=@dev, 0x0, 0x0, 0x33}, [@mark={0xc, 0x15, {0x0, 0xff}}]}, 0x34}}, 0x4840)
sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x4)
r7 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r7, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10)
connect$inet(r7, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10)
sendmmsg$inet(r7, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0)
bind$inet(r7, &(0x7f0000000140)={0x2, 0x4e21, @multicast2}, 0x10)
connect$inet(r7, &(0x7f0000000280)={0x2, 0x4e24, @broadcast}, 0x10)

1.171675924s ago: executing program 1 (id=3859):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={<r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f00000002c0)=@ethtool_modinfo})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r4=>0xffffffffffffffff})
getsockopt$sock_buf(r4, 0x1, 0x1f, &(0x7f0000001680)=""/193, &(0x7f0000000180)=0xc1)
setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10)
sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c0000001a0001ff80000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="06001c"], 0x2c}}, 0x0)
setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000300), 0x4)
recvmmsg(r1, &(0x7f0000000f80)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000040)=""/11, 0xb}], 0x1}, 0x32c1}, {{0x0, 0x0, 0x0}, 0x80000001}], 0x2, 0x2, 0x0)
ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r3, 0x4058587a, &(0x7f0000000340)={{<r5=>r0, &(0x7f0000000080)='*\x00', 0x34042, &(0x7f00000001c0)={@align=0x6, {0xff6e, 0x1000, 0xfff, 0x9}}, 0x85c, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000240)}, {[0xfffffffd, 0x4, 0x74, 0x3]}, 0x0, 0x32, &(0x7f0000000280)=""/50})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000740)={'wlan1\x00', <r8=>0x0})
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@ipmr_delroute={0x2c, 0x19, 0x1, 0x0, 0x0, {0x80, 0x20, 0x10, 0x2, 0x0, 0x4, 0x0, 0x5}, [@RTA_MARK={0x8, 0x10, 0x10000}, @RTA_TABLE={0x8, 0xf, 0x6e75}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004040}, 0x8000)
sendmsg$NL80211_CMD_REGISTER_FRAME(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r8, @ANYBLOB="05005b"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x7c, r7, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x5}, @NL80211_ATTR_REG_RULES={0x40, 0x22, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xe}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xa644}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x6}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x7}]}]}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'aa\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2b}]}, 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x2)
sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f0000001840)="da", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="1daf", 0x2}], 0x1}}], 0x2, 0x4040081)

1.165505387s ago: executing program 4 (id=3860):
r0 = socket(0x40000000015, 0x5, 0x0)
bind$inet6(r0, &(0x7f0000000f80)={0xa, 0x4, 0x0, @loopback, 0xa7a}, 0x1c) (async)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 64)
r3 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_DEL_MIF(r3, 0x29, 0xc8, 0x0, 0xc000000) (async, rerun: 64)
setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x2006, @mcast2, 0x383}, {0xa, 0x0, 0xfffffffe, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1}, 0x0, {[0x1, 0x0, 0x0, 0x6, 0xffffdffd, 0x4b9a, 0xfffffffc, 0xfffffffe]}}, 0x5c) (rerun: 64)
sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000640)=ANY=[@ANYBLOB="7c01000019000100fcffffff10000000ffffffff000000000000000000000000e000000100000000000000000000000000000000f7fb20000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000800000000000000900000000000000080000000000000000000000000000000000000000000000fdffffffffff1f00010000000000000009000000000000008000000000000000000000000000000000000000000000000201000300000000c400050064010102000000000000000000000000000004d43200000000000000fc0200000000000000000000000000010635000000000200000000000000000000000000fe80000000000000000000000000000e000004d4320000000a000000fe8000000000000000000000000000aa00007f0003000000000000000000000000000000fe8000001422f00000000000000000000000bb0000000033000000000000000a01010100000000000000000000000004350000"], 0x17c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) (async)
sendmsg$OSF_MSG_ADD(r1, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="68020000000501040000000000000000010000045402010003000000050000000c0300a00300340073797a30000000000000000000000000000000000000000000000000000000003f5a4b4b07bb6dc6429ecc6c43cd068b28d2d2e51689a1d99c2d42a59fdc62b8fcd24d468918b853e8e0df8098bd105f3f60dfbdad018ac95bd5c70000020028000200000007000000780000020100000000000000ff03760b030000001000000000200a0003000000000000000500e7080100000002000000040000800000000005000000faff0000030000000100008003000700000000002c7200000400ff0300000000400000000008050002000000a89034520700d90b03000000050000000700050002000000000000000400040001000000b8080000740f000800000000010000000500010003000000070000000100ff0f00000000010000000600020001000000000000000700020000000000010000000900e500000000000500000004006b00030000000000000002000008010000005f040000f9ff0400000000000a0000000100ee5603000000a5f5ffff0200fbff03000000030000003300060001000000f4f80000f2ff0100000000006b0d000040007e7e01000000a00000000d000b000100000000080000080007000200000000000000fdff0300030000000200000002000500030000006a000000040000000300000003000000008002000300000001800000010106000100000000000100050000800200000036000000ff038100010000000000000004007f0001000000890400000100f5ff00000000090000000100070000000000a3000000"], 0x268}, 0x1, 0x0, 0x0, 0x20001}, 0x44008)

1.102352938s ago: executing program 2 (id=3861):
r0 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=@newtfilter={0x30, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004884}, 0x24040084)

931.481379ms ago: executing program 0 (id=3862):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x2c, 0xb, 0x6, 0x801, 0x0, 0x0, {0x6, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008041}, 0x24008084)
r2 = socket(0x10, 0x803, 0x0)
setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000240)={{0x1d, @empty, 0x4e21, 0x1, 'none\x00', 0xe, 0xffffff00, 0x60}, {@loopback, 0x4e24, 0x2, 0x9, 0x3, 0x3}}, 0x44)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000200100000", @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r2], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @rand_addr=0x64010100}, @IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e24}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)

912.82934ms ago: executing program 2 (id=3863):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000000540)=@newchain={0x3c, 0x64, 0x300, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0xfff3}, {0xffff, 0x9}, {0x2, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x8, 0xfd}}, @TCA_RATE={0x6, 0x5, {0xec, 0xfc}}, @TCA_CHAIN={0x8, 0xb, 0x81}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x80)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0)

894.003938ms ago: executing program 1 (id=3864):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf092000000000003509010000000a009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf9800003fffffff0d08000000000000850000001b300000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94)

841.179579ms ago: executing program 4 (id=3865):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="7e1d28f3f72114c52a2d25d066cbbeb9e7b3acd2bbb0ed9f51cc01994500d75726354ffcd09dfdbe4e110f994e602796f2245c6f5fca05cff74961712eb95129e03f21d7723a56925144d9d8d346a7fb8bb5", @ANYBLOB="3c56e7cf03a5b560fbcaf67b73ed64adcfbf6ea825e60d3c4d4374ccf41c9c362b4ef3b196bd67d719938e15c50ecc5eff01c18ad727b7bfe2991c7f1719d47ef411127a3a2325a7ec80437ffc7e85d0ac75e7cffbbbe71d51fda90a7a9e7484b78829fa346bd5ba7630dac446899ffa8f6607d7ec0a13c526c3eb70f64294c0b1b342a780e9f33d67bca96ca571c30f1db0ff486b9d"], 0x32600)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000002, 0x13, 0xffffffffffffffff, 0x0)
r1 = socket$xdp(0x2c, 0x3, 0x0)
getsockopt$XDP_STATISTICS(r1, 0x11b, 0x8, 0x0, &(0x7f0000000040))
r2 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0x53b, 0x70bd29, 0x25dfdbfd, {}, [{0x4c, 0x1, [@m_simple={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x9f}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4060040}, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000008000))
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r4)
sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="580000220206050000000000000000000700000505000400030000000900020073797a32000000001400078005001500060000e10700124000000000050005000200000005000100060000000c000300686173683a69700059a3d4c68630f7d7483d5a71997e5c7ee00cccfc6467d30f48507359abd3ecc5dbbf0b80a8d1f971228480b85cc1dfe1e85c02f7315d8decb1e481fc0273340c9667ed69cb5ef3b656063fb2b74d62581899ec9679a0fd555e32fa30f30fe9dde2779dcb211448bdc221296b635c3b7c68958d58d3b45d"], 0x58}, 0x1, 0x0, 0x0, 0x20000800}, 0x0)
r5 = socket(0x1e, 0x4, 0x0)
r6 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2}]}, 0x6c}}, 0x0)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f00000003c0)=0x1c, 0x4)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f00000001c0)=0x6310, 0x4)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r8, 0x0)
connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10)
recvmmsg(0xffffffffffffffff, &(0x7f00000018c0), 0x3fffffffffffe83, 0x2, 0x0)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0], 0x48}}, 0x2404c054)
getsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000340), &(0x7f0000000380)=0xe)
readv(0xffffffffffffffff, &(0x7f0000001480)=[{&(0x7f00000000c0)=""/58, 0x3a}], 0x1)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2000009, 0x12, r0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

840.871766ms ago: executing program 0 (id=3866):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x4a0, 0x368, 0x1d0, 0x368, 0x1d0, 0x0, 0x408, 0x408, 0x408, 0x408, 0x408, 0x6, 0x0, {[{{@ip={@remote, @multicast1=0xe0007600, 0x11000000, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'macvlan1\x00', {}, {}, 0x11, 0x0, 0x9}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1d00, 0x0, @local}}}, {{@ip={@private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'vlan1\x00', 'nr0\x00', {}, {0xff}, 0x1d}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@rand_addr=0x64010101, @loopback, 0xffffff00, 0xff000000, 'veth1_to_team\x00', 'ip6erspan0\x00', {0xff}, {}, 0x32, 0x0, 0x9}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x9, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500)

835.472275ms ago: executing program 3 (id=3867):
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r1, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c)
r2 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r2, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e)
r3 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r3, &(0x7f0000000480)=@abs={0x1, 0x0, 0x4e20}, 0x1c)
sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0xc0, 0x30, 0x1, 0x0, 0x25dfdbfe, {}, [{0xac, 0x1, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x0, 0x0, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x9, 0xb, 0x12, 0x6, 0x695}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xc0}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r4 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400000002080103000000080000000002000005a7f8683392b2657517cb16030f"], 0x14}, 0x1, 0x0, 0x0, 0x24000804}, 0x2)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x300, 0x0)
ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000108000)={{0x0, 0x8, 0x100000000, 0xfffffffffffffffc, 0x0, 0x8, 0x9, 0x400, 0x3, 0x4, 0x36a58e4a, 0xd, 0x2, 0x75, 0x1}})
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$FS_IOC_GETFSLABEL(r5, 0x81009431, &(0x7f0000001b80))
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x1000)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000006000000000000000200008409010000040000000400000001000000000000000001000009000000003000002e"], &(0x7f0000000f40)=""/4079, 0x42, 0xfef, 0x8}, 0x28)
setsockopt$inet6_tcp_int(r5, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4)
shutdown(r5, 0x0)
recvmmsg(r5, &(0x7f0000001980)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/26, 0x11}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47}, {&(0x7f0000000100)=""/224}, {&(0x7f0000000200)=""/4096}, {&(0x7f0000001200)=""/124}, {&(0x7f0000001280)=""/60}]}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000001840)=[{&(0x7f0000001400)=""/149}, {&(0x7f0000001b00)=""/118}, {&(0x7f0000001540)=""/188}, {&(0x7f0000001600)=""/57}, {&(0x7f0000001640)=""/135}, {&(0x7f00000014c0)=""/101}, {&(0x7f0000001780)=""/171}], 0x0, &(0x7f00000018c0)=""/176}}], 0x15cbc1ab4c0933f, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)

695.602822ms ago: executing program 2 (id=3868):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, <r1=>0xffffffffffffffff}, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0xf3ff, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

674.384506ms ago: executing program 4 (id=3869):
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="2300000005000000000400000900000001"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x79, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000600780850000000f"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000005c0)={'syztnl2\x00', <r3=>0x0, 0x29, 0x4, 0x3, 0x80000001, 0x2e, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @empty, 0x20, 0x8, 0x100, 0x1}})
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000240)={'syztnl2\x00', 0x0})
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="340000004100070128bd7000f6ffffff017c0000050042800c000180060006000a000000100002800c00080000000180"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000000000000000000000f9000065e35ab9375fb14406000000fca8d71a5b0691cd41384d639b174fd8277ce541946fc8bdcd03c1b38216926d9a0076789cbe", @ANYRES16=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b704000000000000850000005700000095"], 0x0, 0x100, 0x0, 0x0, 0x41000, 0x13, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x14, &(0x7f00000009c0)=ANY=[@ANYRESHEX=r6, @ANYRESHEX=r3, @ANYRES8=r5], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5e, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r7}, 0xc)
r8 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r8, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, 0x0, 0x0)
r9 = accept4(r8, 0x0, 0x0, 0x800)
sendmmsg$alg(r9, &(0x7f0000000cc0)=[{0x0, 0x0, &(0x7f00000003c0)}], 0x1, 0x600008d0)
recvmmsg(r9, 0x0, 0x0, 0x40000140, 0x0)
sendmsg$MPTCP_PM_CMD_REMOVE(r9, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x110}, 0x240400d4)
write$cgroup_int(r4, &(0x7f0000000200), 0xffffffc1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0)
r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[], 0x0, 0xfffffffffffffe1b}, 0x28)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="020000000400000008000000800100e10080004000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r10, @ANYBLOB="000000000100"/28], 0x48)
mmap(&(0x7f00007a6000/0x3000)=nil, 0x3000, 0x100000c, 0x22051, r4, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xba0c29e690d41d4b, 0x20000000ec071, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

643.450439ms ago: executing program 1 (id=3870):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0xffffffff, 0xe, 0x0, &(0x7f00000000c0)="05004013ffffffffa000c4353512", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50)
sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a310000000038000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000000004000480080007006e6174"], 0xc0}, 0x1, 0x0, 0x0, 0x4000004}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'ip6tnl0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xe32b60fbedc7f0cc}, {0x7}, {0x0, 0xa}}}, 0x24}}, 0x0)
r5 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt(r5, 0x1, 0x4, &(0x7f00000012c0)=""/179, &(0x7f0000001380)=0xb3)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r6=>0xffffffffffffffff})
close(0x3)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
ioctl$int_in(r7, 0x5452, &(0x7f0000000280)=0xffffffffffffffff)
sendto$inet6(r7, &(0x7f0000000300)="8b", 0x1, 0x44080, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c)
setsockopt$sock_int(r6, 0x1, 0x20, &(0x7f0000000040)=0x5e29ee14, 0x4)
ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000340)={r0, &(0x7f0000000040)='GPL\x00', 0x5c400, &(0x7f0000000080)={@_ha_fsid={[0x2a, 0x6]}, {0x9, 0x9, 0x2, 0x2}}, 0xf383, &(0x7f0000000280), &(0x7f00000002c0)=0x4})
bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

555.868081ms ago: executing program 0 (id=3871):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000020000103000000000000000180000000000000001a0000000c000c400000000000000003"], 0x28}}, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0xd, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@tail_call={{0x18, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, {}, {0x85, 0x0, 0x0, 0x3b}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94)

529.984826ms ago: executing program 3 (id=3872):
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$inet(r0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@ip_pktinfo={{0x1c, 0x110, 0xd, {0x0, @local, @broadcast}}}], 0x20}, 0x24000090)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x18, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x10, 0x0, 0x0, 0x1}]}}, @AF_BRIDGE={0xfffffec3}]}]}, 0x40}}, 0x0)

484.174303ms ago: executing program 2 (id=3873):
r0 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=@newtfilter={0x30, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004884}, 0x24040084)

339.452479ms ago: executing program 4 (id=3874):
recvmmsg(0xffffffffffffffff, &(0x7f0000001980)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/26, 0x11}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47}, {&(0x7f0000000100)=""/224}, {&(0x7f0000000200)=""/4096}, {&(0x7f0000001200)=""/124}, {&(0x7f0000001280)=""/60}]}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000001840)=[{&(0x7f0000001400)=""/149}, {&(0x7f0000001b00)=""/118}, {&(0x7f0000001540)=""/188}, {&(0x7f0000001600)=""/57}, {&(0x7f0000001640)=""/135}, {&(0x7f00000014c0)=""/101}, {&(0x7f0000001780)=""/171}], 0x0, &(0x7f00000018c0)=""/176}}], 0x15cbc1ab4c0933f, 0x0, 0x0)
socket$unix(0x1, 0x2, 0x0) (async)
r0 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
sendmsg$unix(r0, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x303de1f53b11ae}, 0x20008840) (async)
sendmsg$unix(r0, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x303de1f53b11ae}, 0x20008840)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000080)=0x7, 0x4) (async)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000080)=0x7, 0x4)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x44f3, 0x4)
recvmmsg(r0, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/57, 0x39}, 0x8}], 0x3ffffffffffff2e, 0x1000400000de, 0x0) (async)
recvmmsg(r0, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/57, 0x39}, 0x8}], 0x3ffffffffffff2e, 0x1000400000de, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
socket$inet_udp(0x2, 0x2, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[], 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000008000000000000000900000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000004000000850000008600000095"], &(0x7f0000000600)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
r3 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r3, &(0x7f00000023c0)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa}, 0x1c, &(0x7f0000000000)=[{&(0x7f00000002c0)='G', 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000001300)="1f", 0x1}], 0x1}}], 0x2, 0x880)
shutdown(r3, 0x1)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000380)={0x0, 0xfff}, 0x8) (async)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000380)={0x0, 0xfff}, 0x8)
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async)
sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) (async)
recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0)
r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="0080000000800000fb00000000000000000000f4", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="0080000000800000fb00000000000000000000f4", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r7, 0x86dd, 0x26, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r7, 0x86dd, 0x26, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f00000012c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={<r9=>0xffffffffffffffff, <r10=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f0000000180)=r8, 0x4)
sendmsg$inet(r10, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0)

339.194605ms ago: executing program 0 (id=3875):
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000680)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0)
r1 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r0, 0x4000000, 0xe, 0x0, &(0x7f0000000040)="976d9023d56482cd284a63da5397", 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)="bf049fd184f7b03c21d9bcddc4eef9ebb6a0da3eb91c5645", 0x6, 0x8000}, 0x50)
r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r0})
listen(0xffffffffffffffff, 0x4)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000074f6967d00000000000000180100002020702500000000002020207baaf8ff00000000bda1000000003f0027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x4c}}, 0x0)
mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r0, 0x0)
mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x2000)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x5, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000456d9dee5713be00020000008d261000040000009500000000000000d37fdedd955c81fcbe208cebace322c8d9c834e0455db87d6872de0d39d39d419965d76d83aea66bdfef4ef624f37900827e6c7815ecbd4356f650a0ae43b86962a812a33208dd2ed69584cf44706374479582758930bc60d410c871000000000000000000000016f75f698af74d37ef2826e8edd7874b128a2412688a9420df2e3a37d3861e321b4876150e1582942d31c9868428183b0bd6cf8656191e09b7bd4b0e8dbc44c21c2d1df01b35c4a888f42569e2e6f1673fc2a3616452e25699b5ffd2a506b0c8b4d66eb0bbba42e0456ce2631d9af2b7aafd9450e1d331ae24d0447672095b5db3a9fc5f013a4ec2b205ac2e1f901747429dc42e940b4222334a8560210254a53a44e4c3bc081b6af8"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
shutdown(r6, 0x0)
unshare(0x26020480)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0xee, 0x4000004)
r7 = socket$phonet_pipe(0x23, 0x5, 0x2)
connect$phonet_pipe(r7, 0x0, 0x0)
ioctl$SIOCPNENABLEPIPE(r7, 0x89ed, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x3, 0x20000000000000c0, &(0x7f0000000a00)=ANY=[@ANYRESOCT=r1, @ANYBLOB="8e9e4a8767cd8b2a025589768bb421e6b64b65c78e5b073bdcea5ce48ef7b9a880935a707b814b78972ab4c15bb84bd1299916b2c14bd32692df48d3e6cd0756d1ecba89d9a9d7562ac8e153ba1d74c634b2a54c0529b693657816358379bcbf05a86f50718226585ecb077948240fb021c56018ab6b5f3d9183cf4eadd5807998e9e928c5c474d30184cbc600b24ecbc12d9d7002623feb714d907b", @ANYRESDEC=0x0, @ANYRESDEC=r5], &(0x7f0000000540)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r3, 0x0, 0x25, 0x0, @void}, 0x10)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000004c0)=ANY=[@ANYRES32, @ANYRES32, @ANYRES16, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESOCT=r3], 0x20)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000a9000000a90000000b000000060000000400000f0100000003000000000000000700000005000000ffff0000ff7f0000010000000104000002000000040000000e00000005000000c7000000000600000d00"/104], 0x0, 0xcf}, 0x28)

245.77545ms ago: executing program 2 (id=3876):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x0) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) (async)
sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYRES64=r3], 0x28}, 0x1, 0x0, 0x0, 0x8c811}, 0x40040) (async)
listen(r1, 0xc) (async)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) (async)
socket$inet6_mptcp(0xa, 0x1, 0x106) (async)
close(0x3) (async)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000800)={0xffffffffffffffff, 0x20, &(0x7f00000007c0)={&(0x7f00000005c0)=""/197, 0xc5, <r5=>0x0, 0x0}}, 0x10) (async)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r0, &(0x7f00000007c0)}, 0x20)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x25) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f00000007c0), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_NEW(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)={0x44, r7, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x84}, 0x40080)
sendmsg$DEVLINK_CMD_SB_GET(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x3c, r7, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x6}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8040}, 0x44) (async)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r2}, 0x8) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x12, &(0x7f0000000000)=ANY=[@ANYBLOB="180000008b0000e4ffffff000600000018110000", @ANYRES32=0x0, @ANYRES8=r5], &(0x7f00000010c0)='syzkaller\x00', 0x9, 0xffd, &(0x7f0000002cc0)=""/4093, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400005}, 0x94)

122.18864ms ago: executing program 0 (id=3877):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000030000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f01000000010000006e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b98d2de10c21d3ea02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d000000200008000000000000001abc11c800000000000000000000000928ee53595a779d243a48cea769470424d20a04c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e495f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e4a48dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f00000021f8547d393dabe616fbbde21c90be00b5a22671395c7a69c6dd4d022ffc97ddb6aa025131652d409da1d8cfc3d219d4b1c1b7b8170d7c33d91db2b73f7ae02485a209a2474b5d0790d05c01bec623056e4d3f4d3149373a28b26a15a1fcce73d57e6eaf7e6f315fe275ebc9ef7aeca277dde01dde724f419803a2172a7833ceab38d21ca4f1dea5e1f4d8824167b21dd289dd4e6ecfba9e163bdbc48e1e758ecde05c10809c9edfa6d77c652fd742e6dad13d2a397bebe3ea8bc087d3720e2202f36c7719ae34f042e19dc08a3323a3d94098a7ec171469352bab1662c3e4d4803c565cfcce32dad628fade43a4844abb230ce608726fd87e93c405a96cf638c41510f26e9da5f316"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r0, 0x0, 0x62, 0xfe, &(0x7f0000000140)="cb74445b7d4c0b24676c6c71ae37efcedaf40242309766deb4e793f90000000000000000dbc856cbc664650634231454ca2d8034c4ca29e0d99c3b6615e91835a600c08f989af45438a54981be310aad92ae545b1c961e5f3762a51fe4c736edec6f", &(0x7f0000000440)=""/254, 0x2f00, 0x0, 0xff, 0x194, &(0x7f0000000980)="ffc4438e5c3081d0e133e812196ec0ed923733aa8b5aba32c8650e7a66d6136853773dfbc6226be13039e230d511f1ac50cc7811aac0400e4c833fedf842ae2918e6fddb550729246fcf4c0a01bc64989ea3985fb362751a83991bd56e761379caa64f6148893ff25f38d5cd6dd695bbf9ca709a9960e0e6b054d5e2239bcb7c0fb2ac66dc4c8f534e439ff20ccaf0d48a98c19c92a3b437a699350f49606d21a403f8c112c46fea5486bf367a854b0f6c1e563b656e4794f6793a08bb3656c391643f6df71d0255054368a938d38503d064da82d5dbf395ad47ed3932669168d324ed0f6de8360d499042ddc7d02b6c0772128257702bfe6d0971f00fea85da062cdc", &(0x7f00000007c0)="4c87fe555ceb79157b1e507ff4d3cc053321e42ae89f596427188b4877ab8f1776c0685784f1174c6401ecc1dd6e2a77bc79238f87ad9215a92ff203a30099e77c543e702b4a4438d358616381745f24f74e585498af129c4b173b242f445b08135f7fa40eb7ba78160ff4f0c80e1b324d0c234cb7f43a3ff9e9535dc16000c797113a039f4508a09144090000009f38a90a24f173b3e68377e4272950a80cfcd3aa6850e917bc7e57370060f5e6db941d67fc98a1e98103830b821657438325578d2af822dd4fc13ea7a7eef8d9be4e715aec8fd6cadc41c8da5ce9da2b9e1559d92a1936fc2b3a00000000000000000072200e10ba6269b634f10f7098c65ba67ba65c0e2687637e131fb8d5ba6c12c09c8356853c434a44ff0878e496dcf9a4f5ca02c293279948f37ebb28843f92c87c057a3b410e04418557d5deda7ddd3bd1d384d64ec980187e8b64a0696571a49e847db79349c9b3c3fab5f1f977bde4d802d9026ae0c11744eb1525c5195fd215d7a432497f35c2f2cfcd2b6336b26dfef0cb968c910ea2af5cdd4d58cc08535d5514", 0x2, 0x0, 0x10000}, 0x24)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'batadv0\x00', <r1=>0x0})
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0x11, 0x148, 0x0, 0x0, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x2, 0x3, 0x2, 0x1}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x3}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00', {}, {}, 0x2e, 0x2, 0x2}, 0x0, 0xf8, 0x220, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x4, 0x2000, 0x2}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0xffffffffffffffff}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x4, 'system_u:object_r:systemd_logind_sessions_t:s0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x2, 0x79, 0x10, 0x28}, [@ldst={0x6, 0x3, 0x0, 0x0, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000003c0)=0xffffffffffffffff, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xe, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x6}, [@printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc3}}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x1}, @jmp={0x5, 0x1, 0x6, 0x2, 0x2, 0x8, 0xffffffffffffffe1}]}, &(0x7f0000000240)='syzkaller\x00', 0x8000, 0xca, &(0x7f0000000280)=""/202, 0x40f00, 0x52, '\x00', r1, @fallback=0x25, r3, 0x8, &(0x7f0000000400)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0x10, 0x7, 0x10001}, 0x10, 0xffffffffffffffff, r0, 0x1, 0x0, &(0x7f0000000580)=[{0x0, 0x4, 0x9, 0x7}], 0x10, 0x1}, 0x94)

12.21718ms ago: executing program 3 (id=3878):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x24000880}, 0x4000)

0s ago: executing program 0 (id=3879):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="d50a00000000001061117800000000001800000000000000000000000000d7351c6727f7f6ed6afa7c0800009500000000000000"], &(0x7f0000000000)='GPL\x00'}, 0x94)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1)
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x10000000, &(0x7f0000000080)=[{&(0x7f0000000300)="d8000000180081054e81f783db4cb9040a1d290006007c02e8fc55a10a0015000600142603600e120800140000000401a8000500fec0ffff00000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace0d81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}], 0x1}, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
r3 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c)
connect$inet6(r3, &(0x7f0000000000)={0x2, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}, 0x1c)
connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4e25, 0xe5, @dev={0xfe, 0x80, '\x00', 0x24}, 0x12}, 0x1c)
r4 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r4, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1)
unshare(0x8040480)
r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0)
r6 = openat$cgroup_procs(r5, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0)
write$cgroup_pid(r6, &(0x7f0000000c40), 0x12)
connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x9, @loopback, 0x44}, 0x1c)
ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x3)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x11a, 0x4, 0x0, 0x0)

kernel console output (not intermixed with test programs):

adv_slave_0
[  405.958938][T14402] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  405.958966][T14402] batman_adv: batadv0: Removing interface: batadv_slave_1
[  406.001996][T14402] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[  406.006252][T14405] bond8: entered allmulticast mode
[  406.089515][T14412] bond8: (slave bridge0): making interface the new active one
[  406.089546][T14412] bridge0: entered promiscuous mode
[  406.089746][T14412] bridge0: entered allmulticast mode
[  406.124123][T14412] bond8: (slave bridge0): Enslaving as an active interface with an up link
[  406.192974][T14427] 0ªX¹¦Dö»: renamed from gretap0 (while UP)
[  406.207971][T14427] 0ªX¹¦Dö»: entered allmulticast mode
[  407.185030][T14443] xt_SECMARK: invalid mode: 9
[  407.387656][T14445] __nla_validate_parse: 5 callbacks suppressed
[  407.387682][T14445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2456'.
[  407.387705][T14445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2456'.
[  408.233049][T14472] netlink: 'syz.1.2465': attribute type 2 has an invalid length.
[  408.254020][T14472] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2465'.
[  408.289662][T14478] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2461'.
[  409.644814][T14501] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2472'.
[  409.879967][T14519] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2475'.
[  409.885976][   T52] block nbd2: Receive control failed (result -1)
[  410.423488][T14530] netlink: 'syz.2.2479': attribute type 1 has an invalid length.
[  410.652820][T14541] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  410.652853][T14541] IPv6: NLM_F_CREATE should be set when creating new route
[  410.652905][T14541] IPv6: NLM_F_CREATE should be set when creating new route
[  410.808984][T14547] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2484'.
[  411.691974][T14569] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2493'.
[  411.961957][T14569] bridge0: port 2(bridge_slave_1) entered disabled state
[  411.966168][T14569] bridge0: port 1(bridge_slave_0) entered disabled state
[  412.004722][T14584] openvswitch: netlink: Geneve option length err (len 256, max 255).
[  412.070016][T14586] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2494'.
[  412.460243][T14569] tipc: Resetting bearer <eth:syzkaller0>
[  412.700381][ T1009] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[  412.700438][ T1009] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  412.700592][ T1009] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[  412.700623][ T1009] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  412.700693][ T1009] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[  412.700744][ T1009] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  412.700787][ T1009] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[  412.700817][ T1009] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  413.053325][T14605] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2502'.
[  413.297234][T14618] tc_dump_action: action bad kind
[  413.298554][T14610] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2502'.
[  413.316694][T14611] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[  414.310137][T14649] dummy0: left allmulticast mode
[  414.315554][T14649] bridge0: port 1(dummy0) entered disabled state
[  414.407391][T14649] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[  414.535119][T14666] A link change request failed with some changes committed already. Interface ipvlan0 may have been left with an inconsistent configuration, please check.
[  414.627335][T14668] xt_SECMARK: invalid mode: 9
[  414.689804][T14670] IPVS: lc: FWM 3 0x00000003 - no destination available
[  414.691080][T14674] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256
[  415.188970][T14692] netlink: 'syz.3.2522': attribute type 13 has an invalid length.
[  415.423350][T14692] netlink: 'syz.3.2522': attribute type 13 has an invalid length.
[  415.519060][T14699] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2525'.
[  415.532026][T14699] unsupported nlmsg_type 40
[  415.708179][T14703] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2527'.
[  416.273817][T14719] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2533'.
[  416.312587][T14719] bond0: option packets_per_slave: invalid value (7627118)
[  416.312617][T14719] bond0: option packets_per_slave: allowed values 0 - 65535
[  416.407709][T14719] bond0 (unregistering): Released all slaves
[  416.871154][T14736] wg2 speed is unknown, defaulting to 1000
[  416.960409][T14743] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2543'.
[  416.996378][T14741] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2542'.
[  416.996403][T14741] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2542'.
[  416.998338][T14741] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2542'.
[  417.167232][T14749] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2544'.
[  417.852326][T14777] netlink: 'syz.3.2548': attribute type 30 has an invalid length.
[  418.249107][T14606] netdevsim netdevsim2 netdevsim0 (unregistering): left promiscuous mode
[  418.302400][T14797] __nla_validate_parse: 1 callbacks suppressed
[  418.302426][T14797] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2552'.
[  418.357758][T14799] netlink: 'syz.0.2552': attribute type 1 has an invalid length.
[  418.357785][T14799] netlink: 200 bytes leftover after parsing attributes in process `syz.0.2552'.
[  418.357804][T14799] netlink: 'syz.0.2552': attribute type 1 has an invalid length.
[  418.357818][T14799] netlink: 29 bytes leftover after parsing attributes in process `syz.0.2552'.
[  418.571498][T14805] xt_SECMARK: invalid mode: 9
[  418.652326][T14807] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2554'.
[  419.537493][T14826] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2560'.
[  419.642150][T14808] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled!
[  419.808843][T14839] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  419.880840][T14842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2565'.
[  420.863211][ T5624] Bluetooth: hci4: command 0x0405 tx timeout
[  421.003609][T14898] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2577'.
[  421.003727][T14898] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2577'.
[  421.072150][T14899] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2577'.
[  421.196156][T14903] FAULT_INJECTION: forcing a failure.
[  421.196156][T14903] name failslab, interval 1, probability 0, space 0, times 0
[  421.196191][T14903] CPU: 1 UID: 0 PID: 14903 Comm: syz.0.2579 Not tainted syzkaller #0 PREEMPT(full) 
[  421.196213][T14903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  421.196224][T14903] Call Trace:
[  421.196233][T14903]  <TASK>
[  421.196241][T14903]  dump_stack_lvl+0xe8/0x150
[  421.196276][T14903]  should_fail_ex+0x410/0x560
[  421.196301][T14903]  ? __alloc_skb+0x1db/0x7a0
[  421.196324][T14903]  should_failslab+0xa8/0x100
[  421.196349][T14903]  ? __alloc_skb+0x1db/0x7a0
[  421.196389][T14903]  kmem_cache_alloc_node_noprof+0xa1/0x610
[  421.196421][T14903]  ? __alloc_skb+0x18d/0x7a0
[  421.196445][T14903]  ? __alloc_skb+0x1db/0x7a0
[  421.196474][T14903]  __alloc_skb+0x1db/0x7a0
[  421.196500][T14903]  netlink_sendmsg+0x5d4/0xb40
[  421.196539][T14903]  ? __pfx_netlink_sendmsg+0x10/0x10
[  421.196576][T14903]  ? apparmor_socket_sendmsg+0x98/0x360
[  421.196600][T14903]  ? __pfx_netlink_sendmsg+0x10/0x10
[  421.196685][T14903]  sock_sendmsg_nosec+0x13a/0x180
[  421.196709][T14903]  ____sys_sendmsg+0x54e/0x850
[  421.196742][T14903]  ? __pfx_____sys_sendmsg+0x10/0x10
[  421.196777][T14903]  ? import_iovec+0x73/0xa0
[  421.196805][T14903]  ___sys_sendmsg+0x2a5/0x360
[  421.196830][T14903]  ? __lock_acquire+0x747/0x2de0
[  421.196857][T14903]  ? __pfx____sys_sendmsg+0x10/0x10
[  421.196928][T14903]  ? __fget_files+0x2a/0x420
[  421.196958][T14903]  ? __fget_files+0x3a2/0x420
[  421.196995][T14903]  __x64_sys_sendmsg+0x1b1/0x290
[  421.197031][T14903]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  421.197076][T14903]  do_syscall_64+0x166/0x520
[  421.197099][T14903]  ? trace_irq_disable+0x3b/0x140
[  421.197119][T14903]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  421.197139][T14903]  ? clear_bhb_loop+0x70/0xc0
[  421.197165][T14903]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  421.197187][T14903] RIP: 0033:0x7f821419e159
[  421.197209][T14903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  421.197227][T14903] RSP: 002b:00007f8214f8e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  421.197252][T14903] RAX: ffffffffffffffda RBX: 00007f8214425fa0 RCX: 00007f821419e159
[  421.197268][T14903] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  421.197282][T14903] RBP: 00007f8214f8e090 R08: 0000000000000000 R09: 0000000000000000
[  421.197296][T14903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  421.197311][T14903] R13: 00007f8214426038 R14: 00007f8214425fa0 R15: 00007ffdab9e5f08
[  421.197349][T14903]  </TASK>
[  421.220690][T14860] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  421.335332][T14859] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  421.344802][T14862] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  421.347367][T14904] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  421.755403][T14910] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported
[  421.783498][T14910] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2581'.
[  422.359109][T14940] netlink: 'syz.2.2591': attribute type 10 has an invalid length.
[  422.359166][T14940] dummy0: entered promiscuous mode
[  422.374120][T14940] bridge0: port 3(dummy0) entered blocking state
[  422.374252][T14940] bridge0: port 3(dummy0) entered disabled state
[  422.374463][T14940] dummy0: entered allmulticast mode
[  422.459990][T14944] xt_SECMARK: invalid mode: 9
[  422.482590][T14943] FAULT_INJECTION: forcing a failure.
[  422.482590][T14943] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  422.482648][T14943] CPU: 0 UID: 0 PID: 14943 Comm: syz.1.2594 Not tainted syzkaller #0 PREEMPT(full) 
[  422.482674][T14943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  422.482693][T14943] Call Trace:
[  422.482707][T14943]  <TASK>
[  422.482718][T14943]  dump_stack_lvl+0xe8/0x150
[  422.482760][T14943]  should_fail_ex+0x410/0x560
[  422.482793][T14943]  _copy_from_iter+0x1d3/0x1660
[  422.482822][T14943]  ? __alloc_skb+0x27a/0x7a0
[  422.482852][T14943]  ? __alloc_skb+0x27a/0x7a0
[  422.482882][T14943]  ? __alloc_skb+0x27a/0x7a0
[  422.482912][T14943]  ? __pfx__copy_from_iter+0x10/0x10
[  422.482938][T14943]  ? kmem_cache_alloc_node_noprof+0x1f9/0x610
[  422.482975][T14943]  ? __alloc_skb+0x27a/0x7a0
[  422.483002][T14943]  ? __alloc_skb+0x27a/0x7a0
[  422.483038][T14943]  ? netlink_sendmsg+0x650/0xb40
[  422.483074][T14943]  ? skb_put+0x112/0x210
[  422.483107][T14943]  netlink_sendmsg+0x6c0/0xb40
[  422.483166][T14943]  ? __pfx_netlink_sendmsg+0x10/0x10
[  422.483215][T14943]  ? apparmor_socket_sendmsg+0x98/0x360
[  422.483246][T14943]  ? __pfx_netlink_sendmsg+0x10/0x10
[  422.483282][T14943]  sock_sendmsg_nosec+0x13a/0x180
[  422.483311][T14943]  ____sys_sendmsg+0x54e/0x850
[  422.483355][T14943]  ? __pfx_____sys_sendmsg+0x10/0x10
[  422.483399][T14943]  ? import_iovec+0x73/0xa0
[  422.483434][T14943]  ___sys_sendmsg+0x2a5/0x360
[  422.483467][T14943]  ? __lock_acquire+0x747/0x2de0
[  422.483498][T14943]  ? __pfx____sys_sendmsg+0x10/0x10
[  422.483573][T14943]  ? __fget_files+0x2a/0x420
[  422.483607][T14943]  ? __fget_files+0x3a2/0x420
[  422.483653][T14943]  __x64_sys_sendmsg+0x1b1/0x290
[  422.483691][T14943]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  422.483751][T14943]  do_syscall_64+0x166/0x520
[  422.483780][T14943]  ? trace_irq_disable+0x3b/0x140
[  422.483805][T14943]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  422.483830][T14943]  ? clear_bhb_loop+0x70/0xc0
[  422.483857][T14943]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  422.483880][T14943] RIP: 0033:0x7f5d35b9e159
[  422.483902][T14943] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  422.483922][T14943] RSP: 002b:00007f5d36b47028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  422.483949][T14943] RAX: ffffffffffffffda RBX: 00007f5d35e25fa0 RCX: 00007f5d35b9e159
[  422.483966][T14943] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  422.483980][T14943] RBP: 00007f5d36b47090 R08: 0000000000000000 R09: 0000000000000000
[  422.483995][T14943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  422.484009][T14943] R13: 00007f5d35e26038 R14: 00007f5d35e25fa0 R15: 00007ffd65e420a8
[  422.484048][T14943]  </TASK>
[  423.699100][T14983] xt_SECMARK: invalid mode: 9
[  423.862910][T14987] __nla_validate_parse: 4 callbacks suppressed
[  423.862936][T14987] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2610'.
[  423.900786][T14989] FAULT_INJECTION: forcing a failure.
[  423.900786][T14989] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  423.900826][T14989] CPU: 1 UID: 0 PID: 14989 Comm: syz.3.2609 Not tainted syzkaller #0 PREEMPT(full) 
[  423.900852][T14989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  423.900867][T14989] Call Trace:
[  423.900877][T14989]  <TASK>
[  423.900887][T14989]  dump_stack_lvl+0xe8/0x150
[  423.900930][T14989]  should_fail_ex+0x410/0x560
[  423.900964][T14989]  _copy_from_iter+0x1d3/0x1660
[  423.900993][T14989]  ? __alloc_skb+0x27a/0x7a0
[  423.901023][T14989]  ? __alloc_skb+0x27a/0x7a0
[  423.901053][T14989]  ? __alloc_skb+0x27a/0x7a0
[  423.901081][T14989]  ? __pfx__copy_from_iter+0x10/0x10
[  423.901105][T14989]  ? kmem_cache_alloc_node_noprof+0x1f9/0x610
[  423.901146][T14989]  ? __alloc_skb+0x27a/0x7a0
[  423.901172][T14989]  ? __alloc_skb+0x27a/0x7a0
[  423.901205][T14989]  ? netlink_sendmsg+0x650/0xb40
[  423.901240][T14989]  ? skb_put+0x112/0x210
[  423.901272][T14989]  netlink_sendmsg+0x6c0/0xb40
[  423.901318][T14989]  ? __pfx_netlink_sendmsg+0x10/0x10
[  423.901363][T14989]  ? apparmor_socket_sendmsg+0x98/0x360
[  423.901390][T14989]  ? __pfx_netlink_sendmsg+0x10/0x10
[  423.901425][T14989]  sock_sendmsg_nosec+0x13a/0x180
[  423.901450][T14989]  ____sys_sendmsg+0x54e/0x850
[  423.901489][T14989]  ? __pfx_____sys_sendmsg+0x10/0x10
[  423.901550][T14989]  ? import_iovec+0x73/0xa0
[  423.901584][T14989]  ___sys_sendmsg+0x2a5/0x360
[  423.901614][T14989]  ? __lock_acquire+0x747/0x2de0
[  423.901646][T14989]  ? __pfx____sys_sendmsg+0x10/0x10
[  423.901719][T14989]  ? __fget_files+0x2a/0x420
[  423.901752][T14989]  ? __fget_files+0x3a2/0x420
[  423.901795][T14989]  __x64_sys_sendmsg+0x1b1/0x290
[  423.901829][T14989]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  423.901886][T14989]  do_syscall_64+0x166/0x520
[  423.901915][T14989]  ? trace_irq_disable+0x3b/0x140
[  423.901938][T14989]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  423.901962][T14989]  ? clear_bhb_loop+0x70/0xc0
[  423.901992][T14989]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  423.902016][T14989] RIP: 0033:0x7fab2559e159
[  423.902038][T14989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  423.902058][T14989] RSP: 002b:00007fab263c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  423.902085][T14989] RAX: ffffffffffffffda RBX: 00007fab25825fa0 RCX: 00007fab2559e159
[  423.902103][T14989] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  423.902119][T14989] RBP: 00007fab263c5090 R08: 0000000000000000 R09: 0000000000000000
[  423.902133][T14989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  423.902148][T14989] R13: 00007fab25826038 R14: 00007fab25825fa0 R15: 00007fffe2e984f8
[  423.902206][T14989]  </TASK>
[  424.485204][T15000] netlink: 'syz.1.2614': attribute type 1 has an invalid length.
[  424.485234][T15000] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2614'.
[  424.822878][T15017] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2618'.
[  424.951482][T15026] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2619'.
[  424.962856][T15024] xt_SECMARK: invalid mode: 9
[  425.019230][T15017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2618'.
[  425.143568][T15021] openvswitch: netlink: Multiple metadata blocks provided
[  425.856863][T15055] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2629'.
[  425.856891][T15055] netlink: 468 bytes leftover after parsing attributes in process `syz.1.2629'.
[  426.086461][T15076] netlink: 'syz.2.2631': attribute type 1 has an invalid length.
[  426.213446][T15079] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2631'.
[  426.304335][T15079] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2631'.
[  426.548179][T15092] netlink: 'syz.3.2635': attribute type 7 has an invalid length.
[  426.561746][T15092] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2635'.
[  426.971829][T15107] wg2 speed is unknown, defaulting to 1000
[  427.397768][T15123] netlink: 'syz.4.2643': attribute type 1 has an invalid length.
[  427.591196][T15127] netlink: 'syz.0.2645': attribute type 1 has an invalid length.
[  427.614056][T15129] netlink: 'syz.1.2644': attribute type 10 has an invalid length.
[  427.636649][T15123] 8021q: adding VLAN 0 to HW filter on device bond9
[  431.480844][T15129] bridge0: port 1(dummy0) entered blocking state
[  431.481053][T15129] bridge0: port 1(dummy0) entered disabled state
[  431.481205][T15129] dummy0: entered allmulticast mode
[  431.483659][T15129] __nla_validate_parse: 7 callbacks suppressed
[  431.483759][T15129] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2644'.
[  431.546629][T15136] veth7: entered allmulticast mode
[  431.547043][T15136] veth7: left allmulticast mode
[  431.875711][T15150] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2650'.
[  431.900613][T15152] netlink: 'syz.2.2651': attribute type 6 has an invalid length.
[  431.908706][T15150] netlink: 'syz.0.2650': attribute type 4 has an invalid length.
[  431.908734][T15150] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.2650'.
[  431.909198][T15150] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2650'.
[  431.990852][T15157] IPVS: set_ctl: invalid protocol: 51 100.1.1.1:20003
[  432.039584][T15155] team0: Mode changed to "loadbalance"
[  432.087583][T15155] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2652'.
[  432.197733][T15164] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2654'.
[  435.286144][T15188] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  436.153310][T15217] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2664'.
[  436.471414][ T9327] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  436.471448][ T9327] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  436.517079][ T9327] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  436.517105][ T9327] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  436.690740][T15232] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  436.830067][T15236] sctp: [Deprecated]: syz.1.2671 (pid 15236) Use of int in maxseg socket option.
[  436.830067][T15236] Use struct sctp_assoc_value instead
[  437.344726][T15250] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  437.675728][T15260] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma?
[  437.678575][T15260] netlink: 332 bytes leftover after parsing attributes in process `syz.0.2678'.
[  437.678636][T15260] netlink: 'syz.0.2678': attribute type 9 has an invalid length.
[  437.678653][T15260] netlink: 108 bytes leftover after parsing attributes in process `syz.0.2678'.
[  437.678670][T15260] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2678'.
[  437.702848][T15257] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2677'.
[  437.933165][T15257] tipc: Disabling bearer <eth:syzkaller0>
[  438.259235][T15283] netlink: 'syz.0.2685': attribute type 1 has an invalid length.
[  438.260786][T15283] netlink: 'syz.0.2685': attribute type 12 has an invalid length.
[  438.260813][T15283] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2685'.
[  438.529029][    C1] vxcan0: j1939_tp_rxtimer: 0xffff888074b61000: rx timeout, send abort
[  438.534551][    C1] vxcan0: j1939_xtp_rx_abort_one: 0xffff888074b61000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
[  438.860668][T15305] ip_tables: iptables: counters copy to user failed while replacing table
[  439.061331][T15311] netlink: Invalid conntrack helper
[  439.061369][T15311] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  439.989446][T15353] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[  440.064489][ T1311] ieee802154 phy1 wpan1: encryption failed: -22
[  441.481166][T15422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2724'.
[  441.623070][T15430] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2726'.
[  441.676192][T15430] bond10: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms
[  441.678563][T15430] bond10 (unregistering): Released all slaves
[  441.709709][T15436] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2726'.
[  441.836981][T15436] bond10: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms
[  441.853290][T15436] bond10 (unregistering): Released all slaves
[  441.925814][T15443] syzkaller0: entered promiscuous mode
[  441.925841][T15443] syzkaller0: entered allmulticast mode
[  442.069591][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.077127][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.739969][T15444] __nla_validate_parse: 22 callbacks suppressed
[  442.739990][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.740022][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.793548][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.793576][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.836375][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.836416][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.836435][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.836450][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.895807][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  442.895856][T15444] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'.
[  443.530074][T15465] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR
[  444.586664][T15515] nbd: couldn't find a device at index 64
[  444.921359][T15520] bond5: Removing last arp target with arp_interval on
[  444.921649][T15527] bond0: (slave veth1_virt_wifi): Error: Device is in use and cannot be enslaved
[  445.062071][T15532] bond6: Removing last arp target with arp_interval on
[  445.101067][T15536] netlink: 'syz.3.2755': attribute type 1 has an invalid length.
[  445.101098][T15536] netlink: 'syz.3.2755': attribute type 2 has an invalid length.
[  445.233026][T15543] tipc: Failed to remove unknown binding: 66,0,0/0:914130317/914130318
[  445.235068][T15543] tipc: Failed to remove unknown binding: 66,0,0/0:914130317/914130318
[  445.239199][T15534] macvtap1: entered promiscuous mode
[  445.242169][T15534] macvtap1: entered allmulticast mode
[  445.242233][T15534] batadv0: entered allmulticast mode
[  445.278965][T15534] 8021q: adding VLAN 0 to HW filter on device macvtap1
[  445.340551][T15534] batadv0: left allmulticast mode
[  445.682448][T15541] Cannot find del_set index 0 as target
[  446.153602][T15549] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  446.927815][T15608] syzkaller0: entered promiscuous mode
[  446.927841][T15608] syzkaller0: entered allmulticast mode
[  447.102097][T15618] batman_adv: batadv0: Adding interface: macvlan2
[  447.102122][T15618] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  447.102160][T15618] batman_adv: batadv0: Interface activated: macvlan2
[  447.231318][T15622] FAULT_INJECTION: forcing a failure.
[  447.231318][T15622] name failslab, interval 1, probability 0, space 0, times 0
[  447.231358][T15622] CPU: 1 UID: 0 PID: 15622 Comm: syz.4.2777 Not tainted syzkaller #0 PREEMPT(full) 
[  447.231396][T15622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  447.231419][T15622] Call Trace:
[  447.231434][T15622]  <TASK>
[  447.231449][T15622]  dump_stack_lvl+0xe8/0x150
[  447.231494][T15622]  should_fail_ex+0x410/0x560
[  447.231526][T15622]  ? __alloc_skb+0x1db/0x7a0
[  447.231554][T15622]  should_failslab+0xa8/0x100
[  447.231586][T15622]  ? __alloc_skb+0x1db/0x7a0
[  447.231611][T15622]  kmem_cache_alloc_node_noprof+0xa1/0x610
[  447.231649][T15622]  ? __alloc_skb+0x18d/0x7a0
[  447.231677][T15622]  ? __alloc_skb+0x1db/0x7a0
[  447.231712][T15622]  __alloc_skb+0x1db/0x7a0
[  447.231746][T15622]  alloc_skb_with_frags+0xc6/0x760
[  447.231779][T15622]  ? __pfx_aa_label_sk_perm+0x10/0x10
[  447.231817][T15622]  sock_alloc_send_pskb+0x878/0x990
[  447.231885][T15622]  ? __pfx_sock_alloc_send_pskb+0x10/0x10
[  447.231918][T15622]  ? aa_file_perm+0x18b/0x15f0
[  447.231955][T15622]  ? aa_sk_perm+0x713/0x900
[  447.231988][T15622]  ? aa_file_perm+0x18b/0x15f0
[  447.232023][T15622]  hci_sock_sendmsg+0x208/0xf50
[  447.232059][T15622]  ? __pfx_aa_sk_perm+0x10/0x10
[  447.232088][T15622]  ? __pfx_hci_sock_sendmsg+0x10/0x10
[  447.232127][T15622]  ? apparmor_socket_sendmsg+0x98/0x360
[  447.232151][T15622]  ? lock_acquire+0x115/0x350
[  447.232175][T15622]  ? __pfx_hci_sock_sendmsg+0x10/0x10
[  447.232207][T15622]  sock_sendmsg_nosec+0x13a/0x180
[  447.232234][T15622]  sock_write_iter+0x2de/0x3e0
[  447.232271][T15622]  ? __pfx_sock_write_iter+0x10/0x10
[  447.232314][T15622]  ? bpf_lsm_file_permission+0x9/0x20
[  447.232349][T15622]  ? security_file_permission+0x75/0x260
[  447.232383][T15622]  vfs_write+0x612/0xba0
[  447.232427][T15622]  ? __pfx_vfs_write+0x10/0x10
[  447.232473][T15622]  ? __fget_files+0x2a/0x420
[  447.232514][T15622]  ksys_write+0x150/0x270
[  447.232552][T15622]  ? __pfx_ksys_write+0x10/0x10
[  447.232599][T15622]  do_syscall_64+0x166/0x520
[  447.232626][T15622]  ? trace_irq_disable+0x3b/0x140
[  447.232649][T15622]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  447.232673][T15622]  ? clear_bhb_loop+0x70/0xc0
[  447.232701][T15622]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  447.232724][T15622] RIP: 0033:0x7f3cb239e159
[  447.232745][T15622] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  447.232765][T15622] RSP: 002b:00007f3cb3269028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  447.232790][T15622] RAX: ffffffffffffffda RBX: 00007f3cb2626090 RCX: 00007f3cb239e159
[  447.232806][T15622] RDX: 000000000000010a RSI: 0000200000000300 RDI: 0000000000000008
[  447.232821][T15622] RBP: 00007f3cb3269090 R08: 0000000000000000 R09: 0000000000000000
[  447.232835][T15622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  447.232849][T15622] R13: 00007f3cb2626128 R14: 00007f3cb2626090 R15: 00007ffc05daa168
[  447.232885][T15622]  </TASK>
[  447.735797][   T30] audit: type=1800 audit(1789812691.120:4): pid=15628 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2780" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2785 res=0 errno=0
[  448.036908][T15637] __nla_validate_parse: 60 callbacks suppressed
[  448.036935][T15637] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2784'.
[  448.268101][T15645] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.268142][T15645] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.293730][T15645] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.293769][T15645] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.386422][T15646] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.386462][T15646] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.387313][T15646] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.387344][T15646] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2786'.
[  448.529657][T15655] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2787'.
[  449.143820][T15642] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  449.143866][T15642] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  449.796058][T15642] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  449.796101][T15642] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  450.130163][T15642] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  450.130205][T15642] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  450.470766][T15642] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  450.470818][T15642] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  451.160193][ T9326] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  451.160237][ T9326] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  451.192334][T15734] netlink: 'syz.2.2807': attribute type 10 has an invalid length.
[  451.248121][T15736] openvswitch: netlink: Unknown nsh attribute 0
[  451.410512][ T1174] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  451.410556][ T1174] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  451.412075][ T9326] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  451.412114][ T9326] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  451.649259][ T1174] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  451.649460][ T1174] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  451.992700][T15750] lo: entered allmulticast mode
[  452.033420][T15750] dvmrp6: entered allmulticast mode
[  452.033646][T15758] batman_adv: batadv0: Interface deactivated: vlan0
[  452.033669][T15758] batman_adv: batadv0: Removing interface: vlan0
[  452.195040][T15748] lo: left allmulticast mode
[  452.360205][T15774] macvlan0: entered promiscuous mode
[  452.382670][T15769] xt_hashlimit: size too large, truncated to 1048576
[  452.770157][T15788] sctp: [Deprecated]: syz.0.2822 (pid 15788) Use of int in maxseg socket option.
[  452.770157][T15788] Use struct sctp_assoc_value instead
[  453.386713][T15811] __nla_validate_parse: 7 callbacks suppressed
[  453.386738][T15811] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2828'.
[  453.485070][   T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  453.487075][   T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  453.488054][   T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  453.489188][   T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  453.524977][   T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  455.091133][T15856] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2839'.
[  455.170793][T15813] wg2 speed is unknown, defaulting to 1000
[  455.419530][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  455.579613][ T5621] Bluetooth: hci5: command tx timeout
[  455.812472][T15871] vcan0: tx drop: invalid sa for name 0x0000004000000000
[  455.814039][T15871] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2843'.
[  455.814077][T15871] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2843'.
[  456.261621][ T7811] batadv2: left allmulticast mode
[  456.261732][ T7811] batadv2: left promiscuous mode
[  456.264513][ T7811] bridge0: port 2(batadv2) entered disabled state
[  456.300701][ T7811] batadv1: left allmulticast mode
[  456.300723][ T7811] batadv1: left promiscuous mode
[  456.300942][ T7811] bridge0: port 1(batadv1) entered disabled state
[  456.608769][ T7811] bond3 (unregistering): (slave gretap2): Releasing backup interface
[  456.732781][ T7811] bond5 (unregistering): (slave bridge3): Releasing backup interface
[  456.763570][ T7811] bond7 (unregistering): (slave .`): Releasing active interface
[  456.764604][ T7811] .` (unregistering): Released all slaves
[  456.795495][ T7811] bond1 (unregistering): Released all slaves
[  456.813341][ T7811] bond2 (unregistering): Released all slaves
[  456.838599][ T7811] bond3 (unregistering): (slave bond4): Releasing backup interface
[  456.845321][ T7811] bond3 (unregistering): Released all slaves
[  456.864604][ T7811] bond4 (unregistering): Released all slaves
[  456.882129][ T7811] bond5 (unregistering): Released all slaves
[  456.908458][ T7811] bond6 (unregistering): Released all slaves
[  456.926222][ T7811] bond7 (unregistering): Released all slaves
[  457.184697][ T7811] ´: left promiscuous mode
[  457.291454][T15813] bridge0: port 1(bridge_slave_0) entered blocking state
[  457.295343][T15813] bridge0: port 1(bridge_slave_0) entered disabled state
[  457.295534][T15813] bridge_slave_0: entered allmulticast mode
[  457.330705][T15813] bridge_slave_0: entered promiscuous mode
[  457.409458][T15813] bridge0: port 2(bridge_slave_1) entered blocking state
[  457.409583][T15813] bridge0: port 2(bridge_slave_1) entered disabled state
[  457.409770][T15813] bridge_slave_1: entered allmulticast mode
[  457.464630][T15813] bridge_slave_1: entered promiscuous mode
[  457.659794][ T5621] Bluetooth: hci5: command tx timeout
[  457.855834][T15902] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2849'.
[  458.073674][T15899] netlink: 'syz.2.2849': attribute type 12 has an invalid length.
[  458.112886][T15813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  458.139985][T15813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  458.227786][T15899] Bluetooth: MGMT ver 1.23
[  458.649234][T15925] ipt_ECN: cannot use operation on non-tcp rule
[  458.665948][T15813] team0: Port device team_slave_0 added
[  458.728513][T15813] team0: Port device team_slave_1 added
[  459.032653][T15940] netlink: 'syz.1.2857': attribute type 5 has an invalid length.
[  459.032676][T15940] netlink: 'syz.1.2857': attribute type 9 has an invalid length.
[  459.032691][T15940] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2857'.
[  459.130835][T15813] batman_adv: batadv0: Adding interface: batadv_slave_0
[  459.130859][T15813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  459.130898][T15813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  459.136746][T15940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2857'.
[  459.184933][T15813] batman_adv: batadv0: Adding interface: batadv_slave_1
[  459.184957][T15813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  459.184990][T15813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  459.412896][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1
[  459.436006][T15813] hsr_slave_0: entered promiscuous mode
[  459.437054][T15813] hsr_slave_1: entered promiscuous mode
[  459.437831][T15813] debugfs: 'hsr0' already exists in 'hsr'
[  459.437847][T15813] Cannot create hsr debugfs directory
[  459.739550][ T5621] Bluetooth: hci5: command tx timeout
[  460.965950][T15989] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2866'.
[  460.974316][ T5621] block nbd4: Receive control failed (result -107)
[  461.383745][T15998] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2868'.
[  461.418793][T15998] sctp: [Deprecated]: syz.2.2868 (pid 15998) Use of struct sctp_assoc_value in delayed_ack socket option.
[  461.418793][T15998] Use struct sctp_sack_info instead
[  461.830475][ T5621] Bluetooth: hci5: command tx timeout
[  462.490733][T16020] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available
[  462.779691][T16020] IPVS: Scheduler module ip_vs_sip not found
[  463.685525][T15813] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  463.747549][T15813] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  463.822902][T15813] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  463.874908][T15813] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  463.890595][T15813] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  463.973786][T15813] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  464.166417][T15813] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  464.190219][T15813] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  465.093462][T15813] 8021q: adding VLAN 0 to HW filter on device bond0
[  465.175854][T15813] 8021q: adding VLAN 0 to HW filter on device team0
[  465.217748][ T3377] bridge0: port 1(bridge_slave_0) entered blocking state
[  465.217864][ T3377] bridge0: port 1(bridge_slave_0) entered forwarding state
[  465.267194][ T3377] bridge0: port 2(bridge_slave_1) entered blocking state
[  465.267315][ T3377] bridge0: port 2(bridge_slave_1) entered forwarding state
[  465.493328][T16125] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2894'.
[  465.542237][T16116] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2894'.
[  466.595494][T16153] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2902'.
[  466.595521][T16153] netlink: 468 bytes leftover after parsing attributes in process `syz.3.2902'.
[  466.695080][T16153] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2902'.
[  466.749889][T16158] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2904'.
[  466.892398][T16152] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2903'.
[  466.977221][ T7811] hsr_slave_0: left promiscuous mode
[  466.993048][ T7811] hsr_slave_1: left promiscuous mode
[  467.237648][T16174] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2905'.
[  467.846291][T16161] syzkaller1: entered promiscuous mode
[  467.846321][T16161] syzkaller1: entered allmulticast mode
[  468.192223][T16193] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2909'.
[  468.195334][T16193] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2909'.
[  468.402052][T15813] 8021q: adding VLAN 0 to HW filter on device batadv0
[  468.423551][T16188] syzkaller0: entered promiscuous mode
[  468.423587][T16188] syzkaller0: entered allmulticast mode
[  468.527333][T16208] xt_SECMARK: invalid mode: 9
[  468.611742][T16199] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input5
[  469.158259][T15813] veth0_vlan: entered promiscuous mode
[  469.158671][ T7811] IPVS: stop unused estimator thread 0...
[  469.252007][T15813] veth1_vlan: entered promiscuous mode
[  469.477008][T15813] veth0_macvtap: entered promiscuous mode
[  469.509233][T15813] veth1_macvtap: entered promiscuous mode
[  469.561933][ T5621] block nbd5: Receive control failed (result -1)
[  469.633535][T15813] batman_adv: batadv0: Interface activated: batadv_slave_0
[  469.762814][T15813] batman_adv: batadv0: Interface activated: batadv_slave_1
[  469.809889][   T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  469.810531][   T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  469.810573][   T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  469.810612][   T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  469.880447][T16239] openvswitch: netlink: Missing key (keys=c0, expected=40280)
[  470.106949][T16242] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  470.364055][ T3377] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  470.364101][ T3377] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  470.563796][ T7358] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  470.563820][ T7358] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  470.638433][T16254] xt_ecn: cannot match TCP bits for non-tcp packets
[  470.976230][T16272] __nla_validate_parse: 6 callbacks suppressed
[  470.976247][T16272] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2826'.
[  471.017878][T16272] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2826'.
[  471.347067][T16284] ip6tnl1: entered allmulticast mode
[  471.509084][T16292] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  471.587757][T16303] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2935'.
[  471.912988][T16315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2937'.
[  471.918608][T16315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2937'.
[  472.119151][T16321] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2940'.
[  472.146200][ T7358] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  472.146450][ T7358] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  472.169905][ T9685] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  472.192916][T16325] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2942'.
[  472.366493][T16326] pim6reg: entered allmulticast mode
[  472.413429][T16326] Bluetooth: hci0: Opcode 0x0c20 failed: -22
[  472.557768][T16331] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-alb(6)
[  472.588547][T16331] bond0 (unregistering): Released all slaves
[  472.659588][ T9685] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  472.785264][ T9685] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  472.787399][T16340] syzkaller1: entered promiscuous mode
[  472.787424][T16340] syzkaller1: entered allmulticast mode
[  473.312191][T16354] netlink: 'syz.4.2954': attribute type 21 has an invalid length.
[  473.312218][T16354] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2954'.
[  473.388329][   T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  473.398688][   T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  473.406627][   T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  473.408043][   T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  473.426573][   T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  473.999561][T16373] can: request_module (can-proto-0) failed.
[  474.436881][T16398] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  474.439771][T16352] wg2 speed is unknown, defaulting to 1000
[  474.949647][T16418] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2966'.
[  475.247325][T16424] syzkaller0: entered promiscuous mode
[  475.247352][T16424] syzkaller0: entered allmulticast mode
[  475.500193][   T52] Bluetooth: hci1: command tx timeout
[  475.966222][T16352] bridge0: port 1(bridge_slave_0) entered blocking state
[  475.967064][T16352] bridge0: port 1(bridge_slave_0) entered disabled state
[  475.967259][T16352] bridge_slave_0: entered allmulticast mode
[  475.980285][    C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  475.983184][T16352] bridge_slave_0: entered promiscuous mode
[  476.003189][T16352] bridge0: port 2(bridge_slave_1) entered blocking state
[  476.003465][T16352] bridge0: port 2(bridge_slave_1) entered disabled state
[  476.004710][T16352] bridge_slave_1: entered allmulticast mode
[  476.008874][T16352] bridge_slave_1: entered promiscuous mode
[  476.086494][T16441] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2973'.
[  476.162616][T16352] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  476.182915][T16352] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  476.268769][T16352] team0: Port device team_slave_0 added
[  476.300621][T16352] team0: Port device team_slave_1 added
[  476.368202][T16451] Bluetooth: MGMT ver 1.23
[  476.381383][T16447] wg2 speed is unknown, defaulting to 1000
[  476.382299][T16352] batman_adv: batadv0: Adding interface: batadv_slave_0
[  476.382316][T16352] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  476.382345][T16352] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  476.461172][T16352] batman_adv: batadv0: Adding interface: batadv_slave_1
[  476.461193][T16352] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  476.461223][T16352] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  476.748416][T16352] hsr_slave_0: entered promiscuous mode
[  476.753759][T16352] hsr_slave_1: entered promiscuous mode
[  477.057334][T16462] x_tables: duplicate underflow at hook 1
[  477.362211][    C1] vcan0: j1939_tp_rxtimer: 0xffff88809edb4c00: rx timeout, send abort
[  477.362560][    C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88809edb4c00: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session.
[  477.386508][T16474] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  477.579562][   T52] Bluetooth: hci1: command tx timeout
[  477.684996][T16352] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  477.685035][T16352] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0
[  477.685062][T16352] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  477.685090][T16352] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0
[  478.053656][T16352] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  478.053698][T16352] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0
[  478.053727][T16352] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  478.053757][T16352] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0
[  478.322740][T16495] netlink: 5408 bytes leftover after parsing attributes in process `syz.3.2991'.
[  478.322812][T16495] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  478.494033][T16352] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  478.494076][T16352] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0
[  478.494108][T16352] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  478.494136][T16352] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0
[  478.747940][T16352] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  478.747982][T16352] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0
[  478.748012][T16352] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  478.748041][T16352] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0
[  478.808795][T16518] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  479.475599][T16534] syzkaller1: entered promiscuous mode
[  479.475627][T16534] syzkaller1: entered allmulticast mode
[  479.663139][   T52] Bluetooth: hci1: command tx timeout
[  479.758629][T16352] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  479.881101][T16352] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  479.882115][T16352] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  479.915449][T16352] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  479.960606][T16548] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[  479.975462][T16352] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  480.025499][T16352] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  480.172294][T16352] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  480.177095][T16352] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  480.261276][T16573] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3016'.
[  480.264814][T16573] Cannot find add_set index 0 as target
[  480.332188][T16574] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  480.544593][T16352] 8021q: adding VLAN 0 to HW filter on device bond0
[  480.595450][T16352] 8021q: adding VLAN 0 to HW filter on device team0
[  480.622534][ T1174] bridge0: port 1(bridge_slave_0) entered blocking state
[  480.622650][ T1174] bridge0: port 1(bridge_slave_0) entered forwarding state
[  480.723917][ T1174] bridge0: port 2(bridge_slave_1) entered blocking state
[  480.724032][ T1174] bridge0: port 2(bridge_slave_1) entered forwarding state
[  480.883804][T16603] syzkaller1: entered promiscuous mode
[  480.883831][T16603] syzkaller1: entered allmulticast mode
[  481.141689][T16609] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input6
[  481.357370][T16618] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3027'.
[  481.405997][T16621] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3028'.
[  481.739800][   T52] Bluetooth: hci1: command tx timeout
[  481.843358][T16641] syzkaller0: renamed from bond0 (while UP)
[  482.082086][T16650] netlink: 4208 bytes leftover after parsing attributes in process `syz.2.3035'.
[  482.082291][T16652] netlink: 4208 bytes leftover after parsing attributes in process `syz.2.3035'.
[  482.159195][T16657] netlink: 452 bytes leftover after parsing attributes in process `syz.3.3037'.
[  482.283047][T16652] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3035'.
[  482.285837][T16654] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3035'.
[  482.445448][T16673] netlink: 11 bytes leftover after parsing attributes in process `syz.3.3039'.
[  482.479130][T16352] 8021q: adding VLAN 0 to HW filter on device batadv0
[  482.720851][T16352] veth0_vlan: entered promiscuous mode
[  482.746179][T16352] veth1_vlan: entered promiscuous mode
[  482.808348][T16352] veth0_macvtap: entered promiscuous mode
[  482.846496][T16352] veth1_macvtap: entered promiscuous mode
[  482.908069][T16352] batman_adv: batadv0: Interface activated: batadv_slave_0
[  482.945415][T16352] batman_adv: batadv0: Interface activated: batadv_slave_1
[  482.994060][T16688] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3045'.
[  482.994119][T16688] netlink: 13 bytes leftover after parsing attributes in process `syz.0.3045'.
[  483.264401][T16693] syzkaller0: entered promiscuous mode
[  483.264422][T16693] syzkaller0: entered allmulticast mode
[  483.340382][ T1399] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  483.340442][ T1399] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  483.340487][ T1399] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  483.340531][ T1399] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  483.341935][T16697] lo: entered allmulticast mode
[  483.342134][T16697] tunl0: entered allmulticast mode
[  483.342265][T16697] gre0: entered allmulticast mode
[  483.342398][T16697] gretap0: entered allmulticast mode
[  483.342554][T16697] erspan0: entered allmulticast mode
[  483.342695][T16697] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check.
[  483.733171][T16711] xt_SECMARK: invalid mode: 9
[  484.221400][    C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  486.908584][ T9680] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  487.157463][T16723] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check.
[  487.261569][ T1399] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  487.261594][ T1399] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  487.292231][T16731] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3059'.
[  487.378160][ T1399] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  487.378185][ T1399] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  487.434622][T16737] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3061'.
[  487.445198][T16737] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3061'.
[  487.536998][T16739] xt_SECMARK: invalid mode: 9
[  487.568470][T16731] wg2 speed is unknown, defaulting to 1000
[  487.741139][ T9685] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  488.543545][ T5621] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  488.571140][ T5621] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  488.573142][ T5621] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  488.575864][ T5621] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  488.585397][ T5621] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  488.918145][T16774] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  489.272058][T16788] xt_SECMARK: invalid mode: 9
[  489.500572][T16795] Bluetooth: MGMT ver 1.23
[  489.940266][T16807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3080'.
[  489.940291][T16807] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3080'.
[  490.135335][T16768] wg2 speed is unknown, defaulting to 1000
[  490.135432][T16817] syzkaller0: entered promiscuous mode
[  490.135457][T16817] bond_slave_0: entered promiscuous mode
[  490.135681][T16817] bond_slave_1: entered promiscuous mode
[  490.135879][T16817] syzkaller0: entered allmulticast mode
[  490.135895][T16817] bond_slave_0: entered allmulticast mode
[  490.135912][T16817] bond_slave_1: entered allmulticast mode
[  490.503303][T16827] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3086'.
[  490.699613][ T5621] Bluetooth: hci0: command tx timeout
[  490.743811][T16835] xt_SECMARK: invalid mode: 9
[  490.981292][T16844] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  491.096429][T16851] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3091'.
[  491.542029][T16768] bridge0: port 1(bridge_slave_0) entered blocking state
[  491.542171][T16768] bridge0: port 1(bridge_slave_0) entered disabled state
[  491.542345][T16768] bridge_slave_0: entered allmulticast mode
[  491.544492][T16768] bridge_slave_0: entered promiscuous mode
[  491.556929][T16768] bridge0: port 2(bridge_slave_1) entered blocking state
[  491.559036][T16768] bridge0: port 2(bridge_slave_1) entered disabled state
[  491.564571][T16768] bridge_slave_1: entered allmulticast mode
[  491.579983][T16768] bridge_slave_1: entered promiscuous mode
[  491.582994][   T52] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  491.759237][T16768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  491.785393][T16768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  491.973225][T16768] team0: Port device team_slave_0 added
[  491.978075][T16768] team0: Port device team_slave_1 added
[  492.033490][T16768] batman_adv: batadv0: Adding interface: batadv_slave_0
[  492.033513][T16768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  492.033548][T16768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  492.093519][T16888] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 1, id = 0
[  492.095770][T16768] batman_adv: batadv0: Adding interface: batadv_slave_1
[  492.095790][T16768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  492.095824][T16768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  492.302870][T16768] hsr_slave_0: entered promiscuous mode
[  492.304169][T16768] hsr_slave_1: entered promiscuous mode
[  492.304999][T16768] debugfs: 'hsr0' already exists in 'hsr'
[  492.305021][T16768] Cannot create hsr debugfs directory
[  492.632461][T16895] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  492.675196][T16905] Unknown options in mask 6
[  492.710567][T16905] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3107'.
[  492.779529][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  493.678328][T16768] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  493.678370][T16768] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  493.856836][T16927] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  493.901432][T16953] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  493.973169][T16963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3113'.
[  493.974178][T16963] netlink: NAT attribute has 8 unknown bytes
[  493.974214][T16963] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  493.974658][T16963] netlink: NAT attribute has 8 unknown bytes
[  493.974690][T16963] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  493.977561][T16963] netlink: NAT attribute has 8 unknown bytes
[  493.977597][T16963] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  493.978121][T16963] netlink: NAT attribute has 8 unknown bytes
[  493.978150][T16963] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  493.978554][T16963] netlink: NAT attribute has 8 unknown bytes
[  493.978587][T16963] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  494.114458][T16966] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3113'.
[  494.311864][T16768] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  494.311909][T16768] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  494.378518][T16975] Cannot find del_set index 0 as target
[  494.517273][T16966] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3113'.
[  494.669165][T16966] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3113'.
[  494.731603][T16966] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3113'.
[  494.814071][T16768] bond0: (slave netdevsim1): Releasing backup interface
[  494.859518][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  494.906822][T16768] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  494.906866][T16768] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  495.226021][T16966] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR
[  495.372904][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.372934][T17008] netlink: 3581 bytes leftover after parsing attributes in process `syz.0.3120'.
[  495.373188][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.373204][T17008] netlink: 3581 bytes leftover after parsing attributes in process `syz.0.3120'.
[  495.373426][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.373441][T17008] netlink: 3581 bytes leftover after parsing attributes in process `syz.0.3120'.
[  495.373623][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.373637][T17008] netlink: 3581 bytes leftover after parsing attributes in process `syz.0.3120'.
[  495.374004][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.374221][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.377006][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.377210][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.377467][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.377651][T17008] netlink: 'syz.0.3120': attribute type 4 has an invalid length.
[  495.525006][T16768] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0
[  495.525048][T16768] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  496.560952][T16768] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  496.614951][T16768] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  496.616275][T16768] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  496.648658][T16768] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  496.650025][T16768] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  496.676166][T16768] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  496.677287][T16768] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  496.700638][T16768] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  496.850245][T16768] 8021q: adding VLAN 0 to HW filter on device bond0
[  496.939381][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  496.974421][T16768] 8021q: adding VLAN 0 to HW filter on device team0
[  497.015152][   T59] bridge0: port 1(bridge_slave_0) entered blocking state
[  497.015286][   T59] bridge0: port 1(bridge_slave_0) entered forwarding state
[  497.057131][   T59] bridge0: port 2(bridge_slave_1) entered blocking state
[  497.057322][   T59] bridge0: port 2(bridge_slave_1) entered forwarding state
[  497.225645][T16768] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  497.682854][T17084] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT
[  497.721689][T17084] __nla_validate_parse: 9 callbacks suppressed
[  497.721712][T17084] netlink: 200 bytes leftover after parsing attributes in process `syz.2.3135'.
[  498.548381][T16768] 8021q: adding VLAN 0 to HW filter on device batadv0
[  499.019441][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  499.310144][T17139] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3144'.
[  499.580434][    C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  499.623913][T16768] veth0_vlan: entered promiscuous mode
[  499.675647][T16768] veth1_vlan: entered promiscuous mode
[  499.922262][T17161] FAULT_INJECTION: forcing a failure.
[  499.922262][T17161] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  499.922300][T17161] CPU: 0 UID: 0 PID: 17161 Comm: syz.1.3152 Not tainted syzkaller #0 PREEMPT(full) 
[  499.922325][T17161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  499.922339][T17161] Call Trace:
[  499.922349][T17161]  <TASK>
[  499.922358][T17161]  dump_stack_lvl+0xe8/0x150
[  499.922397][T17161]  should_fail_ex+0x410/0x560
[  499.922428][T17161]  _copy_from_iter+0x4ff/0x1660
[  499.922463][T17161]  ? __alloc_skb+0x27a/0x7a0
[  499.922491][T17161]  ? __pfx__copy_from_iter+0x10/0x10
[  499.922514][T17161]  ? kmem_cache_alloc_node_noprof+0x1f9/0x610
[  499.922548][T17161]  ? __alloc_skb+0x27a/0x7a0
[  499.922571][T17161]  ? __alloc_skb+0x27a/0x7a0
[  499.922603][T17161]  ? netlink_sendmsg+0x650/0xb40
[  499.922637][T17161]  ? skb_put+0x112/0x210
[  499.922666][T17161]  netlink_sendmsg+0x6c0/0xb40
[  499.922710][T17161]  ? __pfx_netlink_sendmsg+0x10/0x10
[  499.922753][T17161]  ? apparmor_socket_sendmsg+0x98/0x360
[  499.922781][T17161]  ? __pfx_netlink_sendmsg+0x10/0x10
[  499.922814][T17161]  sock_sendmsg_nosec+0x13a/0x180
[  499.922840][T17161]  ____sys_sendmsg+0x54e/0x850
[  499.922887][T17161]  ? __pfx_____sys_sendmsg+0x10/0x10
[  499.922927][T17161]  ? import_iovec+0x73/0xa0
[  499.922961][T17161]  ___sys_sendmsg+0x2a5/0x360
[  499.922990][T17161]  ? __lock_acquire+0x747/0x2de0
[  499.923018][T17161]  ? __pfx____sys_sendmsg+0x10/0x10
[  499.923085][T17161]  ? __fget_files+0x2a/0x420
[  499.923116][T17161]  ? __fget_files+0x3a2/0x420
[  499.923157][T17161]  __x64_sys_sendmsg+0x1b1/0x290
[  499.923189][T17161]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  499.923242][T17161]  do_syscall_64+0x166/0x520
[  499.923269][T17161]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  499.923293][T17161]  ? clear_bhb_loop+0x70/0xc0
[  499.923318][T17161]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  499.923340][T17161] RIP: 0033:0x7f3407f9e159
[  499.923360][T17161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  499.923379][T17161] RSP: 002b:00007f3408dd1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  499.923403][T17161] RAX: ffffffffffffffda RBX: 00007f3408225fa0 RCX: 00007f3407f9e159
[  499.923420][T17161] RDX: 0000000000004014 RSI: 00002000000000c0 RDI: 0000000000000003
[  499.923434][T17161] RBP: 00007f3408dd1090 R08: 0000000000000000 R09: 0000000000000000
[  499.923447][T17161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  499.923458][T17161] R13: 00007f3408226038 R14: 00007f3408225fa0 R15: 00007ffdfda3c018
[  499.923491][T17161]  </TASK>
[  500.589584][T16768] veth0_macvtap: entered promiscuous mode
[  500.634123][T16768] veth1_macvtap: entered promiscuous mode
[  500.839209][T16768] batman_adv: batadv0: Interface activated: batadv_slave_0
[  500.876974][T16768] batman_adv: batadv0: Interface activated: batadv_slave_1
[  500.980801][   T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  500.980854][   T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  500.980893][   T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  500.980932][   T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  501.217476][ T1399] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  501.217504][ T1399] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  501.406892][ T9320] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  501.406917][ T9320] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  501.465731][T17207] FAULT_INJECTION: forcing a failure.
[  501.465731][T17207] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  501.465772][T17207] CPU: 1 UID: 0 PID: 17207 Comm: syz.3.3164 Not tainted syzkaller #0 PREEMPT(full) 
[  501.465798][T17207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  501.465813][T17207] Call Trace:
[  501.465822][T17207]  <TASK>
[  501.465833][T17207]  dump_stack_lvl+0xe8/0x150
[  501.465875][T17207]  should_fail_ex+0x410/0x560
[  501.465908][T17207]  _copy_from_iter+0x4ff/0x1660
[  501.465946][T17207]  ? __alloc_skb+0x27a/0x7a0
[  501.465976][T17207]  ? __pfx__copy_from_iter+0x10/0x10
[  501.466004][T17207]  ? kmem_cache_alloc_node_noprof+0x1f9/0x610
[  501.466041][T17207]  ? __alloc_skb+0x27a/0x7a0
[  501.466067][T17207]  ? __alloc_skb+0x27a/0x7a0
[  501.466101][T17207]  ? netlink_sendmsg+0x650/0xb40
[  501.466137][T17207]  ? skb_put+0x112/0x210
[  501.466169][T17207]  netlink_sendmsg+0x6c0/0xb40
[  501.466217][T17207]  ? __pfx_netlink_sendmsg+0x10/0x10
[  501.466358][T17207]  ? apparmor_socket_sendmsg+0x98/0x360
[  501.466422][T17207]  ? __pfx_netlink_sendmsg+0x10/0x10
[  501.466459][T17207]  sock_sendmsg_nosec+0x13a/0x180
[  501.466489][T17207]  ____sys_sendmsg+0x54e/0x850
[  501.466529][T17207]  ? __pfx_____sys_sendmsg+0x10/0x10
[  501.466573][T17207]  ? import_iovec+0x73/0xa0
[  501.466605][T17207]  ___sys_sendmsg+0x2a5/0x360
[  501.466636][T17207]  ? __lock_acquire+0x747/0x2de0
[  501.466665][T17207]  ? __pfx____sys_sendmsg+0x10/0x10
[  501.466734][T17207]  ? __fget_files+0x2a/0x420
[  501.466779][T17207]  ? __fget_files+0x3a2/0x420
[  501.466821][T17207]  __x64_sys_sendmsg+0x1b1/0x290
[  501.466857][T17207]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  501.466912][T17207]  do_syscall_64+0x166/0x520
[  501.466942][T17207]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  501.466968][T17207]  ? clear_bhb_loop+0x70/0xc0
[  501.466998][T17207]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  501.467023][T17207] RIP: 0033:0x7fab2559e159
[  501.467045][T17207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  501.467067][T17207] RSP: 002b:00007fab263c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  501.467094][T17207] RAX: ffffffffffffffda RBX: 00007fab25825fa0 RCX: 00007fab2559e159
[  501.467113][T17207] RDX: 0000000000004014 RSI: 00002000000000c0 RDI: 0000000000000003
[  501.467129][T17207] RBP: 00007fab263c5090 R08: 0000000000000000 R09: 0000000000000000
[  501.467145][T17207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  501.467160][T17207] R13: 00007fab25826038 R14: 00007fab25825fa0 R15: 00007fffe2e984f8
[  501.467199][T17207]  </TASK>
[  501.513521][ T1311] ieee802154 phy1 wpan1: encryption failed: -22
[  501.821709][   T52] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  501.822089][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  501.823719][T17211] netlink: 6076 bytes leftover after parsing attributes in process `syz.4.3068'.
[  501.824139][T17211] netlink: 112 bytes leftover after parsing attributes in process `syz.4.3068'.
[  502.034541][T17215] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3165'.
[  502.249123][   T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  502.261144][   T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  502.270053][   T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  502.286355][   T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  502.287783][   T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  502.487367][T17227] bridge0: port 3(vlan2) entered blocking state
[  502.487510][T17227] bridge0: port 3(vlan2) entered disabled state
[  502.487686][T17227] vlan2: entered allmulticast mode
[  502.487704][T17227] geneve0: entered allmulticast mode
[  502.526554][T17227] vlan2: entered promiscuous mode
[  502.526581][T17227] geneve0: entered promiscuous mode
[  502.910553][T17239] tipc: Trying to set illegal importance in message
[  503.353557][T17259] net_ratelimit: 9 callbacks suppressed
[  503.353584][T17259] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  503.702433][T17266] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3180'.
[  503.747767][T17220] wg2 speed is unknown, defaulting to 1000
[  504.380741][ T5621] Bluetooth: hci4: command tx timeout
[  504.585217][T17295] netlink: 136 bytes leftover after parsing attributes in process `syz.0.3184'.
[  504.710473][T17299] validate_nla: 4 callbacks suppressed
[  504.710507][T17299] netlink: 'syz.1.3186': attribute type 1 has an invalid length.
[  504.710525][T17299] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3186'.
[  505.263569][T17220] bridge0: port 1(bridge_slave_0) entered blocking state
[  505.263810][T17220] bridge0: port 1(bridge_slave_0) entered disabled state
[  505.264023][T17220] bridge_slave_0: entered allmulticast mode
[  505.296223][T17220] bridge_slave_0: entered promiscuous mode
[  505.313625][T17220] bridge0: port 2(bridge_slave_1) entered blocking state
[  505.315307][T17220] bridge0: port 2(bridge_slave_1) entered disabled state
[  505.315500][T17220] bridge_slave_1: entered allmulticast mode
[  505.319086][T17220] bridge_slave_1: entered promiscuous mode
[  505.387808][T17328] Cannot find set identified by id 0 to match
[  505.411302][T17324] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3193'.
[  505.441823][T17220] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  505.471218][T17220] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  505.494488][T17331] netlink: 388 bytes leftover after parsing attributes in process `syz.1.3196'.
[  505.535303][T17329] dvmrp0: entered allmulticast mode
[  505.613072][T17220] team0: Port device team_slave_0 added
[  505.643342][T17220] team0: Port device team_slave_1 added
[  505.818791][T17220] batman_adv: batadv0: Adding interface: batadv_slave_0
[  505.818812][T17220] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  505.818841][T17220] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  505.872364][T17220] batman_adv: batadv0: Adding interface: batadv_slave_1
[  505.872387][T17220] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  505.872418][T17220] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  506.188867][T17220] hsr_slave_0: entered promiscuous mode
[  506.198081][T17220] hsr_slave_1: entered promiscuous mode
[  506.205660][T17220] debugfs: 'hsr0' already exists in 'hsr'
[  506.205686][T17220] Cannot create hsr debugfs directory
[  506.459747][ T5621] Bluetooth: hci4: command tx timeout
[  506.985619][T17365] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  507.151284][T17371] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  507.404011][T17379] xt_SECMARK: invalid mode: 9
[  507.407921][T17220] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  507.407965][T17220] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  507.634664][T17382] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3210'.
[  507.848906][T17220] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  507.848947][T17220] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  507.964434][T17220] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  507.964479][T17220] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  508.091248][   T59] IPVS: starting estimator thread 0...
[  508.154170][T17220] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  508.154212][T17220] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  508.219726][T17397] IPVS: using max 26 ests per chain, 62400 per kthread
[  508.424355][T17398] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3213'.
[  508.540716][ T5621] Bluetooth: hci4: command tx timeout
[  508.865688][T17404] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3214'.
[  509.040923][T17412] netlink: 'syz.2.3217': attribute type 1 has an invalid length.
[  509.041083][T17413] netlink: 'syz.2.3217': attribute type 1 has an invalid length.
[  509.158438][T17419] xt_hashlimit: size too large, truncated to 1048576
[  509.331465][T17412] 8021q: adding VLAN 0 to HW filter on device bond7
[  509.405303][T17429] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3220'.
[  509.418955][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.419148][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.440860][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.441106][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.441289][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.441494][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.441880][T17415] bond7: (slave veth11): Enslaving as an active interface with a down link
[  509.446784][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.447045][T17434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3221'.
[  509.527196][T17421] 8021q: adding VLAN 0 to HW filter on device batadv0
[  509.537275][T17421] bond7: (slave batadv0): making interface the new active one
[  509.538747][T17421] batadv0: entered promiscuous mode
[  509.539196][T17421] bond7: (slave batadv0): Enslaving as an active interface with an up link
[  509.582880][T17422] bond7 (unregistering): (slave veth11): Releasing active interface
[  509.599613][T17422] bond7 (unregistering): (slave batadv0): Releasing active interface
[  509.599699][T17422] batadv0: left promiscuous mode
[  509.604242][T17422] bond7 (unregistering): Released all slaves
[  509.816459][T17439] macvlan2: entered promiscuous mode
[  509.816486][T17439] macvlan2: entered allmulticast mode
[  509.817695][T17439] bond0: entered promiscuous mode
[  509.818657][T17439] 8021q: adding VLAN 0 to HW filter on device macvlan2
[  509.860691][T17439] bond0: left promiscuous mode
[  510.146752][T17442] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  510.190979][T17220] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  510.251202][T17220] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  510.253189][T17220] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  510.306175][T17220] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  510.336555][ T9327] IPVS: starting estimator thread 0...
[  510.366440][T17220] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  510.391942][T17220] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  510.415123][T17220] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  510.420309][T17463] IPVS: using max 31 ests per chain, 74400 per kthread
[  510.440126][T17220] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  510.482492][T17470] netlink: 'syz.0.3226': attribute type 58 has an invalid length.
[  510.482660][T17468] netlink: 'syz.0.3226': attribute type 58 has an invalid length.
[  510.619539][ T5621] Bluetooth: hci4: command tx timeout
[  511.119699][T17489] xt_SECMARK: invalid mode: 9
[  511.261620][T17220] 8021q: adding VLAN 0 to HW filter on device bond0
[  511.338986][T17220] 8021q: adding VLAN 0 to HW filter on device team0
[  511.395663][ T1399] bridge0: port 1(bridge_slave_0) entered blocking state
[  511.395789][ T1399] bridge0: port 1(bridge_slave_0) entered forwarding state
[  511.426668][T17498] syzkaller0: entered promiscuous mode
[  511.426694][T17498] syzkaller0: entered allmulticast mode
[  511.445012][   T59] bridge0: port 2(bridge_slave_1) entered blocking state
[  511.445124][   T59] bridge0: port 2(bridge_slave_1) entered forwarding state
[  511.466884][T17498] tipc: Started in network mode
[  511.466920][T17498] tipc: Node identity 1a8826320d22, cluster identity 4711
[  511.489930][T17498] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  511.717727][T17498] tipc: Resetting bearer <eth:syzkaller0>
[  511.807038][T17497] tipc: Resetting bearer <eth:syzkaller0>
[  511.878972][T17497] tipc: Disabling bearer <eth:syzkaller0>
[  512.402448][T17525] netlink: 'syz.0.3242': attribute type 12 has an invalid length.
[  512.541360][T17533] xt_SECMARK: invalid mode: 9
[  513.180307][ T5621] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  513.180592][ T5621] Bluetooth: hci0: command 0x041b tx timeout
[  513.442257][T17220] 8021q: adding VLAN 0 to HW filter on device batadv0
[  513.550850][T17574] xt_SECMARK: invalid mode: 9
[  513.714679][T17220] veth0_vlan: entered promiscuous mode
[  513.783539][T17220] veth1_vlan: entered promiscuous mode
[  513.902762][T17220] veth0_macvtap: entered promiscuous mode
[  513.925046][T17220] veth1_macvtap: entered promiscuous mode
[  514.474986][T17220] batman_adv: batadv0: Interface activated: batadv_slave_0
[  514.516235][T17220] batman_adv: batadv0: Interface activated: batadv_slave_1
[  514.603946][T17594] __nla_validate_parse: 27 callbacks suppressed
[  514.603971][T17594] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3262'.
[  514.613638][   T59] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  514.613776][   T59] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  514.613888][   T59] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  514.613998][   T59] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  514.676318][T17593] bridge_slave_0: left allmulticast mode
[  514.676341][T17593] bridge_slave_0: left promiscuous mode
[  514.676520][T17593] bridge0: port 1(bridge_slave_0) entered disabled state
[  514.702760][T17593] bridge_slave_1: left allmulticast mode
[  514.702788][T17593] bridge_slave_1: left promiscuous mode
[  514.703005][T17593] bridge0: port 2(bridge_slave_1) entered disabled state
[  514.704212][T17593] vlan2: left promiscuous mode
[  514.704234][T17593] geneve0: left promiscuous mode
[  514.741205][T17593] syzkaller0: (slave bond_slave_0): Releasing backup interface
[  514.741971][T17593] bond_slave_0: left promiscuous mode
[  514.742122][T17593] bond_slave_0: left allmulticast mode
[  514.745128][T17593] syzkaller0: (slave bond_slave_1): Releasing backup interface
[  514.747670][T17593] bond_slave_1: left promiscuous mode
[  514.747804][T17593] bond_slave_1: left allmulticast mode
[  514.800035][T17593] team0: Port device team_slave_0 removed
[  514.804467][T17593] team0: Port device team_slave_1 removed
[  514.805260][T17593] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  514.805278][T17593] batman_adv: batadv0: Removing interface: batadv_slave_0
[  514.806699][T17593] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  514.806716][T17593] batman_adv: batadv0: Removing interface: batadv_slave_1
[  514.808531][T17593] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[  515.055349][T17595] team0: Mode changed to "loadbalance"
[  515.141023][T17606] xt_SECMARK: invalid mode: 9
[  515.212607][   T13] IPVS: starting estimator thread 0...
[  515.238072][T17608] netlink: 'syz.2.3265': attribute type 4 has an invalid length.
[  515.238100][T17608] netlink: 'syz.2.3265': attribute type 8 has an invalid length.
[  515.238116][T17608] netlink: 212 bytes leftover after parsing attributes in process `syz.2.3265'.
[  515.319436][T17611] IPVS: using max 30 ests per chain, 72000 per kthread
[  515.358749][T17617] netlink: 'syz.2.3265': attribute type 4 has an invalid length.
[  515.358775][T17617] netlink: 'syz.2.3265': attribute type 8 has an invalid length.
[  515.358788][T17617] netlink: 'syz.2.3265': attribute type 1 has an invalid length.
[  515.358800][T17617] netlink: 196 bytes leftover after parsing attributes in process `syz.2.3265'.
[  515.358815][T17617] NCSI netlink: No device for ifindex 7388457
[  515.660136][   T52] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  515.660248][ T5621] Bluetooth: hci0: command 0x041b tx timeout
[  516.161525][   T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  516.161553][   T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  516.221574][T17635] ip6gre1: entered promiscuous mode
[  516.221599][T17635] ip6gre1: entered allmulticast mode
[  516.455090][ T3377] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  516.455116][ T3377] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  516.776436][T17670] netlink: 'syz.3.3167': attribute type 1 has an invalid length.
[  517.093691][T17666] netlink: 'syz.3.3167': attribute type 12 has an invalid length.
[  517.145982][T17671] netlink: 'syz.1.3276': attribute type 1 has an invalid length.
[  517.578259][T17683] openvswitch: netlink: Missing key (keys=40, expected=2000)
[  517.814344][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  517.827680][ T5621] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  517.846554][ T5621] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  517.849558][ T5621] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  517.861543][ T5621] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  518.240984][T17697] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3290'.
[  518.390911][T17699] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3291'.
[  519.182285][T17676] wg2 speed is unknown, defaulting to 1000
[  519.390286][T17726] block nbd0: reconnected socket
[  519.390401][T17726] block nbd0: reconnected socket
[  519.397920][T17726] netlink: 'syz.1.3297': attribute type 9 has an invalid length.
[  519.556757][ T5621] block nbd0: Receive control failed (result -32)
[  519.560150][   T52] block nbd0: Receive control failed (result -32)
[  519.899776][ T5621] Bluetooth: hci2: command tx timeout
[  520.543007][T17763] Bluetooth: MGMT ver 1.23
[  520.620293][T17676] bridge0: port 1(bridge_slave_0) entered blocking state
[  520.620431][T17676] bridge0: port 1(bridge_slave_0) entered disabled state
[  520.620607][T17676] bridge_slave_0: entered allmulticast mode
[  520.659597][T17676] bridge_slave_0: entered promiscuous mode
[  520.678347][T17676] bridge0: port 2(bridge_slave_1) entered blocking state
[  520.678483][T17676] bridge0: port 2(bridge_slave_1) entered disabled state
[  520.690940][T17676] bridge_slave_1: entered allmulticast mode
[  520.719731][T17676] bridge_slave_1: entered promiscuous mode
[  520.908235][T17676] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  520.955003][T17676] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  521.171804][T17676] team0: Port device team_slave_0 added
[  521.179938][T17676] team0: Port device team_slave_1 added
[  521.244849][   T13] IPVS: starting estimator thread 0...
[  521.308071][T17676] batman_adv: batadv0: Adding interface: batadv_slave_0
[  521.308093][T17676] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  521.316639][T17676] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  521.351819][T17778] IPVS: using max 25 ests per chain, 60000 per kthread
[  521.441301][T17676] batman_adv: batadv0: Adding interface: batadv_slave_1
[  521.441323][T17676] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  521.441357][T17676] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  521.979494][ T5621] Bluetooth: hci2: command tx timeout
[  522.005776][ T5621] Bluetooth: hci5: Malformed HCI Event
[  522.029154][ T5621] Bluetooth: hci5: Malformed HCI Event
[  522.331565][T17676] hsr_slave_0: entered promiscuous mode
[  522.335198][T17676] hsr_slave_1: entered promiscuous mode
[  522.336473][T17676] debugfs: 'hsr0' already exists in 'hsr'
[  522.336497][T17676] Cannot create hsr debugfs directory
[  522.339748][   T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  522.448573][T17802] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3317'.
[  522.448606][T17802] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3317'.
[  522.448625][T17802] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3317'.
[  522.448957][T17802] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3317'.
[  522.764306][T17806] netlink: 'syz.1.3318': attribute type 1 has an invalid length.
[  523.361021][T17830] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3327'.
[  524.060365][ T5621] Bluetooth: hci2: command tx timeout
[  524.932080][T17676] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  525.140424][T17676] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  525.235117][T17881] syzkaller0: entered promiscuous mode
[  525.235149][T17881] syzkaller0: entered allmulticast mode
[  525.253909][T17676] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  525.284022][T17676] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  525.287966][T17676] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  525.313344][T17676] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  525.331338][T17676] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  525.351471][T17676] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  526.139548][ T5621] Bluetooth: hci2: command tx timeout
[  528.380369][    C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  530.269699][T17917] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4
[  530.269750][T17917] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4
[  530.269796][T17917] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  530.274695][T17918] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR
[  530.512933][T17926] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3353'.
[  530.512966][T17926] IPv6: NLM_F_CREATE should be specified when creating new route
[  530.593256][T17676] 8021q: adding VLAN 0 to HW filter on device bond0
[  530.681825][T17676] 8021q: adding VLAN 0 to HW filter on device team0
[  530.728249][ T1399] bridge0: port 1(bridge_slave_0) entered blocking state
[  530.728365][ T1399] bridge0: port 1(bridge_slave_0) entered forwarding state
[  530.777732][ T1399] bridge0: port 2(bridge_slave_1) entered blocking state
[  530.777851][ T1399] bridge0: port 2(bridge_slave_1) entered forwarding state
[  531.776809][T17960] tipc: Started in network mode
[  531.776847][T17960] tipc: Node identity ac14140f, cluster identity 4711
[  531.797890][T17963] netlink: 'syz.3.3359': attribute type 1 has an invalid length.
[  531.807250][T17960] tipc: New replicast peer: 255.255.255.255
[  531.808387][T17960] tipc: Enabled bearer <udp:syz2>, priority 10
[  531.809180][T17962] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3359'.
[  531.942890][T17960] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3359'.
[  531.956807][T17960] ipvlan1: entered promiscuous mode
[  531.958781][T17960] ipvlan1: entered allmulticast mode
[  531.958848][T17960] veth0_vlan: entered allmulticast mode
[  532.181358][T17972] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3360'.
[  532.344505][T17676] 8021q: adding VLAN 0 to HW filter on device batadv0
[  532.548760][T17676] veth0_vlan: entered promiscuous mode
[  532.619512][ T5621] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  532.619673][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  532.646561][T17676] veth1_vlan: entered promiscuous mode
[  532.682400][T17989] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3365'.
[  532.682672][T17989] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3365'.
[  532.682913][T17989] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3365'.
[  532.683153][T17989] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3365'.
[  532.686840][T17989] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3365'.
[  532.916678][T17993] bond4: (slave gretap1): Enslaving as an active interface with an up link
[  532.971278][T15065] tipc: Node number set to 2886997007
[  533.016592][T17996] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3365'.
[  533.143828][T17676] veth0_macvtap: entered promiscuous mode
[  533.169286][T17676] veth1_macvtap: entered promiscuous mode
[  533.234980][T17676] batman_adv: batadv0: Interface activated: batadv_slave_0
[  533.319776][T17676] batman_adv: batadv0: Interface activated: batadv_slave_1
[  533.372474][ T1399] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  533.372752][ T1399] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  533.372798][ T1399] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  533.372836][ T1399] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  534.386316][ T1399] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  534.386340][ T1399] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  534.525007][T18027] syzkaller0: entered promiscuous mode
[  534.525033][T18027] syzkaller0: entered allmulticast mode
[  534.635110][T18034] mac80211_hwsim hwsim104 wlan0: entered promiscuous mode
[  534.635144][T18034] mac80211_hwsim hwsim104 wlan0: entered allmulticast mode
[  534.635363][T18034] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  534.715648][T18039] netlink: 'syz.3.3372': attribute type 10 has an invalid length.
[  534.753625][T18039] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  534.758574][T18039] team0: Port device netdevsim1 added
[  534.759673][   T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  534.759696][   T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  535.002005][T18043] netlink: 'syz.0.3375': attribute type 11 has an invalid length.
[  535.195287][T18042] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  535.341684][T18050] netlink: 'syz.1.3376': attribute type 21 has an invalid length.
[  535.833183][T18061] bridge0: port 3(bond0) entered blocking state
[  535.833299][T18061] bridge0: port 3(bond0) entered disabled state
[  535.887643][T18061] bond0: entered allmulticast mode
[  535.887671][T18061] bond_slave_0: entered allmulticast mode
[  535.887724][T18061] bond_slave_1: entered allmulticast mode
[  535.967989][T18061] bond0: entered promiscuous mode
[  535.968021][T18061] bond_slave_0: entered promiscuous mode
[  535.968254][T18061] bond_slave_1: entered promiscuous mode
[  536.063237][T18061] bridge0: port 3(bond0) entered blocking state
[  536.063449][T18061] bridge0: port 3(bond0) entered forwarding state
[  536.163652][T18063] __nla_validate_parse: 4 callbacks suppressed
[  536.163678][T18063] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3378'.
[  536.477918][ T9327] IPVS: starting estimator thread 0...
[  536.560308][T18084] IPVS: using max 26 ests per chain, 62400 per kthread
[  536.697986][T18086] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3382'.
[  537.043451][T18100] netlink: 176 bytes leftover after parsing attributes in process `syz.1.3383'.
[  537.046103][T18100] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3383'.
[  537.046137][T18100] netlink: 'syz.1.3383': attribute type 1 has an invalid length.
[  537.050044][T18100] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3383'.
[  537.272028][T18108] ip_tables: iptables: counters copy to user failed while replacing table
[  537.479037][T18111] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3388'.
[  537.518756][T18111] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3388'.
[  537.518823][T18111] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3388'.
[  537.550751][T18115] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3390'.
[  537.550788][T18115] netlink: 'syz.2.3390': attribute type 12 has an invalid length.
[  537.600406][T18116] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3390'.
[  537.600443][T18116] netlink: 'syz.2.3390': attribute type 12 has an invalid length.
[  537.856306][T18126] siw: device registration error -23
[  537.943500][ T1399] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  537.944296][ T1174] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  537.944430][ T1174] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  537.950541][ T1174] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  538.127472][T18131] syzkaller0: entered promiscuous mode
[  538.127498][T18131] syzkaller0: entered allmulticast mode
[  538.347477][T18141] 
@0Ù: renamed from bond_slave_1 (while UP)
[  538.577752][T18147] netlink: 'syz.1.3400': attribute type 30 has an invalid length.
[  540.619504][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  540.619692][ T5621] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  541.682388][T18164] tap0: tun_chr_ioctl cmd 1074025672
[  541.682415][T18164] tap0: ignored: set checksum disabled
[  541.747837][T18178] __nla_validate_parse: 4 callbacks suppressed
[  541.747861][T18178] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3407'.
[  541.845577][T18179] bridge0: port 1(vlan4) entered blocking state
[  541.847401][T18179] bridge0: port 1(vlan4) entered disabled state
[  541.847638][T18179] vlan4: entered allmulticast mode
[  541.863451][T18179] vlan4: entered promiscuous mode
[  541.863518][T18179] geneve0: entered promiscuous mode
[  541.864501][T18179] vlan2: entered promiscuous mode
[  541.957232][T18196] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3411'.
[  542.441290][T18211] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3416'.
[  542.441321][T18211] openvswitch: netlink: Flow set message rejected, Key attribute missing.
[  543.948237][T18263] team0: Port device wg1 added
[  543.993715][T18263] netlink: 'syz.0.3430': attribute type 1 has an invalid length.
[  544.155813][T18266] bond2: option arp_validate: invalid value (1048579)
[  544.157310][T18266] bond2 (unregistering): Released all slaves
[  544.309888][T18271] bond2: option arp_validate: invalid value (1048579)
[  544.317512][T18271] bond2 (unregistering): Released all slaves
[  544.539602][ T5621] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  544.539949][ T5621] Bluetooth: hci0: command 0x041b tx timeout
[  544.572322][T18287] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3437'.
[  544.573958][T18287] syzkaller1: tun_chr_ioctl cmd 2147767521
[  544.598128][T18287] syzkaller1: tun_chr_ioctl cmd 1074025673
[  544.607760][T18290] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3437'.
[  544.623870][T18287] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3437'.
[  544.624559][T18287] syzkaller1: tun_chr_ioctl cmd 2147767521
[  544.773511][T18295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3436'.
[  545.355037][T18314] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3444'.
[  545.522840][T18323] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3447'.
[  545.768572][T18325] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3448'.
[  546.797900][T18364] xt_SECMARK: invalid mode: 9
[  546.913448][T18371] ip6tnl1: entered allmulticast mode
[  547.061752][ T1399] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  547.062046][ T1399] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  547.091300][T15068] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  547.159735][T18384] __nla_validate_parse: 1 callbacks suppressed
[  547.159760][T18384] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3463'.
[  547.220168][T15068] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  547.384807][T18395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3467'.
[  547.495801][T18395] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3467'.
[  547.495834][T18395] nbd: couldn't find a device at index 64
[  547.672498][T18405] vlan5: entered allmulticast mode
[  547.672526][T18405] bridge_slave_0: entered allmulticast mode
[  547.834068][T18405] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3470'.
[  547.899816][T15069] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  547.974929][T18424] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3476'.
[  547.996962][T18424] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3476'.
[  548.181723][ T5621] Bluetooth: hci0: command 0x041b tx timeout
[  548.191999][   T52] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  548.390014][T18435] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3480'.
[  548.671156][T18446] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3482'.
[  548.983800][T18449] xt_CT: No such helper "syz1"
[  548.994857][T18448] wg2 speed is unknown, defaulting to 1000
[  549.174543][T18454] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3487'.
[  549.335334][T18475] xt_hashlimit: max too large, truncated to 1048576
[  549.335581][T18474] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3490'.
[  549.354410][T18475] No such timeout policy "syz1"
[  549.627856][T18484] ip_tables: iptables: counters copy to user failed while replacing table
[  549.649444][T18484] IPVS: set_ctl: invalid protocol: 58 172.30.0.3:20004
[  550.456956][T18508] netlink: 'syz.0.3498': attribute type 1 has an invalid length.
[  550.709814][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  550.816256][T18518] pimreg: tun_chr_ioctl cmd 1074025681
[  551.291617][T18526] netlink: 'syz.0.3504': attribute type 4 has an invalid length.
[  551.552973][T18531] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3
[  551.749127][T18538] netlink: 'syz.2.3509': attribute type 1 has an invalid length.
[  551.782581][T18538] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check.
[  551.901199][T18540] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available
[  551.952163][T18540] netlink: 'syz.3.3510': attribute type 1 has an invalid length.
[  552.124005][T18540] 8021q: adding VLAN 0 to HW filter on device bond1
[  552.258889][T18558] openvswitch: netlink: IP tunnel dst address not specified
[  552.307491][ T5621] Bluetooth: hci2: ISO packet too small
[  552.386080][T18567] netlink: 'syz.3.3517': attribute type 10 has an invalid length.
[  552.386549][T18567] bridge0: port 2(bridge_slave_1) entered disabled state
[  552.387568][T18567] bridge0: port 1(bridge_slave_0) entered disabled state
[  552.422635][T18567] bridge0: port 2(bridge_slave_1) entered blocking state
[  552.422817][T18567] bridge0: port 2(bridge_slave_1) entered forwarding state
[  552.423193][T18567] bridge0: port 1(bridge_slave_0) entered blocking state
[  552.423394][T18567] bridge0: port 1(bridge_slave_0) entered forwarding state
[  552.429105][T18567] bond0: (slave bridge0): Enslaving as an active interface with an up link
[  552.558361][T18563] bridge0: port 3(wlan1) entered blocking state
[  552.558497][T18563] bridge0: port 3(wlan1) entered disabled state
[  552.558692][T18563] mac80211_hwsim hwsim111 wlan1: entered allmulticast mode
[  552.610198][T18563] mac80211_hwsim hwsim111 wlan1: entered promiscuous mode
[  552.659737][T18563] mac80211_hwsim hwsim111 wlan1 (unregistering): left allmulticast mode
[  552.659774][T18563] mac80211_hwsim hwsim111 wlan1 (unregistering): left promiscuous mode
[  552.660397][T18563] bridge0: port 3(wlan1) entered disabled state
[  552.678236][T18577] __nla_validate_parse: 6 callbacks suppressed
[  552.678259][T18577] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3518'.
[  552.678365][T18577] openvswitch: netlink: Message has 4 unknown bytes.
[  552.725698][T18578] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3518'.
[  552.725840][T18578] openvswitch: netlink: Message has 4 unknown bytes.
[  552.940307][ T5621] Bluetooth: hci0: command 0x041b tx timeout
[  552.940374][   T52] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  553.956471][T18650] syzkaller1: entered promiscuous mode
[  553.956497][T18650] syzkaller1: entered allmulticast mode
[  554.031770][T18650] syzkaller1: left promiscuous mode
[  554.247932][T18657] netdevsim netdevsim0 netdevsim0: entered allmulticast mode
[  554.267972][T18657] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  554.421800][T18662] syzkaller0: entered promiscuous mode
[  554.421828][T18662] syzkaller0: entered allmulticast mode
[  554.449462][T18662] tipc: Started in network mode
[  554.449500][T18662] tipc: Node identity b2f78b2dd29f, cluster identity 4711
[  554.454966][T18662] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  554.572238][T18665] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3528'.
[  554.572270][T18665] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3528'.
[  555.019665][ T5621] Bluetooth: hci0: command 0x041b tx timeout
[  555.019737][   T52] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  555.210541][T18665] tipc: Resetting bearer <eth:syzkaller0>
[  555.419792][T18658] tipc: Resetting bearer <eth:syzkaller0>
[  555.595578][T18658] tipc: Disabling bearer <eth:syzkaller0>
[  555.807118][ T9688] tipc: Node number set to 1617464109
[  556.370974][T18710] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3544'.
[  556.582174][T18718] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3546'.
[  556.695371][T18725] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3550'.
[  556.714004][T18727] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3551'.
[  556.714051][T18727] netlink: 312 bytes leftover after parsing attributes in process `syz.0.3551'.
[  556.714071][T18727] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3551'.
[  557.723060][T18753] __nla_validate_parse: 2 callbacks suppressed
[  557.723086][T18753] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3558'.
[  558.099138][T18756] batman_adv: batadv0: Adding interface: netdevsim0
[  558.099161][T18756] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  558.099192][T18756] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active
[  558.385589][T18763] vlan2: entered promiscuous mode
[  558.385615][T18763] bridge0: entered promiscuous mode
[  558.459529][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  558.530114][T18768] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3562'.
[  558.633111][T18769] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3562'.
[  558.633151][T18769] openvswitch: netlink: Missing key (keys=c0, expected=40280)
[  558.633506][T18771] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3562'.
[  558.633532][T18771] openvswitch: netlink: Missing key (keys=c0, expected=40280)
[  558.883793][T18795] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3566'.
[  558.888104][T18795] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3566'.
[  558.921814][T18795] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3566'.
[  558.946008][T18795] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3566'.
[  558.965237][T18795] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3566'.
[  558.980653][T18795] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3566'.
[  559.013700][T18758] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048)
[  559.156191][T18801] xt_SECMARK: invalid mode: 9
[  560.343636][T18834] xt_SECMARK: invalid mode: 9
[  561.127497][T18845] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  561.238426][T18848] netlink: Failed to add  helper -22
[  561.238491][T18848] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  561.471507][T18866] xt_SECMARK: invalid mode: 9
[  561.795949][T18880] netlink: 'syz.3.3595': attribute type 10 has an invalid length.
[  561.832267][T18880] bridge0: port 2(bridge_slave_1) entered disabled state
[  561.832509][T18880] bridge0: port 1(bridge_slave_0) entered disabled state
[  561.858386][T18880] netlink: 'syz.3.3595': attribute type 10 has an invalid length.
[  562.387706][T18896] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  562.722579][T18899] netlink: 'syz.2.3599': attribute type 21 has an invalid length.
[  562.740300][T18900] __nla_validate_parse: 28 callbacks suppressed
[  562.740324][T18900] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3599'.
[  562.800040][T18899] netlink: 'syz.2.3599': attribute type 4 has an invalid length.
[  562.800067][T18899] netlink: 'syz.2.3599': attribute type 5 has an invalid length.
[  562.800082][T18899] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3599'.
[  562.884545][T18899] x_tables: ip_tables: icmp match: only valid for protocol 1
[  562.943170][ T1311] ieee802154 phy1 wpan1: encryption failed: -22
[  563.122770][T18911] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  563.165375][T18916] netlink: 'syz.1.3601': attribute type 1 has an invalid length.
[  563.303052][T18916] netlink: 'syz.1.3601': attribute type 1 has an invalid length.
[  563.303394][T18916] netlink: 'syz.1.3601': attribute type 1 has an invalid length.
[  563.303610][T18916] netlink: 'syz.1.3601': attribute type 1 has an invalid length.
[  563.303841][T18916] netlink: 'syz.1.3601': attribute type 1 has an invalid length.
[  563.664865][T18929] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3606'.
[  564.124213][T18946] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  564.397879][T18956] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  564.601851][T18961] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3615'.
[  564.645708][T18961] xt_hashlimit: size too large, truncated to 1048576
[  564.645742][T18961] xt_hashlimit: max too large, truncated to 1048576
[  564.912381][T18975] syzkaller0: entered promiscuous mode
[  564.912409][T18975] syzkaller0: entered allmulticast mode
[  565.393304][T18982] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3622'.
[  565.773002][T18992] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3624'.
[  566.160898][T19003] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3628'.
[  566.194381][T19003] openvswitch: netlink: VXLAN extension message has 2 unknown bytes.
[  566.230047][T18998] bridge0: vlan filtering disabled, automatically disabling multicast vlan snooping
[  567.144616][T19030] validate_nla: 60 callbacks suppressed
[  567.144641][T19030] netlink: 'syz.0.3637': attribute type 1 has an invalid length.
[  567.237193][T19033] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3638'.
[  567.237502][T19040] netlink: 'syz.3.3641': attribute type 11 has an invalid length.
[  567.431094][T19032] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3638'.
[  567.483161][T19038] Cannot find add_set index 0 as target
[  567.668206][T19042] bond2 (unregistering): Released all slaves
[  568.059481][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  568.766156][T19085] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3650'.
[  568.779752][   T52] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  568.780047][   T52] Bluetooth: hci0: command 0x041b tx timeout
[  568.812741][T19090] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3650'.
[  569.083513][T19077] netlink: 172 bytes leftover after parsing attributes in process `syz.3.3647'.
[  569.086919][T19077] netlink: 'syz.3.3647': attribute type 11 has an invalid length.
[  570.465770][T19125] netlink: 'syz.1.3661': attribute type 1 has an invalid length.
[  570.465796][T19125] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3661'.
[  570.825005][T19140] netlink: 'syz.1.3665': attribute type 34 has an invalid length.
[  570.825030][T19140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3665'.
[  570.886114][T19140] bond6: option lacp_strict: invalid value (128)
[  570.899011][T19140] bond6 (unregistering): Released all slaves
[  571.961723][T19167] tipc: Started in network mode
[  571.961762][T19167] tipc: Node identity 0ea60dfe8401, cluster identity 4711
[  571.962036][T19167] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  572.057385][T19167] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) !
[  572.315563][T19166] wg2 speed is unknown, defaulting to 1000
[  572.458818][T19164] wg2 speed is unknown, defaulting to 1000
[  572.710133][T19180] netlink: 540 bytes leftover after parsing attributes in process `syz.3.3677'.
[  572.713189][T19180] Cannot find map_set index 0 as target
[  572.767303][T19182] geneve2: entered promiscuous mode
[  572.767331][T19182] geneve2: entered allmulticast mode
[  572.767647][T19171] wg2 speed is unknown, defaulting to 1000
[  572.946787][T19177] netlink: 4912 bytes leftover after parsing attributes in process `syz.1.3676'.
[  573.192279][T15065] tipc: Node number set to 2326203902
[  573.426105][T19188] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3675'.
[  573.438652][T19187] syz_tun: entered allmulticast mode
[  573.487675][T19199] netlink: 'syz.0.3681': attribute type 4 has an invalid length.
[  573.553478][T19205] netlink: 'syz.0.3681': attribute type 4 has an invalid length.
[  573.819547][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  574.583679][T19224] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3686'.
[  575.482727][T19250] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3694'.
[  575.482766][T19250] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3694'.
[  575.486850][T19250] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3694'.
[  575.486880][T19250] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3694'.
[  575.828873][T19260] bridge0: port 3(bond0) entered blocking state
[  575.829043][T19260] bridge0: port 3(bond0) entered disabled state
[  575.831079][T19260] bond0: entered allmulticast mode
[  575.831103][T19260] bond_slave_0: entered allmulticast mode
[  575.831124][T19260] 
@0Ù: entered allmulticast mode
[  575.831142][T19260] bridge0: entered allmulticast mode
[  575.962384][T19260] bond0: left allmulticast mode
[  575.962413][T19260] bond_slave_0: left allmulticast mode
[  575.962432][T19260] 
@0Ù: left allmulticast mode
[  575.962452][T19260] bridge0: left allmulticast mode
[  576.426503][T19276] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3703'.
[  576.926168][T19288] tipc: Enabling of bearer <udp:s> rejected, failed to enable media
[  576.927376][T19288] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3707'.
[  577.082101][T19298] bridge_slave_0: left allmulticast mode
[  577.082131][T19298] bridge_slave_0: left promiscuous mode
[  577.082402][T19298] bridge0: port 1(bridge_slave_0) entered disabled state
[  577.098159][T19298] bridge_slave_1: left allmulticast mode
[  577.098187][T19298] bridge_slave_1: left promiscuous mode
[  577.098519][T19298] bridge0: port 2(bridge_slave_1) entered disabled state
[  577.187436][T19298] bond0: (slave bond_slave_0): Releasing backup interface
[  577.219131][T19298] bond0: (slave bond_slave_1): Releasing backup interface
[  577.276230][T19298] team0: Port device team_slave_0 removed
[  577.298342][T19298] team0: Port device team_slave_1 removed
[  577.307281][T19298] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  577.307309][T19298] batman_adv: batadv0: Removing interface: batadv_slave_0
[  577.329019][T19298] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  577.329049][T19298] batman_adv: batadv0: Removing interface: batadv_slave_1
[  577.351004][T19298] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[  577.401832][T19300] team0: Mode changed to "broadcast"
[  578.398801][   T30] audit: type=1800 audit(1789812821.780:5): pid=19328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3720" name=3A202E31323334352E2E2E2E2028313829207238203D2030783363333130303030300A202020202020323A202E31323334352E2E382E20283835292063616C6C2070632B360A202020202020333A202E2E2E2E2E2E2E2E382E2028313829207230203D203078313130303030303066666666666666660A202020202020353A20 dev="tmpfs" ino=999 res=0 errno=0
[  578.454257][T19332] syzkaller0: entered promiscuous mode
[  578.454282][T19332] syzkaller0: entered allmulticast mode
[  579.430018][T19356] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3728'.
[  579.430056][T19356] netlink: 'syz.2.3728': attribute type 1 has an invalid length.
[  579.430071][T19356] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3728'.
[  579.531698][T19354] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3728'.
[  579.706026][T19353] syzkaller0: left promiscuous mode
[  579.706059][T19353] syzkaller0: left allmulticast mode
[  579.706793][T19353] tipc: Resetting bearer <eth:syzkaller0>
[  580.138548][T19370] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3734'.
[  580.241965][T19372] xt_hashlimit: overflow, try lower: 18446744073709551614/255
[  580.776698][T19400] netdevsim netdevsim1 netdevsim0: entered allmulticast mode
[  580.797465][T19400] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  581.327315][T19413] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3745'.
[  581.730144][T19423] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3748'.
[  581.892997][T19433] netlink: 'syz.1.3751': attribute type 10 has an invalid length.
[  581.893040][T19433] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3751'.
[  581.893115][T19433] dummy0: entered promiscuous mode
[  581.893453][T19433] bridge0: port 4(dummy0) entered blocking state
[  581.893564][T19433] bridge0: port 4(dummy0) entered disabled state
[  581.893750][T19433] dummy0: entered allmulticast mode
[  581.963673][T19433] bridge0: port 4(dummy0) entered blocking state
[  581.963828][T19433] bridge0: port 4(dummy0) entered forwarding state
[  582.361951][T19448] netlink: 112 bytes leftover after parsing attributes in process `syz.3.3756'.
[  582.584458][T19463] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3761'.
[  582.753506][T19467] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[  582.846642][T19463] 8021q: adding VLAN 0 to HW filter on device ipvlan3
[  583.397866][T19476] ip_tables: iptables: counters copy to user failed while replacing table
[  584.701001][ T5621] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  584.701051][ T4933] Bluetooth: hci0: command 0x041b tx timeout
[  584.702441][T19527] netlink: 'syz.3.3780': attribute type 11 has an invalid length.
[  584.952110][T19533] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3780'.
[  585.262848][T19545] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3784'.
[  585.637954][T19563] netlink: 'syz.2.3790': attribute type 1 has an invalid length.
[  585.734841][T19563] 8021q: adding VLAN 0 to HW filter on device bond1
[  585.887821][T19563] bond1: (slave veth5): Enslaving as an active interface with a down link
[  585.918665][T19565] 8021q: adding VLAN 0 to HW filter on device batadv1
[  585.932044][T19565] bond1: (slave batadv1): making interface the new active one
[  585.935373][T19565] batadv1: entered promiscuous mode
[  585.935891][T19565] bond1: (slave batadv1): Enslaving as an active interface with an up link
[  586.133229][T19563] bond1 (unregistering): (slave veth5): Releasing active interface
[  586.158220][T19563] bond1 (unregistering): (slave batadv1): Releasing active interface
[  586.158255][T19563] batadv1: left promiscuous mode
[  586.178251][T19563] bond1 (unregistering): Released all slaves
[  586.428616][T19583] xt_TPROXY: Can be used only with -p tcp or -p udp
[  586.774225][T19592] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6
[  588.491854][T19659] netlink: 88 bytes leftover after parsing attributes in process `syz.3.3812'.
[  588.491881][T19659] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3812'.
[  588.540121][    C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  588.718534][T19660] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  588.973553][T19666] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3816'.
[  589.261583][T19666] IPVS: Error connecting to the multicast addr
[  589.266024][T19681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3813'.
[  589.437172][T19690] nbd6: detected capacity change from 0 to 63
[  589.478361][ T5621] block nbd6: Receive control failed (result -104)
[  589.686554][T19701] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3823'.
[  589.686595][T19701] netlink: 'syz.2.3823': attribute type 1 has an invalid length.
[  589.754524][T19701] geneve2: entered promiscuous mode
[  590.205385][T19720] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3829'.
[  590.513660][T19724] can: request_module (can-proto-0) failed.
[  590.622912][T19736] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  590.773849][T19738] batman_adv: batadv0: Adding interface: syzkaller0
[  590.773871][T19738] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  590.773906][T19738] batman_adv: batadv0: Interface activated: syzkaller0
[  590.924041][T19737] batman_adv: batadv0: Interface deactivated: syzkaller0
[  591.060716][T19737] batman_adv: batadv0: Removing interface: syzkaller0
[  591.067167][T19753] netlink: 'syz.2.3836': attribute type 2 has an invalid length.
[  591.067198][T19753] netlink: 'syz.2.3836': attribute type 2 has an invalid length.
[  591.549072][T19786] netlink: 'syz.3.3845': attribute type 1 has an invalid length.
[  591.549083][T19779] netlink: 'syz.3.3845': attribute type 1 has an invalid length.
[  591.741859][ T5621] Bluetooth: hci0: Opcode 0x0c13 failed: -110
[  591.742144][ T5621] Bluetooth: hci0: command 0x041b tx timeout
[  591.947556][T19795] netlink: 'syz.4.3850': attribute type 4 has an invalid length.
[  592.352864][T19810] bond6: entered promiscuous mode
[  592.415125][T19823] netlink: 'syz.0.3857': attribute type 4 has an invalid length.
[  592.571782][T19821] syzkaller0: entered promiscuous mode
[  592.571836][T19821] syzkaller0: entered allmulticast mode
[  592.572507][T19821] tipc: Resetting bearer <eth:syzkaller0>
[  592.868603][T19837] netlink: 'syz.2.3863': attribute type 83 has an invalid length.
[  592.951222][T19845] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9
[  593.097046][T19851] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  593.263387][T19854] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3870'.
[  593.452435][T15069] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  593.617034][T19880] xt_l2tp: invalid flags combination: 0
[  593.686212][T19882] netlink: 'syz.0.3879': attribute type 21 has an invalid length.
[  593.686250][T19882] netlink: 'syz.0.3879': attribute type 20 has an invalid length.
[  593.712384][T19882] 
[  593.714780][T19882] ======================================================
[  593.721830][T19882] WARNING: possible circular locking dependency detected
[  593.728903][T19882] syzkaller #0 Not tainted
[  593.733367][T19882] ------------------------------------------------------
[  593.740420][T19882] syz.0.3879/19882 is trying to acquire lock:
[  593.746517][T19882] ffff88801c2f7a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_permission+0x7f/0x430
[  593.757125][T19882] 
[  593.757125][T19882] but task is already holding lock:
[  593.764523][T19882] ffffffff8ebe9930 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900
[  593.774874][T19882] 
[  593.774874][T19882] which lock already depends on the new lock.
[  593.774874][T19882] 
[  593.785419][T19882] 
[  593.785419][T19882] the existing dependency chain (in reverse order) is:
[  593.794506][T19882] 
[  593.794506][T19882] -> #7 (cpu_hotplug_lock){++++}-{0:0}:
[  593.802294][T19882]        cpus_read_lock+0x42/0x160
[  593.807464][T19882]        static_key_slow_inc+0x12/0x30
[  593.812975][T19882]        nbd_genl_reconnect_sock_cb+0x69a/0xbb0
[  593.819354][T19882]        nbd_genl_foreach_sock+0x265/0x450
[  593.825209][T19882]        nbd_genl_reconfigure+0xbbb/0x1040
[  593.831060][T19882]        genl_family_rcv_msg_doit+0x233/0x340
[  593.837279][T19882]        genl_rcv_msg+0x614/0x7a0
[  593.842359][T19882]        netlink_rcv_skb+0x226/0x4a0
[  593.847715][T19882]        genl_rcv+0x28/0x40
[  593.852265][T19882]        netlink_unicast+0x7bd/0x940
[  593.857621][T19882]        netlink_sendmsg+0x813/0xb40
[  593.863046][T19882]        sock_sendmsg_nosec+0x13a/0x180
[  593.868640][T19882]        ____sys_sendmsg+0x54e/0x850
[  593.873983][T19882]        ___sys_sendmsg+0x2a5/0x360
[  593.879233][T19882]        __x64_sys_sendmsg+0x1b1/0x290
[  593.884742][T19882]        do_syscall_64+0x166/0x520
[  593.889925][T19882]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  593.896389][T19882] 
[  593.896389][T19882] -> #6 (&nsock->tx_lock){+.+.}-{4:4}:
[  593.904090][T19882]        __mutex_lock+0x19d/0x1550
[  593.909292][T19882]        nbd_queue_rq+0x373/0xff0
[  593.914367][T19882]        blk_mq_dispatch_rq_list+0x499/0x1990
[  593.920484][T19882]        __blk_mq_sched_dispatch_requests+0xd36/0x1580
[  593.927391][T19882]        blk_mq_sched_dispatch_requests+0xd7/0x190
[  593.933956][T19882]        blk_mq_run_work_fn+0x16c/0x300
[  593.939564][T19882]        process_scheduled_works+0xc3d/0x1630
[  593.945690][T19882]        worker_thread+0xa47/0xfb0
[  593.950882][T19882]        kthread+0x38b/0x480
[  593.955515][T19882]        ret_from_fork+0x514/0xb70
[  593.960669][T19882]        ret_from_fork_asm+0x1a/0x30
[  593.966011][T19882] 
[  593.966011][T19882] -> #5 (&cmd->lock){+.+.}-{4:4}:
[  593.973289][T19882]        __mutex_lock+0x19d/0x1550
[  593.978540][T19882]        nbd_queue_rq+0xc1/0xff0
[  593.983526][T19882]        blk_mq_dispatch_rq_list+0x499/0x1990
[  593.989642][T19882]        __blk_mq_sched_dispatch_requests+0xd36/0x1580
[  593.996548][T19882]        blk_mq_sched_dispatch_requests+0xd7/0x190
[  594.003118][T19882]        blk_mq_run_work_fn+0x16c/0x300
[  594.008734][T19882]        process_scheduled_works+0xc3d/0x1630
[  594.014859][T19882]        worker_thread+0xa47/0xfb0
[  594.020033][T19882]        kthread+0x38b/0x480
[  594.024661][T19882]        ret_from_fork+0x514/0xb70
[  594.029818][T19882]        ret_from_fork_asm+0x1a/0x30
[  594.035178][T19882] 
[  594.035178][T19882] -> #4 (set->srcu){.+.+}-{0:0}:
[  594.042357][T19882]        __synchronize_srcu+0xc9/0x2f0
[  594.047878][T19882]        elevator_switch+0x1e8/0x7b0
[  594.053483][T19882]        elevator_change+0x2fa/0x480
[  594.058814][T19882]        elevator_set_default+0x375/0x440
[  594.065144][T19882]        blk_register_queue+0x3f3/0x4e0
[  594.070744][T19882]        __add_disk+0x6b8/0xdb0
[  594.075646][T19882]        add_disk_fwnode+0x100/0x3a0
[  594.081019][T19882]        nbd_dev_add+0x733/0xb60
[  594.086002][T19882]        nbd_init+0x168/0x1f0
[  594.090718][T19882]        do_one_initcall+0x250/0x870
[  594.096061][T19882]        do_initcall_level+0x10a/0x1a0
[  594.101659][T19882]        do_initcalls+0x59/0xa0
[  594.106563][T19882]        kernel_init_freeable+0x29d/0x3e0
[  594.112336][T19882]        kernel_init+0x22/0x1d0
[  594.117251][T19882]        ret_from_fork+0x514/0xb70
[  594.122400][T19882]        ret_from_fork_asm+0x1a/0x30
[  594.127740][T19882] 
[  594.127740][T19882] -> #3 (&q->elevator_lock){+.+.}-{4:4}:
[  594.135656][T19882]        __mutex_lock+0x19d/0x1550
[  594.140825][T19882]        elevator_change+0x1af/0x480
[  594.146151][T19882]        elevator_set_none+0xb5/0x140
[  594.151566][T19882]        blk_mq_update_nr_hw_queues+0x5ef/0x19f0
[  594.157951][T19882]        nbd_start_device+0x189/0xb30
[  594.163365][T19882]        nbd_genl_connect+0x167d/0x1cd0
[  594.169045][T19882]        genl_family_rcv_msg_doit+0x233/0x340
[  594.175164][T19882]        genl_rcv_msg+0x614/0x7a0
[  594.180242][T19882]        netlink_rcv_skb+0x226/0x4a0
[  594.185573][T19882]        genl_rcv+0x28/0x40
[  594.190122][T19882]        netlink_unicast+0x7bd/0x940
[  594.195448][T19882]        netlink_sendmsg+0x813/0xb40
[  594.200794][T19882]        sock_sendmsg_nosec+0x13a/0x180
[  594.206394][T19882]        ____sys_sendmsg+0x54e/0x850
[  594.211729][T19882]        ___sys_sendmsg+0x2a5/0x360
[  594.216991][T19882]        __x64_sys_sendmsg+0x1b1/0x290
[  594.222495][T19882]        do_syscall_64+0x166/0x520
[  594.227656][T19882]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  594.234112][T19882] 
[  594.234112][T19882] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}:
[  594.242776][T19882]        blk_alloc_queue+0x544/0x690
[  594.248098][T19882]        __blk_mq_alloc_disk+0x194/0x390
[  594.253769][T19882]        nbd_dev_add+0x494/0xb60
[  594.258761][T19882]        nbd_init+0x168/0x1f0
[  594.263465][T19882]        do_one_initcall+0x250/0x870
[  594.268783][T19882]        do_initcall_level+0x10a/0x1a0
[  594.274274][T19882]        do_initcalls+0x59/0xa0
[  594.279162][T19882]        kernel_init_freeable+0x29d/0x3e0
[  594.284908][T19882]        kernel_init+0x22/0x1d0
[  594.289785][T19882]        ret_from_fork+0x514/0xb70
[  594.294917][T19882]        ret_from_fork_asm+0x1a/0x30
[  594.300242][T19882] 
[  594.300242][T19882] -> #1 (fs_reclaim){+.+.}-{0:0}:
[  594.307491][T19882]        fs_reclaim_acquire+0x71/0x100
[  594.312981][T19882]        kmem_cache_alloc_noprof+0x5f/0x600
[  594.318903][T19882]        __kernfs_iattrs+0xdd/0x380
[  594.324130][T19882]        kernfs_iop_setattr+0xe6/0x3f0
[  594.329703][T19882]        notify_change+0xbba/0xea0
[  594.335235][T19882]        do_truncate+0x1c2/0x250
[  594.340220][T19882]        path_openat+0x15b5/0x1d60
[  594.345409][T19882]        do_file_open+0x23e/0x4a0
[  594.350456][T19882]        do_sys_openat2+0x115/0x200
[  594.355676][T19882]        __x64_sys_openat+0x138/0x170
[  594.361071][T19882]        do_syscall_64+0x166/0x520
[  594.366206][T19882]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  594.372650][T19882] 
[  594.372650][T19882] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}:
[  594.381215][T19882]        __lock_acquire+0x164c/0x2de0
[  594.386655][T19882]        lock_acquire+0x115/0x350
[  594.391712][T19882]        down_read+0x4a/0x330
[  594.396437][T19882]        kernfs_iop_permission+0x7f/0x430
[  594.402190][T19882]        inode_permission+0x3de/0x5f0
[  594.407585][T19882]        cgroup_attach_permissions+0x28e/0x9f0
[  594.413755][T19882]        __cgroup_procs_write+0x24b/0x320
[  594.419509][T19882]        cgroup_threads_write+0x24/0x50
[  594.425117][T19882]        cgroup_file_write+0x331/0x8f0
[  594.430611][T19882]        kernfs_fop_write_iter+0x3a4/0x540
[  594.436446][T19882]        vfs_write+0x612/0xba0
[  594.441237][T19882]        ksys_write+0x150/0x270
[  594.446112][T19882]        do_syscall_64+0x166/0x520
[  594.451247][T19882]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  594.457679][T19882] 
[  594.457679][T19882] other info that might help us debug this:
[  594.457679][T19882] 
[  594.467927][T19882] Chain exists of:
[  594.467927][T19882]   &root->kernfs_iattr_rwsem --> &nsock->tx_lock --> cpu_hotplug_lock
[  594.467927][T19882] 
[  594.481956][T19882]  Possible unsafe locking scenario:
[  594.481956][T19882] 
[  594.489431][T19882]        CPU0                    CPU1
[  594.494808][T19882]        ----                    ----
[  594.500186][T19882]   rlock(cpu_hotplug_lock);
[  594.504802][T19882]                                lock(&nsock->tx_lock);
[  594.511762][T19882]                                lock(cpu_hotplug_lock);
[  594.518805][T19882]   rlock(&root->kernfs_iattr_rwsem);
[  594.524193][T19882] 
[  594.524193][T19882]  *** DEADLOCK ***
[  594.524193][T19882] 
[  594.532353][T19882] locks held by syz.0.3879/19882: 4, last CPU#0:
[  594.538698][T19882]  #0: ffff888024cf2460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
[  594.547628][T19882]  #1: ffff88807b43c080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
[  594.557409][T19882]  #2: ffffffff8ed9c7e0 (cgroup_mutex){+.+.}-{4:4}, at: cgroup_kn_lock_live+0x13c/0x230
[  594.567210][T19882]  #3: ffffffff8ebe9930 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900
[  594.577796][T19882] 
[  594.577796][T19882] stack backtrace:
[  594.583722][T19882] CPU: 0 UID: 0 PID: 19882 Comm: syz.0.3879 Not tainted syzkaller #0 PREEMPT(full) 
[  594.593118][T19882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  594.603507][T19882] Call Trace:
[  594.606819][T19882]  <TASK>
[  594.609769][T19882]  dump_stack_lvl+0xe8/0x150
[  594.614396][T19882]  print_circular_bug+0x2e2/0x300
[  594.619457][T19882]  check_noncircular+0x12f/0x150
[  594.624522][T19882]  __lock_acquire+0x164c/0x2de0
[  594.629399][T19882]  ? __lock_acquire+0x747/0x2de0
[  594.634394][T19882]  lock_acquire+0x115/0x350
[  594.638918][T19882]  ? kernfs_iop_permission+0x7f/0x430
[  594.644325][T19882]  ? __pfx_kernfs_iop_permission+0x10/0x10
[  594.650169][T19882]  ? __pfx_kernfs_iop_permission+0x10/0x10
[  594.656003][T19882]  down_read+0x4a/0x330
[  594.660185][T19882]  ? kernfs_iop_permission+0x7f/0x430
[  594.665591][T19882]  ? __pfx_kernfs_iop_permission+0x10/0x10
[  594.671441][T19882]  kernfs_iop_permission+0x7f/0x430
[  594.676673][T19882]  ? __pfx_kernfs_iop_permission+0x10/0x10
[  594.682509][T19882]  inode_permission+0x3de/0x5f0
[  594.687396][T19882]  cgroup_attach_permissions+0x28e/0x9f0
[  594.693075][T19882]  __cgroup_procs_write+0x24b/0x320
[  594.698391][T19882]  cgroup_threads_write+0x24/0x50
[  594.703445][T19882]  ? __pfx_cgroup_threads_write+0x10/0x10
[  594.709216][T19882]  cgroup_file_write+0x331/0x8f0
[  594.714203][T19882]  ? __pfx_cgroup_file_write+0x10/0x10
[  594.719693][T19882]  ? __kmalloc_noprof+0x38c/0x720
[  594.724738][T19882]  ? __pfx_cgroup_file_write+0x10/0x10
[  594.730221][T19882]  kernfs_fop_write_iter+0x3a4/0x540
[  594.735555][T19882]  vfs_write+0x612/0xba0
[  594.739927][T19882]  ? __pfx_vfs_write+0x10/0x10
[  594.744728][T19882]  ? __pfx_do_futex+0x10/0x10
[  594.749434][T19882]  ? kmem_cache_free+0x182/0x650
[  594.755012][T19882]  ksys_write+0x150/0x270
[  594.759381][T19882]  ? __pfx_ksys_write+0x10/0x10
[  594.764275][T19882]  do_syscall_64+0x166/0x520
[  594.768882][T19882]  ? trace_irq_disable+0x3b/0x140
[  594.773919][T19882]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  594.780012][T19882]  ? clear_bhb_loop+0x70/0xc0
[  594.784719][T19882]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  594.790631][T19882] RIP: 0033:0x7fa547f9e159
[  594.795070][T19882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  594.814698][T19882] RSP: 002b:00007fa548d9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  594.823141][T19882] RAX: ffffffffffffffda RBX: 00007fa548225fa0 RCX: 00007fa547f9e159
[  594.831131][T19882] RDX: 0000000000000012 RSI: 0000200000000c40 RDI: 0000000000000009
[  594.839296][T19882] RBP: 00007fa54803506b R08: 0000000000000000 R09: 0000000000000000
[  594.847294][T19882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  594.855293][T19882] R13: 00007fa548226038 R14: 00007fa548225fa0 R15: 00007ffe36beab98
[  594.863319][T19882]  </TASK>
[  594.876694][T15069] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  596.221563][ T1718] block nbd6: Connection timed out, retrying (0/1 alive)
[  596.221606][ T1718] block nbd6: Connection timed out, retrying (0/1 alive)
[  596.221650][ T1718] block nbd6: Dead connection, failed to find a fallback
[  596.221661][ T1718] block nbd6: shutting down sockets
[  596.221672][ T1718] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 2 prio class 2
[  596.221695][ T1718] Buffer I/O error on dev nbd6, logical block 2, async page read
[  596.221719][ T1718] Buffer I/O error on dev nbd6, logical block 3, async page read
[  596.221736][ T1718] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 2 prio class 2
[  596.221754][ T1718] Buffer I/O error on dev nbd6, logical block 0, async page read
[  596.221765][ T1718] Buffer I/O error on dev nbd6, logical block 1, async page read
[  596.221927][ T1690] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.221947][ T1690] Buffer I/O error on dev nbd6, logical block 0, async page read
[  596.222011][ T1690] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.222032][ T1690] Buffer I/O error on dev nbd6, logical block 1, async page read
[  596.222083][ T1690] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.222101][ T1690] Buffer I/O error on dev nbd6, logical block 2, async page read
[  596.222151][ T1690] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.222169][ T1690] Buffer I/O error on dev nbd6, logical block 3, async page read
[  596.222299][ T1690] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.222317][ T1690] Buffer I/O error on dev nbd6, logical block 0, async page read
[  596.222368][ T1690] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.222386][ T1690] Buffer I/O error on dev nbd6, logical block 1, async page read
[  596.222435][ T1690] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.222502][ T1690] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2
[  596.223780][T17939] ldm_validate_partition_table(): Disk read failed.
[  596.224593][T17939] Dev nbd6: unable to read RDB block 0
[  596.225505][T17939]  nbd6: unable to read partition table
[  596.235353][T17939] ldm_validate_partition_table(): Disk read failed.
[  596.237548][T17939] Dev nbd6: unable to read RDB block 0
[  596.241441][T17939]  nbd6: unable to read partition table
[  600.859488][ T5621] Bluetooth: hci5: command 0x0405 tx timeout
[  603.259477][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!