last executing test programs: 1m19.764624933s ago: executing program 0 (id=1982): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r0, 0x0, 0x3}, 0x18) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x6, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0xfe0, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC]}, 0xfe0}, 0x1, 0x0, 0x0, 0x20008091}, 0x801) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="b4ca0e8df84bd493700fab1f24375620a8c92bec181185960d3c6225e6b0054620ac25407249d0b3f06d30ead932e232adda5a1c9227bd4fdbd861a6d0a95b77283ebc8b1aa9892051c4e50e5ea8ce29e10272b259cbb49cdab37977336f71077193dbfb41626a1dced64ef559dbc915e6e320c381b74591574a4e774ac35c8f5c6672558913b3903b73d72ec1561b4ad2cdeaeba14ea123ee753ff7e717d06102b3d7db50716e889a14383ffe2f556efed71b72047ffd9d633c0d6a6860", 0xbe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/syz0\x00', 0x1ff) 1m0.290357224s ago: executing program 0 (id=1982): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r0, 0x0, 0x3}, 0x18) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x6, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0xfe0, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC]}, 0xfe0}, 0x1, 0x0, 0x0, 0x20008091}, 0x801) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="b4ca0e8df84bd493700fab1f24375620a8c92bec181185960d3c6225e6b0054620ac25407249d0b3f06d30ead932e232adda5a1c9227bd4fdbd861a6d0a95b77283ebc8b1aa9892051c4e50e5ea8ce29e10272b259cbb49cdab37977336f71077193dbfb41626a1dced64ef559dbc915e6e320c381b74591574a4e774ac35c8f5c6672558913b3903b73d72ec1561b4ad2cdeaeba14ea123ee753ff7e717d06102b3d7db50716e889a14383ffe2f556efed71b72047ffd9d633c0d6a6860", 0xbe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/syz0\x00', 0x1ff) 47.139201547s ago: executing program 0 (id=1982): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r0, 0x0, 0x3}, 0x18) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x6, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0xfe0, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC]}, 0xfe0}, 0x1, 0x0, 0x0, 0x20008091}, 0x801) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="b4ca0e8df84bd493700fab1f24375620a8c92bec181185960d3c6225e6b0054620ac25407249d0b3f06d30ead932e232adda5a1c9227bd4fdbd861a6d0a95b77283ebc8b1aa9892051c4e50e5ea8ce29e10272b259cbb49cdab37977336f71077193dbfb41626a1dced64ef559dbc915e6e320c381b74591574a4e774ac35c8f5c6672558913b3903b73d72ec1561b4ad2cdeaeba14ea123ee753ff7e717d06102b3d7db50716e889a14383ffe2f556efed71b72047ffd9d633c0d6a6860", 0xbe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/syz0\x00', 0x1ff) 33.847581305s ago: executing program 0 (id=1982): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r0, 0x0, 0x3}, 0x18) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x6, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0xfe0, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC]}, 0xfe0}, 0x1, 0x0, 0x0, 0x20008091}, 0x801) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="b4ca0e8df84bd493700fab1f24375620a8c92bec181185960d3c6225e6b0054620ac25407249d0b3f06d30ead932e232adda5a1c9227bd4fdbd861a6d0a95b77283ebc8b1aa9892051c4e50e5ea8ce29e10272b259cbb49cdab37977336f71077193dbfb41626a1dced64ef559dbc915e6e320c381b74591574a4e774ac35c8f5c6672558913b3903b73d72ec1561b4ad2cdeaeba14ea123ee753ff7e717d06102b3d7db50716e889a14383ffe2f556efed71b72047ffd9d633c0d6a6860", 0xbe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/syz0\x00', 0x1ff) 18.863268724s ago: executing program 0 (id=1982): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r0, 0x0, 0x3}, 0x18) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x6, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0xfe0, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC]}, 0xfe0}, 0x1, 0x0, 0x0, 0x20008091}, 0x801) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="b4ca0e8df84bd493700fab1f24375620a8c92bec181185960d3c6225e6b0054620ac25407249d0b3f06d30ead932e232adda5a1c9227bd4fdbd861a6d0a95b77283ebc8b1aa9892051c4e50e5ea8ce29e10272b259cbb49cdab37977336f71077193dbfb41626a1dced64ef559dbc915e6e320c381b74591574a4e774ac35c8f5c6672558913b3903b73d72ec1561b4ad2cdeaeba14ea123ee753ff7e717d06102b3d7db50716e889a14383ffe2f556efed71b72047ffd9d633c0d6a6860", 0xbe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/syz0\x00', 0x1ff) 4.918354272s ago: executing program 3 (id=3270): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000001080)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x20000090) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r4], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 4.698124993s ago: executing program 1 (id=3273): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000095980000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f0ffffffb702000005000000b7030000000000008500000073000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x2c, 0x10, 0x801, 0xfffffffd, 0x0, {}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x2}, @IFLA_AF_SPEC={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.numa_stat\x00', 0x26e1, 0x0) close(r4) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x5f, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000014000780080008400000000008001240ffffffe80500010006000000050005000200000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x5c}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={r0, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000240)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x7, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3c, &(0x7f0000000400)=[{}], 0x8, 0x10, &(0x7f0000000440), &(0x7f0000000540), 0x8, 0x7b, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x9cf8, 0x0, r4, 0x3, '\x00', r6, r3, 0xfffffffe, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000b8a6000000050006000100000005000200"], 0x3c}}, 0x0) 4.316469827s ago: executing program 3 (id=3274): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@nat={'nat\x00', 0x19, 0x2, 0x90, [0x200000000080, 0x0, 0x0, 0x2000000000b0, 0x200000000314], 0x1979b5, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00000010000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000200000001003629f5cd0000"]}, 0x108) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x64}}, 0x0) 4.289184891s ago: executing program 4 (id=3275): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x1d8, 0x12, 0x60d, 0x0, 0x202, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2c0, 0x4, 0x0, {[{{@ipv6={@local, @remote, [], [], 'veth0_to_team\x00', 'macsec0\x00'}, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "000000165a8c2e0617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f672225d6147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac05a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x2, 0x2}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x1d8, 0x12, 0x60d, 0x0, 0x202, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2c0, 0x4, 0x0, {[{{@ipv6={@local, @remote, [], [], 'veth0_to_team\x00', 'macsec0\x00'}, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "000000165a8c2e0617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f672225d6147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac05a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x2, 0x2}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) 4.125110776s ago: executing program 4 (id=3276): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000b0a500007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r2, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.007311353s ago: executing program 4 (id=3277): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) bind$ax25(r2, &(0x7f0000000380)={{0x3, @null, 0x1}, [@null={0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x2}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007b243ce4b3daa7804f"], 0x48) sendmsg$inet(r2, &(0x7f0000000c40)={&(0x7f0000000280)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000000940)=[{&(0x7f00000005c0)="be3b772db7002767cded73129a7520a2d9384914f089685e5f208571b2f6532fd1a9cfedc53485e932a15d5b7440c8611a3bb33e7428c9e5fb6c88001c5db2a36aaa61ae32496182087ce17721b3b694476a4d848e25a04bb39ec8e7949cce1825cec65df8e5a2c25182cfbd087c5c59a87622164f92a2a6630473dc632d7db0fd124cb65e34d07cd715604a9f588f48f223ec7dfc16a6650d460c63fef4ddfcd21a10e7bfbfe9bf11dbbe3c0ff90eaa39232855d9684cfba24cc757e8f04247d67644575e7fc2b8453723e8f8c1fd", 0xcf}, {&(0x7f0000000d00)="2ebbab8a0d63689f0be755566e3b76a0be817e162c9471f02e7a06d1ac48616941a32a348ff3f818a7c5090b24acb95a74e8dfc5468a43d3a343c1d4f186c8a52eb28c213008bdbaeb93dba194caec00071068966e92b2d16f7bd1c55999771613f44e160b8dc6ab281114a002398eb48367c8c25e71127a10d85e2f66955771e939bf6549bd58f13de1597d20dcd1f4264ff86633acad5fe0fa8c9d3d457d91a42da081bbc8b1f6fa2961ed8e34b315d59465f281b9f6a28a853d768297f66d72cb23b35c82258cf511ec809eaaf6657d606e97b5042c0a161da708c20adbb7cc50c73f0395730b820d406abac2c4441b086d5e03a659a89757330bdc0b832adfc8c333f5a2f8e9aaf4337083491f35174efb58f0c6501a56663f90a638757bc6ba76efbd6d6904ed1d611f589526e1094dc57ebf66ac2237bfff0c7fa933388aa115c2a370854d3536f68e1fe42ed2d60f8016b42049ac612cd8fa058edf1beeb2310ad5ea429c8c02b2b1dc261df9dbe7d3c8e5ace6d1b1b35065085159a917f144cdb07bc98f3a11e6adff24d0ce9ea139e6cd16abcb04d7577a20fa151a0917d960c492cc32d192f0e0cc0eee4d7f6a61266bed6a0e516e692a4ea970675449bc2ed87d257ea2a7e3f01aec42571ca414853565fe070317c5a315e51543ea0c860fe268a3f5f1aaba7620e8d9a114c5356901541842c88b8a9cc36338e75a6a9a0f0467aacd84fa84b0bcd91ecfe03efd93afccb85833494dc2b8756c0bb21364a1befe0c5c7e545a1c8d7952856386795fafcf492740fd1770c991b94f37e3b5117962b2747920af425456207790e921d77ae9a8a9362df8f4fa94b15c8e82998d791dbf5494b78347357b2f9e9c6dc85d9f47db701792d35ff93e8f5e9d051c62bcddc58d97babf7411c2abce91f7b68b57f34f6cd3fce6d733c8cafe812bc26aef8ad1975ee079eb450cfb1c2b71ae47f376643caea3584a7943250241ce806db432989220660f6c63dc5df3cf1c0b1b9feaf7365701d64a86725e2c91dc095e428d563ce95d94e67fe6d93b93e372b9bb8fc883f07e47f8bb9e797ecfb546f032b34b136c2a7818d177790d7bbf5d1bc8fb093552c2710648b247909a04f15a16d559ae691fc9eb6cafdbea6c21aa1aa6ea08237a265d1d2769301ed52ac57df522dbcb358067d2328ed6d457a441b9b8d20a49cbad2b8c4ed781ff40541c167a73d2529d699d7b3d1ac9c8ab89db8a54c93715bbd347297faaf7f559135c86cb094bc98e78b12bf51f1f99ab6284dbc96800fc4c97c73f1d44fb3670a7b95afcdd4185a2ca8a05bc629aa00e0141778a393732c337da7f7a2428e9ce5c7c83323512f03f61543470963c01e9149765199a034a4670cb17bebd8575e413e9bc97687a32473eaed66f5740fdcdcac3d674ed585b1340d8b5e19401e3526c44364c88c29a16e15f1306aaebf8e831dbb2de9cc19c82d554c6c241dece5638ee3598ee7aacdc35b28cf38b0a6334af8926bf15dc5dc52fc2ded182f3c5f6f2308d8349dffacd359c7d06000b45e30b94c7d10d65a357bf1d2b366b75313ff1b44620629f8e434f5de8656ca6613d3ee8cce332cb059ceb2c56f0aa267bdb0f2b99886126b66a16f0d5a2d22f5b7bd3730b5514308cc7a5e87abdae6f577c6174fd3d7bdd791cfcd91b953dbc8c1f917e3443a48677b29abe85996dbf2923a88fbb944a8ecbe9467e0ffaa9c3c45697ba1bcb0ea5298212c04d72fff4d90605775343de289a0405e5dcda698b176c9b9f41afe6d44d2e2e15e29e3956c2299035b2614684b73b8d2b1dc1dcb12d5400b337acb0c5713d6e2bd8572cad2dc6699f90e4772ee2039142b7a31f34aeea62538e209025d1adb38038fe52b79b3f3e0dccb41651c6bb5a1542c5abbd86a868acec1d4ccdcf78152d581c7f7edafb2afbc67a1c21d1cecfd8eea2b078f0f09c0d7d412a98f251b556a69badfc41662f98fea13de1342465d69806cc94929d862ad2839184a0dcc734173ed3f105854150682e30e0660c2f781b089383c6fcbe1a2cd047c4a826488927f2163dfde03ca7f9a715f724e05016fc9f62356ab3fe32e384cc60499f3170feb9f29f1cd7b31d852516d733a2333eb56d9299a03c8ae140bc43da7531cc440221d6a0fbbe25f59b1ff16b7717b933d24439da64c46a08c0ec997848ee150ca642e9c5808ad184e66cbfa004d291a39b6f932d96415dcfb82be8c17452cea80074299419c2d41feaf69ac26c0f5b89ef903f4f8566021582ba0c726506930ff6d7c78e10f2ec9ff874dfe6e3b0d82934030778670cd6ddda633cb9a3a722969a30817ecf28dfd1a66cbbd6742703414a31a51031f1ef5658147e9aa664e744a81bf9918a85cd14ad1c638b52d579453a174919d5101a08217694d437252a5aae867ec4c3b7b1053b8f70d608f88430ee9399787b3bc8088b2c721a930f0ca707a6c5de117adf97ba45aa82cb5f8f0612d0e84d1bef4abf739955a39fd98badfc64dce91501b0881ebc99bdf7720ae7da40de62bf8d3d5a3940a5681e12d63ecd3f0462fd0c53259d0a7a65628f6d24074f06ae1c1744ed4ff412e9221793df159b646d349cb9b113975383c67a38aa836a004001b46116cfd1cbe7f09a253e2828e60178169bb576c83fc4adf332b1d1d288f4e211a6234ca939512352dcb08060b0343fd1ab67c251911ebc34eada39ba653069327c6df236918d8428a83c409ce941506ffebc0a6f66445501792a0a53d87f3af331ba31fae933046702d162b9962414000ce0833e9765a207fe18fd5fff6eb55fc52e4765276227be4f2acb9c90dbdeaad4c7a9c80da73ff9e6a5add33a587c98a5b11b4bc94b5f9393a644e6c2eed35c40b3eda37abcb0ce52a6b690e8a2e6d41cdc58668142e43ffb32daf07ddb42fc3537024e37ca496e28d2de30756e16fb3e37aa6a6bc40493ff6bdef9ef2286cf34c91266cc468c5656494ca73404a9bf7dfa6d5671c9b492be3acc590afcff26aafc35c03c43ffa9cef78261024ac5e31f5ba10f4187b2c3ffd8f4bb98087fb4968c900c493e24b4f57720148e47769da16492aa1306718addea4f624f7ef23e5166638cf8fe9de0b297cc7fec6ea85284817617e1cc4be9107001d1e1e97226922a2e11e0cde4dc9036d46932fe30ebdde643bff83a0dc59d98497fddcf9794316b9b033c9c8a2bff9a5b71acc1ccce002cdb2862b40c273e8ec0a665c5de49ac53cd7ed61b21d8d8cebe8dff97feed6562298278b1e2da28012d3454ab5a97d9576cc83c893b6870eac57369f9170b04c0637569cbd955162f78a40e87e9f593f97c55ed36249499123cc7470a12d08ea76368096b1f170452ae299149065a479cb60614693cbf7a997baabbca893d81e33cdb285b55d5e89b3786c4ff571909bc661b74a4171fe80628fa69b520c3a1e681a2f56c55b8930b128481c2e4304eb4fbe62dd980a93560554fa35033535420372f74e999c21edabfb38064854408fb4ab5db8ebf7d9be1438ac6c4fb184adfd46863031fc08d1197849e71d0dc529f38d5ddb56ff79fd753aeaf4601140123a12d90c1c432683f3744b3fd30cb8a0b9b416cb8b5855148e199269fb81003de4db7b2db8324aa3b8755b214980bcee8a0c1e71bb9e0f326602ca30a0b1fc521bd932a64488a933c86554e47a3ebd2ae88711da9c5c0fbc303b3fd8a1f8fa6ae4446a14cc9b83bddf8feb51b6652847c4bdd24b93972bebae296cc771e2237a0023749f8a937f1548af985fec6be74833274a671ca7da7c7cbadf5dafb9651b326d2df7937168bc600171def85558db34c4de882c3ab01e0b346892b81622bbb0b6dafe26c3fe402ba5f4ca277dd508ae17472739368baa13bc2fe4648a4a0a90b8c3d8d52be568f9cdb93457891a5daeb1ea687b81537ad2525cc150f7141e44a4bdc4f404ce2ee3aa22da185537a65b09a2b2ea176c935bf23b35c4fb54d01227c0eb7a1c6f5531ac38399c64b3a32ef2d8496b7145b7ea5ba54e2ff75f112a799fcf4e056793ca53dfb3b9e3d8a6124f930b58f4725efae33171b16a417aed7eb2529d0044ebc6a6878dbd4cce2742d1b62c225a286f96bf896b409ccb4aefec48f06946273ebef3742260ef779a3683ec184611a21b7c8f3f29c09cb7fd7f89b407fc7e0ad206bda34dfcf8e8fcd091408030ed028c78d48222fc014fdf01b56b80899c7fdb00944908f86c9fee1c21fd6eba1e7d85fac762ad5dff8c18d6609cfc8497c03f228ffc25560516006c4803054ad3ac57f8a0691b3091a77267de18afc3f4c204a32a7e8b0465d263cca77255cf876ad373eddf360f5d974b2952483c5f1c05089e83f8838a157b197b7fd0bcd353da738dde1887eb2112b0e9b5231a4574425f203432b24bf51152ae8854e6beb802eccea5484fd4fa0602c8eb5baf4e7f8875c34623047e6a0afb3ef43a4dbae224c3056900831ebd8aa2f2bdff6e5e7cfdd0e4f1d0c2ebfd8b4556fe6df48e68788d31893414e46d418363793a3090ff456a80d163b9688dc7a074815450640c3a3b0d36865546e763cd414aa60d2bc49ae21c643638982449048ce3f10f27a5882e046d5bcaeb1bd6900190b188023933b62593274f194547cf3020c7b9945f143cf9f1edabdebb10587d9a4fa676b3801c697a7f6160896cdc47366634ea7412dd390bbd36a12711931a97a5a929cdd7867978a806a3e456455260898162dab628c4be686d0dc4101bc23f48b5e8b8bcc44147127010f57ec162d42daeaba8ff24a18cf593b9600366075c4d48eb7cd6e686f18f50950c90610c6bae35c6bb02d467fe7bf80fd33a1d230fefb46a1a47567f3d92ace7d260b9a5cb076aefa424e82c8a3000ca4b0eb5cee6bdbc09f60c42d1114cedf8bd1353d306748335134e305db2431513a9f8a51f36e3e150a8e7f0e194b433a2050ea6af0766d867542431a1a5df76c5537f28f0d5e46a554ed43711789fccaa62a61d23fdb90799a454b03554ccf7ebc132b748f438c437af311afaad4fda94c7b7f0e9be1a8083894008f0eb9d7b62a0587e81b2c6efd15a5f13718204a59331053db518066fc79743d24ddc1606063ffd3ca5ff5d0e193319e8a8c0d3be6213d48c63d54493898510a574aa625301b877e69f8b73e1937dad924f20180a098bc3d01d89b21cd046405ad466278ebe3c57c9b354a7fd41dbc391586082060d8aecb58cf3bcb308349dd53487c57dce0a835a7ed8e55cdf21f3552c6f4c7c05dbadbd3e13dd7c640ce2cae8195111e80ecfdc4f2ea5b2f2bd99017680b6c18f1ea537a959749ed3757bed59f217c2f13cb7f1649e75c555653509238278bb6450a8c6276eda72d2cddc15c0558d7429fbf619865e2e59f6df1ed581a91e2575a371b748ad449cc061ea3e41710286c1f895093b9fcb46451e7b5c6d2714259fbbb4e55282c1ee9559785380cd4cffb169d116ce76900898fb4d7965752b2f4b4e0f2d5d7da8f16d3d6013da866cb279727c4216a37bbb5719a17a1fe41bc2ec6e84cf1cf5c05e65b64ae69dfc56b9211b1eee77c322dbdaa7dcc9c37c6cdb630471aa2a3cd61ad807f4984fc0cd8fca2d96bee4d5b9a57bc508df2c5707d6733ccbf62e9c7780f5de46a4e22202f5ec1941a5097b6cc8e94af369cc7779f62e886fcc47ed647c7e0592010fe278c694c93bc837891ddeb91adbeb2aec9f0fa551e65dcc6bf955697a4d618353933306730667bce51ad478df00ad270d3386214", 0x1000}, {&(0x7f00000002c0)="ffae1637d350f6c87c4ce21df7e4890ee3c9e9545b852cbd305b4a49bd0af3400a27832aa69402d024c9de9890ed4a5cb46ed173d799099dc1099f7526776f504877e29bcfdab82de226d16f07e0558218631d0909e485ab12a61017a317366003133ff4497129255bd5f7e6344ed1671e3e591b8b4c9bc78a2a1e9fa3648d3f67e22ea631e7a1a95e972731b604127998", 0x91}, {&(0x7f00000006c0)="de1e09d59238f3fa3aea9fa842979333a8c7a7d898eaa198eeb235b71a28e1b0ea36095c4fa2c0c71afe95f2ecb983d0f3995c7dff3f6282276421320efeaa65831a6ea6181f88641817ec8cbf43c160346f01072e06a5d0a28bc5526b1b8d8876cdf69d0dfdf990ea420348b8a518ed15ba9f8c6782f1b94e1299ee7c5bde411064675ed4e964d4074b5e1ea62db621ab1a5bcbdead8a5e153d203c27667cd97df7263af7b07f23a21d50c1495b9bfe5098f60ef6994c3e348810d5332e16508cbc33d3bec57e2ba72255df5662302427adc99dbc3a122fa1f3aaf05db87790dcff38fb979e2ff2a182a3f9933c27afb31184a8", 0xf4}, {&(0x7f00000007c0)="353cb5d175a8686cbd5b087df9fc108cdb11a9d9e954278b82cadf5cb23c5d5f8b21ff0c09df", 0x26}, {&(0x7f0000000800)="cdc069a619", 0x5}, {&(0x7f0000000840)="803ba30514200e3c1498a0e821ba35d17908e6112419762d4dbf369344ccf693ca4206c5ff6fab2be4cc9f6ab3f11b2a3d83063ae7599a7eb1c261c678ab6dd99c61edaf1ae32beb6de01b18bd3c5bbb2404939bfe8434ac9c4c56660407e4d93f4bd618c5c422bf", 0x68}, {&(0x7f00000008c0)="66866152b167c3ced6af831848cf6acc0a94cea7e07c7b19e7fcbdbd147d53105c742ae0e65408981e12f6a229ee5a6a66e22ffc6014301a0f844965eaa08385b01fa0e27610303138a83fb68baa536bfaf80784cf399433b517e0e21e24decf5cc47636c0e0ecdf586865b0fe49bdae46b13bce", 0x74}], 0x8, &(0x7f0000000a00)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_retopts={{0x38, 0x0, 0x7, {[@rr={0x7, 0x27, 0xbb, [@rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x2c}, @rand_addr=0x64010101, @multicast2, @multicast1, @dev={0xac, 0x14, 0x14, 0x33}, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty]}]}}}, @ip_retopts={{0x14, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}]}}}, @ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_retopts={{0x40, 0x0, 0x7, {[@ssrr={0x89, 0xf, 0x5c, [@local, @multicast2, @rand_addr=0x64010102]}, @rr={0x7, 0x7, 0x25, [@loopback]}, @timestamp={0x44, 0x4, 0x7b}, @lsrr={0x83, 0x13, 0x7b, [@remote, @broadcast, @dev={0xac, 0x14, 0x14, 0x3f}, @broadcast]}]}}}, @ip_retopts={{0x30, 0x0, 0x7, {[@rr={0x7, 0x17, 0x8b, [@dev={0xac, 0x14, 0x14, 0x19}, @multicast1, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101]}, @ssrr={0x89, 0x7, 0x68, [@rand_addr=0x64010102]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3}}, @ip_retopts={{0x10c, 0x0, 0x7, {[@noop, @cipso={0x86, 0x4c, 0x0, [{0x7, 0xc, "62a5051f49a78365990d"}, {0x2, 0xc, "164b19c60c449ad8dd31"}, {0x2, 0xf, "3fcba4dffd7a02d5bd82394804"}, {0x1, 0xa, "9ef928b611458155"}, {0x0, 0xa, "a96b7c16f64c47bd"}, {0x5, 0xb, "7d62ab04dccf594b36"}]}, @ssrr={0x89, 0x23, 0xd9, [@remote, @local, @rand_addr=0x64010102, @broadcast, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @local]}, @end, @timestamp={0x44, 0x1c, 0xa9, 0x0, 0xd, [0x6, 0x5d2f, 0xc, 0xc, 0x7, 0x7]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x4d, 0x3, [{0x2, 0xa, "8e37e7b4f0950f18"}, {0x0, 0x6, "59f1e869"}, {0x2, 0xc, "59b629e0cfbcf34fd6f8"}, {0x1, 0x6, "c36f68bb"}, {0x5, 0x3, '['}, {0x6, 0xe, "184f64e2152741ce19d9a937"}, {0x5, 0x8, "eee1764fbf1e"}, {0x7, 0xc, "d4dc5e8e33efcd0683ad"}]}, @end, @timestamp={0x44, 0x1c, 0x7e, 0x0, 0x2, [0x80000001, 0x3d3e, 0x3, 0x6, 0x1000, 0x401]}]}}}], 0x230}, 0x40001) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$alg(r6, &(0x7f0000008dc0)={0x0, 0x0, &(0x7f0000008cc0)=[{&(0x7f0000008a40)="7c72bf03f7d9c0fd0826786ffcfb99e55c1272594d5be5c7f1de9562bbf652", 0x1f}, {&(0x7f0000008c80)="9d", 0x7fffefe1}], 0x2}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000cc0)='mmap_lock_acquire_returned\x00', r4}, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r7, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r8, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 3.815024527s ago: executing program 2 (id=3278): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) socket$inet(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x4000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r5, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000014ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x4050) (fail_nth: 8) 3.690020124s ago: executing program 1 (id=3279): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a30000000060a090400000000d1d9c58a74db013d74563bbc3c270b8101010000000000001c000480180001800e000900696d6d656469617465000000040021801400000000000098d1b1ef7cee80721c50cb1640232c33d22a3382955647edf985cb6b774da4b7f0f6677b24234e3b8926f89a1fe6b045a723a0ebe0946f13fd773a07fcadd727698040a435c41b121608d1"], 0x58}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000003e000701fcfffff7fddbdff6037c0000040036800c000180060006008847"], 0x24}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt(r2, 0x400000000000003a, 0x1, 0x0, &(0x7f0000000000)) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, 0x3f9, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x40090}, 0x840) 3.000958013s ago: executing program 3 (id=3280): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x1, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_80211_inject_frame(&(0x7f0000000140), &(0x7f0000000200)=@mgmt_frame=@disassoc={{{0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x4}, @broadcast, @broadcast, @from_mac=@broadcast, {0x7, 0x8}, @value=@ver_80211n={0x0, 0x6, 0x2, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1}}, 0xc, @val={0x8c, 0x10, {0xf03, "a9268ea381c4", @short="be35b269b7339f26"}}}, 0x30) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000240)={r0, 0x3, 0x0, 0x9}) syz_emit_ethernet(0x86, &(0x7f0000000240)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast1, @dev, {[@rr={0x7, 0x3, 0x2f}, @rr={0x7, 0x7, 0x0, [@broadcast]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa01012f}, {@multicast1}, {@loopback, 0x200}, {@local}, {}, {@dev}, {@private}]}]}}}}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x80}, [@call={0x85, 0x0, 0x0, 0x93}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffff, @void, @value}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10}, [@ldst={0x2, 0x0, 0x3}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x37) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="180100000000000000000000040000008510000003000000180000000000000000000000000000009500000000000000bfa000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x2c, &(0x7f00000007c0)=""/240, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd, @void, @value}, 0x94) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x2, 0x9, 0x3, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0xd2fb069e59f44bf8}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x1, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) syz_80211_inject_frame(&(0x7f0000000140), &(0x7f0000000200)=@mgmt_frame=@disassoc={{{0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x4}, @broadcast, @broadcast, @from_mac=@broadcast, {0x7, 0x8}, @value=@ver_80211n={0x0, 0x6, 0x2, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1}}, 0xc, @val={0x8c, 0x10, {0xf03, "a9268ea381c4", @short="be35b269b7339f26"}}}, 0x30) (async) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000240)={r0, 0x3, 0x0, 0x9}) (async) syz_emit_ethernet(0x86, &(0x7f0000000240)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast1, @dev, {[@rr={0x7, 0x3, 0x2f}, @rr={0x7, 0x7, 0x0, [@broadcast]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa01012f}, {@multicast1}, {@loopback, 0x200}, {@local}, {}, {@dev}, {@private}]}]}}}}}}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x80}, [@call={0x85, 0x0, 0x0, 0x93}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffff, @void, @value}, 0x94) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10}, [@ldst={0x2, 0x0, 0x3}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x37) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="180100000000000000000000040000008510000003000000180000000000000000000000000000009500000000000000bfa000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x2c, &(0x7f00000007c0)=""/240, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd, @void, @value}, 0x94) (async) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x2, 0x9, 0x3, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0xd2fb069e59f44bf8}, 0x0) (async) 2.899861687s ago: executing program 2 (id=3281): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_netdev_private(r0, 0x8947, &(0x7f0000000000)="a6cc04e2d8f1c38afbf14b29b86e3a") r1 = socket$nl_route(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000040), 0x2, 0x0) r4 = accept$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000000c0)=0x14) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendfile(r1, r3, &(0x7f0000000240)=0x6, 0x9) 2.856918918s ago: executing program 1 (id=3282): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x2, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000140000008500000083000000bf090000000000005509010000000000950000000000000085100000f5ffffffbf9100000000000068040000000000008500000084000000b7000000f50000009500000000000000000b000000000000"], &(0x7f0000000000)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdf0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) 2.782284454s ago: executing program 3 (id=3283): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000030000000400010005"], 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x2c, 0x1, 0x1, 0x201, 0x0, 0x0, {0x2}, [@CTA_TUPLE_REPLY={0x4}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x8}]}, @CTA_STATUS={0x8}]}, 0x2c}}, 0x8004) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x3}, 0x10, 0x0, r0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x14, r2, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20008015}, 0x4008841) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYRES32, @ANYBLOB="715fec71b4c61371667c334dbb84d5ba67dfa0f4e88bfde35d7e56572d83b168c8c74231cdac8e83b13d02c91e5a95f2939f98648209f9db457b15e00c5bb08a2d317fc1a5a3e6ec66302f505c6aa77769d2f02766b50e325d6ebd3f8052a3f481d0ceda081efa9a358bbb58c69305"], 0x2c}}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200100, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4d2f02, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8922, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006000000050005000200000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x7, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x1}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x74}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x810) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000001900010028bd7000fedbdf251d01000008000a00", @ANYRES32=0x0, @ANYBLOB='\b\x00\t\x00', @ANYRESDEC], 0x24}, 0x1, 0x0, 0x0, 0x20008090}, 0xd4) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r7}, 0x10) 2.780191554s ago: executing program 4 (id=3284): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000001080)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x20000090) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r4], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 2.657113457s ago: executing program 1 (id=3285): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x1c, &(0x7f0000001840)=@ringbuf={{0x18, 0x6}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{}, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5}, {0x3, 0x3, 0x3, 0xa, 0xa}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x15, 0x0, 0x64, 0x76}}], {{}, {0x5}, {0x28}}}, &(0x7f00000003c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @void, @value}, 0x94) 2.603462912s ago: executing program 3 (id=3286): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @private0}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100)={0x66, 0xfe, 0x4, 0x0, 0x40, 0x0, 0x0, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x9}, 0xe) (async) shutdown(r0, 0x1) (async, rerun: 64) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (rerun: 64) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'syztnl1\x00', &(0x7f0000000240)={'gretap0\x00', 0x0, 0x7, 0x7, 0x1000, 0x7, {{0xf, 0x4, 0x2, 0x29, 0x3c, 0x68, 0x0, 0x2, 0x2f, 0x0, @loopback, @remote, {[@generic={0x44, 0x10, "265af248def678fd86d97e78a9a5"}, @noop, @ssrr={0x89, 0x13, 0x5a, [@rand_addr=0x64010100, @local, @multicast1, @dev={0xac, 0x14, 0x14, 0x32}]}, @noop]}}}}}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1e, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', r3, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x4c, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x31, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) (async) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = epoll_create1(0x0) r6 = socket$unix(0x1, 0x1, 0x0) close(r6) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async, rerun: 64) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) (rerun: 64) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x2, &(0x7f0000000180)=@gcm_256={{0x303}, "c4915c7f49541ce8", "9b84f987950ff3df25fa8f46983d34157e047d27ae4a66a6d15608a32cbaa5bc", '\x00', "be0ea450d5a50003"}, 0x38) setsockopt$sock_int(r6, 0x1, 0x2e, &(0x7f0000000040)=0x7c, 0x4) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000080)={0xa002a008}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000000)={0x10003, 0x0, 0xd7c4, 0xfffffff9}, 0x10) write(r8, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000001d00000000000000050009000d000000", 0x24) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time\x00') poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) (async, rerun: 32) syz_open_procfs$namespace(0x0, &(0x7f0000000000)) (rerun: 32) 2.591567293s ago: executing program 2 (id=3287): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000b0a500007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r2, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.43949694s ago: executing program 2 (id=3288): r0 = socket$nl_crypto(0x10, 0x3, 0x15) (async) r1 = getpid() (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={r1, r2, 0x0, 0x0, 0x0}, 0x30) (async) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000100)={{{@in, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8) (async) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000240)=0x0) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000dc0)={0x1a00, 0x10, 0x50b, 0x0, 0x0, "", [@generic="6f6d8864d22a3f2ffaa46c88bc", @typed={0xa9, 0x0, 0x0, 0x0, @binary="2b0e13e735a3184f1b3d6da2f1acfac0ee50d2b184b27db1f302de337c0004060000000000bf852c89867f6691b01b2d44e4ff2d2d28732c5fbd9423debbb86f9dba4a2dba4dbe076c02262600c446a567de243ab0d67683f7bb11c9cab3b3eed8a8bef4ff1631aa78acefca03c1a66db4424a8ba100022db228bb7b5eb5100100000000000000a0912086d9f4606d2e4cc898739222c5d3a83cb6b707f3336336ebb7d681"}, @nested={0x1934, 0x0, 0x0, 0x1, [@nested={0x192d, 0x10, 0x0, 0x1, [@typed={0x4, 0xf3}, @nested={0x1699, 0xff, 0x0, 0x1, [@typed={0x8, 0xea, 0x0, 0x0, @pid=r1}, @generic="625b07b08ad1409578520fa9ea1df68242c6ec23a679ecd6c471d417bf0c08fcf5e1ec6b746cc2c8493a7cae43e638b8045a8613e052744a6e77e8924d88756b303dc541a4e303a89d0f8fd3c69253e2aada555bfbf9c21293ff8901e318376222858b8f0c5b23f4bfdf8abaa2f29b194dc15447e9b67cd170cbfccbb63cdc45fec1b9d6d57522c00f3f4f50d46743aab4b0b5675039c45b7009d0f6db9f3a4ad4f83ba93b6dce9b3c56b6fb8bad4a21d93ba285b556803bce4b2c4fdf87", @generic="5e0b470c5e0c28a855f71741ce4c80095a8ce2020797935fb9ad951892", @nested={0x4, 0xdb}, @typed={0x8, 0x71, 0x0, 0x0, @uid=r3}, @typed={0x40, 0x83, 0x0, 0x0, @binary="d5f669db3cc43f461c43a578eb1dd700d689267aa1e063680617579a540ea56e140e2766233bbb844a82526a18c55ca707426efba35e4625819be101"}, @nested={0x1534, 0x5e, 0x0, 0x1, [@generic="c4b8ed9ca940f4e775fdfe8708d11f54358d563952faf704d46cf2865a393b0129b6703167484c470426c8b0e0e317152976e730615b37085ba7b3378131b4ae5ef51edf7859ae483f945817c7ae6789152e5b9fdf3a7d9ce5df83700b2c2b58ee920e57f8a6b777a0fb8289647179e8e95f5480fb22a449a2650d562af20d0e3720fe4f728a8592adc30f5a2a5454f28dded5314080b12aef22db8aa93966ff", @generic="79c5cfba91b1532d2a34a90f8a60f2270df50413fabf5de1662baa19fc16981271b7b85e5a024388b842617325ea956ba19c8511835d4dd05bcc32f7e2c633611cba4ee4ba518caa6a6978090a84d1f3b25b88239fcf8d2434ad1b8efa63e9ea55762c726c6ef73e68fa6f0f5dd77ad377bd047a98d6f91f31562ee245f836f499d8aa9b24b454b71d3939bc8628d7bbd42e20cbd099387b1997bfeb377261180b9c9aa32f7fdccced69a4eee72b6b23355978c1c66fbe8b07815cda6a00e985b94e07852d1c65e0326fa4f54ea6b5e0ba24483e2b6c0d1acc80f46285d2b488ed5644dc1ecab433fd16303a3ef0d85d302eaf8dc8b645136abf131e526a1e77296663fce699b6a2e402c870d2c8d5f004419187e9335bee0a403b0cb541af04d55d3e308c18b6b14ff9e9951bfad6950e1938a5d0762461eb6a8aadf3853235f6d902e3d1b75bc751fd9a0d51f5afd309ee7552152b7f2e02a5466e4b812b4c0574e60b1f9574ad22dcd93b0d4a28879d3e4c4aadbf050b973135198dfa5653079f26e3207e5d6ae2f891f9a88b13bd291c98e1614ee71dd999b0c5507d25193ca3ee35cd81d7792df4b336e831abd1599684417d586e16cac70144b39f1907cd754e6036c46e4593d9a1b110f75623d8b3450b599a0fec3a6caba61e0417e647027190425235bdfab097098cfbbae5e9498e4d38c67eebb42fcbde98330fb7d68adcf8cc5c0f5ddb19269d3381c5bd5664e3ffe1c51c27ae112e205e65d62de8aaf90928e5b5e5537cba23f614962f00f70188d2f2250ddc4107f7cc3cf82608989fcb5294867f8b40be7d3ad15b6375778a2cd2f393e6718b6499335e302998d9a806036859aa63abb4d0ce3da939410a88e1ca7c77dad9cdf6d651a55c9a3f559ca74df148be4ef8a55b032266f7ef8cb0aa416d4eb83714f073bfdbec307777005333edf8518651a2bb492171d874c5c78e045aa50b264983ae9ad11c01488508f0af7596d6113ad75f1c2d7290c5d1f0e73630e39f9cc2bbe6a946ebf0fb834f6ac0ae512c26742932cff6c0eb1568cd412a7ace4e54ba9ccf7ced13c68184ecbdcc15926b54591db20a045644114f4ba3688ae716de38f3919d1d077f0b5ee9111c47a64f9652077cc71445905131e8257535ff826547df40f6aa9d838644d32052862523230d7c45e8a4992854b825678298a8f03f9f5e11e7594885cad97371c6889678e939fb3762094f346a2a6092395f5763eb9eb769127d417e97803b15f9802dc7d4c36212d0283b6ab378fb6d1e72523429d8a698e136585dd1f16f81619d35a0b6d12241696eaff51eecca157fb21bfaf6ccc0ed3d756e764d5ad1e6247908c8e8008590f8c359b93f94cfb5b0b5802d084653645a7280792fecb51165949bc5972dbc6371bd03150c9464b1b8a7cb2bc6d7397aaff40ffd8f049d9ac201f4fc4208f0840127bf6c5c06c56a153a2c5d33569dd151230b24ba5faf8267d6d07bef7fe90389f440df32516943ac2b34e1bc42f92581defb8d92c2c12b77abf2f933fd516b3cb18f86cd14910ce7d072da52efec1479f75c6fb330b0f1c491f5840a663c9293ad169ee9aed85537e2af4489175a5a9c383637df63348877ef45abdfa6c2ad7ea8ad417598080d071f8e0a09dbbb2f4ec94e430352444d02a4f2dd74e856e16a3c99cdd45c1e4275f583a72b1a6b55a0999847cec7f3ce7ed85c7fa6aa9c8e2be6afaf81d53b9b629b53e295dfd6d735555d980fdc3c1da6f974ce26aea25787c06a6f06e096f67fb44cd2da87a17b3f5eee7b8d0de8979eb1f9517c6892829b21cd84c25792a2f5680d1b45c6b68b561d2807f265f675dfac113d980ab5bafec4b4d1f5aa47e6b24a756d3daa66934a75e43b6282bc29f1fd585a55e674c81c41ca10f55f04eba646f946b3cfcdcd584f77110abad15e21793cc63370a1f619d03c6dbefed4187caca7d4bcfdf7daaf9a2c22fdd3c0f59cde3246979194226ee2c98868c888aabd7772abf2bfe6b9581b2c338649b95b942d42b2178520a4d4e8f2a2fb29bac6e5aa95317dd3f93d3ab2c164a748cee4cb0b6d6de02651ce5fefce02722f592d2ed63b481d5e14ae0c6c644630bceb351c906227a5f8f1a7ff71c011110a4a5a8ff92d9da7cc47838ddf1e3c617662f894b45403a4fcc90beaee540c6757236749baacef1d3c56cff809971ade933db71bfd30f51bca56af4eafd7689cc11ba72a60d91984eb6f0f2d7f3ee4bdaabbac7b4d0f0d9bf90ed7514e8af1d0c73375d1bc281e318e6024bd2c3e5a1493fac7ec9a423c4fa454cff418bcd317d024e7994dd76f1cd141f31a25f4f6cc6e813bef4d279753a60180cef07a5f7466176c20d1bfef8990b7160069705c4b29f30055af70a5a8432a226ae7a1fa481755a02c060795a1039a9a9b3057a5d3ac1a7e57da2fa097ba668deb5151ab127f9d05c77b50f7843b80ee069527ad66a7b7d11d73811beedf0c9257baaed9df39caf254aa9a6b03602740704db4c36455574cff81d7a286fdaeb1bf27adf2997fb8d7ed175b7f1d10526aa5823623d45b26a13fa639539abacb82b5a7b919f01a2fa0526fdfc5d5f2a18c04ac48e645d8dfc2a09f2f00c82642f6d098ee44c454a13a61c720ea953c754e363fc917feb85ed227ca0ea587c311fb458ab001b1a735ef2ff9b687030530aaed1d1fae390e450493aa8b6f7ad28c40b7cef6e9a01455338565bb6541ba394bf5b32cdde230900869792b14d5fe59d357ca7966bb4f1599464ff6247576118372e1f8acb41975771a68cd3b0643fab36ad89d16a4a7c5972bffaeeb9e8f94152718734e7fd2753ae3fac1e788195defd1d01d8f75ef5174488f1e74dad59964ae84ee342398945f20975db1f12404fb2862efafec1e1b3df795b35475803be863818b543a676483e35a853ca66fdeb1597385a9522d8854787bef57b1af69d8ef19eeead5db504c30b59785bdc799a1fdc4bd59f18f336ebbce3cd6cd0fa9d0d6eed450ba274c35efb5cbc5e65e48603d8a4c316f221fa88cd3ba2ce2de930a05dda48f94ee5e50ec60efd15259b47f5ac486bc7054b570656cc40f5ae9e1b9bff6b3b4935cc0d0819572565f50928a9980a4fca416a661c592975da3352217ff96258ef9b5160134888c45c9c946069b2fb5107dd8000fc4f1d8ea0d483614d85ece6a8525e2b4e5529602929f0f6206a178e8b4963e960ba3e94b783f2f5e58412c68b969f0a624b935c7b805f7034b507e364c7839c165282cfeb58bbea02c8007c35c079d731726354b0edc0d2639b52c9dd4d76d2bfe33510978265ee5468021eb5009ffa5c8f996dd37bd42c1939df3cd239fcea4f7ca219ae5e5070aeeb18822af49db33f09271c3d47bc068f784e06dd073ff394d4b35e9d538c8ede374ad208c96c45e4fc62655e6ae6048b1bff794aac48eb1bfcc26c4c4f4e6b92ba2abcb954f16560f946d8c359de0b251ae3a780834962298a17f0793d59ec8ca6297a3b403e8cd2cd4381f21b53168a2b097d6352fa546fbea108f4bf9743423bbdeef1ec2dd93b9506052bc9988eee3cf476f7eda596819a0b8d8bccbeb0515327f5a18459ea80f36b8be49d1128729d2a7e8b8ce0236f61bddaa3ec9886ae544fd324fc2ef532a33633342af3f2879c996ac6a219fc873c612d3daa2f1343fad03ac6f49125026c01bda23d6152fb6641096dba17e4735e66d71b2d021f04581d21766b8feee3c547c12beeae12f6cde617440cb86d3c8a4e6e743106324ea82d81bd434f6e394d287dc59b4e92261681d004e15ea3cd93e1dd80450874f62a0a9cc70fa10bf665651e48c5e95e37ee9fc9d5ac9bed1254c6b3a9cde6eb6a026fef59f546985d763676566db35dc53169407c5d4ab75a1e6001afdb4bf3746463f2cc5947f91a6eabc62e90079cef9a9774e43d43242007e5fbb3b9e5248e49683dbcb3faadbfd8cf618294e568585b92e2370bfa7643aa7945bf36ce9121e4e60a19ecfd037bf8261a77484cf24999b557a0b50d1b445021e707b78c4178647341bd24dd5841b09c9a473ea04f8d6b795b842aedf1df40f0b931953346e71e2cdcaffcb48a2006aad2577aad36d40c4b81f8fa07964166952329d7c8b0db074a1bd7cdd3e9dfafeeff4c350379dd91720adf34160f516e6dc0002b79a30a382546e0a4dbab235701c549546111aed566dcc6c3e9f078a87f037c993688395060babe636fcaf63960f40b55c47653a8193ce689f8eb6d00d4c3c9e2fc918500137209d8932fb3bc83ce7c95efd71f63ddbeaf154453f5dcdaf8056cfb9a570a4750d9e592b42d76d0a94591b50a4f61f0e8c106161437d7d948aedc81720e81d5ce326598cd33873c6b51125d58bc3b62596d04315cc22cf11aca1e8b8f3df778a733ce9e38b04a654da090367a7e6ceb6b3f62bb5ef25d3e285705ff01a2a5512aefee156ef54accd55652cdb5d4119ca859902023ebede14ebef0014b9b23df708e27ff3a398799c95e1dca504d746200cde1ba5b2640cd2ca97b584764bddc390f7059286b531c0ffd618e75095b31930108895ef99a3e2cf25b736569cc06dd4856b2cdb5b0699af22abc3d462f67b4c766c09c5534a7d5250198131e8139c68035f82238858e9a6f188522a816e01853588c50c3959a0403750ae60119f0a4be40114ab96afb13bdfecb2378f6d41cfd65d2b508e42a8a772c8d2f0caf514aee07ae739a6e4e3fa6623a46a377c2421b7d2ce2dba398dc46ad05c1bd203e3ea2b50d4bcb7de32faac1ab7b19d57c6cd486f2be40963628f795c4b4c3e6aaa81f2a106b37c1bec0bd4c7e475d45879836ea5459096e808c1c24e3ffaaba1ba6854693ac1c01f868970be24ad5507b80258b33439a6b6ea170da6f42c4c0c62f259b4a0c0bb2db145b59cad5a2ee196053ed7228695c1c5da530a875932627d18fb582b965a47c95979f825771b54dffd74fed04345ae39372badb8734804b4f729b50a03c3433f41a287b75b4809c18faa635498096458ec5d8bb8f5add6dc0bd3f03bfb7d55ae3686486b9bb77f6c778a84089e3387e67acf4770473e9b182706d30d8ee79d825e03ba2e0d715dc47d4d6f30b747f321812a2f3cf46b6e9cc2abeacd0af6f620572367425259adedd43f718f3289665f89c966bf28561265642774b1025214f8bbabca00426b4cf6bae354e4833010a6d9d4ece7cc92313ba0dcfa787e045d9e19e697d902b0d1388aab6a355c91d2cb277129b20425df7bf4eb3c3f38dffa91f41b754ddbfa02bf591e0fa4c5949eb322a4a5b6d7b0409094e694c6763363172a062e68c872fde7161bfd97e9756e33b8598eb2d7b5125cc17d68a268bde1431a14d0b290ba69119313cf676e10950dd6f626fd02380b99b8953dea0acaca642e0545db4da9c606ec9368e0d49e5f25d3edbd9f075c2453f1e3b75f64a5cd360825921bd23eb9e78f940f9861d965efd37785eb16210ec6c7dccf93b910319912097c5abd626cf3d24a70f60763963657a8d1c853f264f9d2d6531d26e23ba23f757c9d4e9598e23bc252c44045fabb6b837ebaca3780fbd734ca8e8a68130b0cfd78561e49b753f372ab2833b7912108ea42b3ab0594bb64da8027ec3bc4cd784229db4f5bebadc4641720489c41890b5066c18c45a484b2fa25c220e181aa87e9891a8a3029c3fe392c255d5f3b24d9784528146a2c653c8055bf5809fbf7a3777d3c07df6d15b475b1a1481fa7f951c108fcff9c1d5c6b", @nested={0x3e2, 0x5a, 0x0, 0x1, [@generic="cf11d88fb7c47fcb8fa4b7398c9e0eaf27df0145bffe3a1c68b89ecc1334ba5b3b22c8f0b3faa513de0462b6de0664d7f2b111459e135ba418a6925a2fe03320e29e702b30689d1e681df79dc27107933f78c6c3866b735d12ccbda0136d7fd25edb8456dff150adc8b57186e5c4dbe9adc0e80fcfe1acddc858bf25b18c2c28fbfd49466581d57e8994353b396dc18ce67afedd40b61e2ad8e944702c940c59f368fbd56ab3b1539b4e97de02513161c150d538151a735c95fd35d550a92cd93b5f6707dea9f230875b7e73d055adbc6ccaa0f9b2aa29bafd540a705148d9e5a3b711a7", @generic="2ad42369cd298261e75a6201f0b4ea8142b19b14c60fe3f7025b767a7aec7925c24fe47f68297b326c7463f76d562ef7e2e3baabe6a255100b973efaffdda973a94f21122d7eeaeacdb8fd9f31921cb786", @generic="33686ec0cee886c4e1ac0d23f1b2ef9cb85831193fba9b33ae", @typed={0x14, 0x12a, 0x0, 0x0, @ipv6=@loopback}, @typed={0x14, 0xfe, 0x0, 0x0, @str='veth0_to_batadv\x00'}, @nested={0x267, 0x131, 0x0, 0x1, [@nested={0x4, 0x13e}, @nested={0x4, 0x21}, @nested={0x4, 0x92}, @generic="cf2e80b8c46ed4471ab5602f91163880867152c53e4ef29096ecf6dac3137b50e7ca43fd1227fd555f6d180081b38f1ae0acd4129331956911063c9358f6caef9e650f5f3c4c22e562bbdc063f4d23fd4d6da1079292cea3ed15f84d6593a879de4c951ec61811fd87c2ccbceb7b889b299c860e71a03c0d5aa66cd6cd0883b4ab5c30739d2392b38e3207bc32f10fb6bf3d71d4be50bf35b26fa1f399906986c958e26c7351d3db3c5f80a8ba2130680bde2a53ce7871d0a8e5cc7562403a8415e950922beb729406c30c3bd1afdb88bf42ad9b71cb2ede77728b21b1cdaffa7604c6ef4072355b5774224687ba0a068ff546e282f20b", @generic="b85ff6ff2544e990d95fee0a81773dfb240f3960249d8b0fa6477b4bd947a42c811ecfa483b753e54cd61b1e40433e5ea26760a9d8573a958a2c0ce109a93328c6d7253340bc42dca91d59f8b36be79a9b72cf92638c7c85df0d3d7d02410f3aa520766ce2305641d69cddfd4680f789638f2b67e4dadb9f9d6a56dc33845a1cbf02913c24b47464fbee154f492f3de201ea4a9e5e30711726d06c4fcdbc6d8c87122d8439e89b63f4837b7502106086920bc0c312cb6d24bae35d283b541eedfa946fc905286a6655a5cebbf29792f7ca4cdd", @typed={0x14, 0x13b, 0x0, 0x0, @ipv6=@mcast1}, @generic="eb935780a8", @generic="a287c6949e4e30b799c72e026620d38eece1ae6d3b7af029cbd4787c0bc32fff2ef487c354184e313f83a32b0d0d0345b4dfc192474cb3703f6b253bb2761fa6e41a27113b980fbf4c5b79350b12d161d66022307e6c0262daec0cd2de24b311c4bb00c4971c35fcedf8319f833633174672ff36"]}]}, @generic="7b11c51cf6706a3636aeec68a1a90614eacf8ddc6ced6327a3a7b8cca41f9caf92533292f2721c41b62156046149778e20aab95b357a765ae1158efd958077631d8e3530784992c65f508287563c6a86164918f02659d4f79e693cf018034381fc6f25c217eba9e60ff7642ec4f074c6450bc84d3dfece9755604166c920fdea6b9235a89c7fa6afa9312ac529052b3ef95a84261129ba2d2eb7b681f1a99a75b7f4afca", @typed={0x8, 0x86, 0x0, 0x0, @pid=r4}]}, @typed={0x14, 0xf7, 0x0, 0x0, @ipv6=@mcast2}, @generic="61ebf07da997642fa337a68f45ccfe771f197310d10ae461fee9cf3827ad"]}, @typed={0x4, 0xc3}, @typed={0x8, 0x12c, 0x0, 0x0, @fd=r0}, @nested={0x1cc, 0x139, 0x0, 0x1, [@nested={0x4, 0x84}, @typed={0x8, 0x109, 0x0, 0x0, @fd=r0}, @nested={0x4, 0x2f}, @nested={0x4, 0x42}, @generic="4198eda1946ba4b6207686ce4021df23fb8149d651c5ac10acd6927b6ac25c7f2cea0d5c8b3596f4d9db389e677b6c913177b8daa1667d0885708e7b2979e70de6d6071123b5bf0a8ae065fb9b48dc8abb7206588a3c686093226a199c80f66cb2d344c1992086376afd66", @generic="c0a12d3225b341f5a716c43b3e3b28d00a3c51357e775302a04a30e30e46e6477968a914a98a23b439b82545a815dcefabe9cce0dec99463e287b99d31e97454ff76ecef5fd6847a504c1f008f758ddd11c051f3390df0a2ab415e75e9a0f478c491", @generic="2eb9c3314ab326902528e9d5ac23bdfc9252d4ad6ab0af667af2516f3c61ecc00bac71d0f61ac2ac19057684e40835212f08aaeb4118ce22c352e91b7da7ebd35b6f30a7fb6c1b01331861fa1ac68137a0568d93f83dfcb5190754dfba8a73f76c69b3deececf01c06ebe785c71d147ac07135c537b51b89215a3aa3ee842132cf261025a40066429e57a12d", @generic="2ab2df824a26ae0564fdb8828352345550e6df08205d38a2236b3947f7768124393223bc327d0d2d167a006717277ff6ae6a952b0376d4565eaf274ab0808001affe99c8224dc64dabcc50", @typed={0xf, 0xe1, 0x0, 0x0, @binary="eaca2898d548ba7a8111ce"}]}, @generic="de3d024223984f5a64e9cafe7790985435237c356ec68009771f366cc8afe2cac7ccb72fa2aa9add160662a5b74e12ae4f", @generic="1df7546d93bdea01fdbffdfca780ec721c211d63b1474b7f5f47a08b38655dbf33fe7a80a2cddb5913e9a0a7d1bb0430702da2573adcf54177a77b12c28a82fbf5a520fea82c207e4fc59eb2e8d61e3a53971359c93aa97d9d7ed8332768dfa6e58771c2c73acac6451b863582c036c52932c8217c778b93", @typed={0x8, 0xaf, 0x0, 0x0, @pid=r4}]}]}]}, 0x1a00}], 0x1}, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth0_to_batadv\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x4) (async) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_deladdr={0x2c, 0x15, 0x2, 0xfffffffd, 0x25dfdbfe, {0x2, 0x40, 0x8, 0xfe, r6}, [@IFA_LABEL={0x14, 0x3, 'team_slave_1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008040}, 0x10000086) 2.418231219s ago: executing program 1 (id=3289): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000095980000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f0ffffffb702000005000000b7030000000000008500000073000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x2c, 0x10, 0x801, 0xfffffffd, 0x0, {}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x2}, @IFLA_AF_SPEC={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.numa_stat\x00', 0x26e1, 0x0) close(r4) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x5f, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000014000780080008400000000008001240ffffffe80500010006000000050005000200000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x5c}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={r0, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000240)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x7, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3c, &(0x7f0000000400)=[{}], 0x8, 0x10, &(0x7f0000000440), &(0x7f0000000540), 0x8, 0x7b, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x9cf8, 0x0, r4, 0x3, '\x00', r6, r3, 0xfffffffe, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000b8a6000000050006000100000005000200"], 0x3c}}, 0x0) 2.417634326s ago: executing program 4 (id=3290): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) getsockopt(r1, 0x200000000114, 0x8, &(0x7f0000032380)=""/102400, &(0x7f0000000000)=0x19000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000140)=ANY=[], 0x32600) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x300000e, 0x110, r2, 0xddf91000) getsockopt$netlink(r0, 0x10e, 0x4, 0x0, &(0x7f0000000080)) 2.321171856s ago: executing program 2 (id=3291): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) socket$inet(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x4000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r5, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000014ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x4050) (fail_nth: 9) 2.315534069s ago: executing program 0 (id=1982): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r0, 0x0, 0x3}, 0x18) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x6, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0xfe0, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC]}, 0xfe0}, 0x1, 0x0, 0x0, 0x20008091}, 0x801) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="b4ca0e8df84bd493700fab1f24375620a8c92bec181185960d3c6225e6b0054620ac25407249d0b3f06d30ead932e232adda5a1c9227bd4fdbd861a6d0a95b77283ebc8b1aa9892051c4e50e5ea8ce29e10272b259cbb49cdab37977336f71077193dbfb41626a1dced64ef559dbc915e6e320c381b74591574a4e774ac35c8f5c6672558913b3903b73d72ec1561b4ad2cdeaeba14ea123ee753ff7e717d06102b3d7db50716e889a14383ffe2f556efed71b72047ffd9d633c0d6a6860", 0xbe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/syz0\x00', 0x1ff) 6.035243ms ago: executing program 1 (id=3292): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) socket$inet(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000e80)=ANY=[@ANYBLOB='<\n\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r4, @ANYBLOB="08025a80280003800700010005440100050007000200000014000300000870ed0300ffff0300018003000000180001801400030079088000fdff080008000400060095230c00028005000700010000003000028005000600020000001400030000800010000000000200b92f00049108050006000200000005000400010000007c00018033000200360933183a0d1f41420333380100442f544123385539002119064f141f272d3a380e2d3d0751443f39512c3a432137001400050010080400070000000500c7c0c75dc90f050006000100000005000400000000000900020043284e12340000001400050001000900001008000a00e500090007001800038013000100040b30181b0c032f240b607a6976010004000180300001800500070000000000050006000100000014000300020005000800070007005a00feff080005000600010000005c00028014000300ff070000060007000800000064000104050006000200000005000700020000000500070001000000050006000100000024000100010b6006600b300236180c0024186c12480048010c01122412366c120c181816640001801f00010060601b3618360416036016bd360101041b04166c0248011b043630000500070002000000140003000700020004000400d3c64000020002000500040001000000050006000000000014000500b500440200000200090009000e000600b8025a8074000280050007000000000014000500040001800500c20b060004000600ea00140005000cc10f0001000600ff7f01006501d3001400050001800400880507000b000f00000092061400050002000300b3f2008004000700060006000500040002000000050004000000000005000600000000006800018014000500f5af0100820007000800ba006b2e22f705000600010000000500040002000000050004000000000014000300715d02000700790074000400bd0a7f0014000300c00d07000100bc0e020000040000080005000400000000000500040000000000180000801400050040580800070001007f000800fcff02008800028014000300080079caf9ff0400070003000800090005000600020000002e00020009072147061101260131414b23464810101b1952254f2f4240360524574041303b3d2c04571b3b085200000005000600020000000500040000000000140003000700070001000100ff0105000d0004001400050000000900d0cc0d000900040001000600d4000380050002004e000000140003000004000043000000030092480900050005000600010000001a000100126c00300c01050c3016240606000139090505360b300000140003003c2efc0bff0fb40e420e4000040007001a00010048041b18090c30090b052403480212041204091b0018000014000500070018000700040008008100ff0f0900140005000700830003000100ffff0b00700a00002100020012000e062f2d2a4c09325308480a1d27401e22350b3d4b293709544c2100000014000500060001004f05020009003200090000c0140000800500040001000000050006000100000044000380050004000000000014000500050002000800090009000d00000002000500070001000000140005003c03060001800500a60208000100010005000400020000000c00038005000600010000005c015a80040001806c00008005000700000000001a0001005b0b040316301b0618481218183009026c7e16300924000014000100360c0409096016090405093624300516140003000c006fb7090005000c000004060006000500040002000000140003000900020003000300090000004d7481004400018005000600000000000500060001000000140003000f00030002000e000b00e60b13f603000a000100020b020b4804000005000600020000000500040002000000a400008005000600000000000c000100040c7c040c0216040500040000000000140005000d00000006000300d2e300030000469723000100051230010b5e6c01121b0c0c1b510c6c0012010604301616050b300c05360c00350002001c4e130052080a094d2209271b174507031045381e243c142b565148531f1a4b040a07282c0f40272719410b490e390041000000140003000000040003000300090005002c00070068005a80640002800500060002000000140005000100010043090300ff010104e005070005000700020000003a0002000903070e084f33380b480c4f0d31155422022d12110829291c530226180c023e2c1b422a2a274e312c442b0d54002e391f103f322127000098015a80ac000080110001000c0116010002056c4848483602000000180001001b0b090f3609246c161218606c1b03241b1b0118050004000100000051000200235123465328141b4c00393e3a1e3441481115412c390c4f404f2e0732114d1e3f0c4c4e523e0c1607182e3449472428323b0c3c4008561b444d3e0b550853381c1148310f2f3d19414b2c0f070000001e0002003b152937480126102a5620451c20401c482e34485d52110d0f2e0000200003800500040000000000140005000600f5ff00010900090006000c000300a80000800500070000000000240001001d096c1605033030040b0609041b050b160b4824360236060930033d160c0b061500010018306c48600c181b04030960031106121800000014000500fbff0500040001000600ca000101c5061800010012360c056c0c1b0424090c160618526c2409041b1f00010012040b054824670b12091830021202026c090b09481830120c053b0014000300060000100500050002000700575ca6c0200002800500060000000000140005000000090007001449970eff004000040098005a80400001801400050042820900ff000100020008003800080014000300000003003500ff01fcff020000040001140005000000010000000400010007000000d4855400018014000500fdfa7f00080003000300ef0d060005003b000200503b175454474d4b534b39294e2a470750463b4012510029513d39294a041e10222c1339050709224d304f1d40363a2238541e143a17180090005a803000028005000700000000000500070001000000050004000100000014000300050009000e00550000000900050002005c00038005000600020000000500070001000000140003000700a300010009000b0009000100ffff140005000f0004006877a000010041330c0005001400030009ff03001000800005000100e50008000c0001002412090316050b6c9c005a805800008005000600010000000500060002000000140003008fc19894030005006200400004000300200002003a182f29081e1901053d4340544c28180e2103540b3f4719033a04100f0002001039394c182d0125422c290040000180140005000f000500fcff0002fcff00000300100014000300040080000600000009002700958e070014000500ff0109000600050007002b00a836670040005a80100000800b0002004c38214a203c20002c0001801f00010004080205350304050c0b0316304801121836040248186c09016c1200050007000100000016c48c179f71e64346565e2760bbcf51f16778ea188618d0a5394b91d6441e0afe3a03a40f0740324af36199f4cd6a1c480942d3c8aa1b68c31314d461"], 0xa3c}}, 0x4000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r5, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000000480)={@dev={0xfe, 0x80, '\x00', 0xfd}}, 0x14) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x1b, &(0x7f0000000180)={@remote, 0x0, 0x1, 0x0, 0x0, 0x7}, 0x20) close(r6) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000014ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x4050) 5.020623ms ago: executing program 2 (id=3293): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x1, 0x59, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000340), 0x8) pipe(&(0x7f0000000640)={0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000780)={@ifindex=0x0, 0xf, 0x1, 0x1, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f00000006c0)=[0x0], &(0x7f0000000700)=[0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0], 0x0}, 0x40) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000800), 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000007c0)={@cgroup=r2, r3, 0x22, 0x0, 0x0, @void, @value=r6, @void, @void, r5}, 0x20) pwrite64(r0, &(0x7f0000000580)="d97047cf388de7609265d645c78208c49b8106a2c2fa702698e325c810668e465525399a9cf48e1e36e1576fae9074397623d178fe1d08207dc67e71a34312365dbf9e73516292e3184c9aa159043d13fd7534613d6943ac5ca9c97588e7b47342d1031c7784e867be08c1fdbb81fd762a1ff704ec005400647741578ab98421f2f3954832815205585e805707", 0x8d, 0x9) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={0x1, 0xffffffffffffffff}, 0x4) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x5, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x17, 0x6, &(0x7f0000000000)=@raw=[@btf_id={0x18, 0x4, 0x3, 0x0, 0x4}, @map_val={0x18, 0x7, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0xffffff01}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x9}], &(0x7f0000000080)='syzkaller\x00', 0x3, 0xd3, &(0x7f0000000200)=""/211, 0x40f00, 0x2, '\x00', r4, @fallback=0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x5, 0x4, 0x2}, 0x10, 0x0, r2, 0x1, &(0x7f0000000440)=[0x1, r7, r8], &(0x7f0000000480)=[{0x4, 0x3, 0x6, 0x7}], 0x10, 0x1, @void, @value}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWTABLE={0xa4, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0x78, 0x6, "38507d6ccb0de48daa0e7d887154e16dd5666fa73ad243bad59f0bdc397f8c8db1e439ee36e89a78fc7779bd5ef007875ccb1080b732fe72a6e5c2fbffdbf4abb46f871414e0d54bcc26b1b54e487542f7e0d8f5f39a50687c2f02dca4a46cd42eb7fee9161207ed329ea22789b198b1ef6bb753"}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN={0x0, 0x2, 'syz0\x00'}, @NFTA_RULE_TABLE={0xfffffe0f, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xf4}}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040)={r10, 0x3bce}, 0x0) r11 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_serviced\x00', 0x275a, 0x0) write$cgroup_subtree(r11, &(0x7f0000000000)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r11, 0x0) setsockopt(r9, 0x84, 0x80, &(0x7f0000000040)="020000000980ffff", 0x8) socket$netlink(0x10, 0x3, 0x14) socket$inet_mptcp(0x2, 0x1, 0x106) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNATTACHFILTER(r12, 0x401054d5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r13, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="140100001e0001030000000000000000010100800c00000009000000000000009a8aa489160a1150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb47d96219c08c029d1608a487f26fbe816b89f7cb81bff81a8b7a82565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b850c9bbb14b8f1ea8ab3a682167c43dbf137115a40ebddcad74875cf0d972df9e99f07976773f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fdc2f4393c05a007d12b505a84dfdb98d568175b62421d726d1e5331e1ddfd4d080001"], 0x114}], 0x1}, 0x0) 3.562078ms ago: executing program 3 (id=3294): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) r3 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r3, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="933c547ecfa7"}, 0x14) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r5 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r1, &(0x7f00000002c0)={0x40000001}) write$tun(r1, &(0x7f0000000440)={@val={0x2000, 0xc}, @void, @eth={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x29, 0x0, @private=0xa010100, @remote}, {0x600, 0x0, 0x10, 0x0, @gue={{0x2, 0x1, 0x0, 0xbc, 0x100, @val=0x80}}}}}}}}, 0x36) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000006"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd27, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e20, 0x4e20}}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r8 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0x48, {0x2, 0x0, @dev}}) r9 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r9, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0x4a, {0x2, 0x0, @dev}, 'bridge0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) r11 = socket$qrtr(0x2a, 0x2, 0x0) r12 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)=@o_path={&(0x7f0000000100)='./file0\x00', 0x0, 0x8, r3}, 0x18) poll(&(0x7f0000000240)=[{r2}, {r3, 0x200}, {r11, 0x220}, {r0, 0x2061}, {r12, 0x4010}, {r2, 0x2140}, {r2, 0x4002}, {r9}], 0x8, 0x1) 0s ago: executing program 4 (id=3295): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) ioctl$SIOCGETVIFCNT(r0, 0x89e0, &(0x7f0000000000)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b40)={0x6, 0xf, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x400}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000340)='syzkaller\x00', 0x5083, 0x0, 0x0, 0x40f00, 0x0, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x94) recvmmsg(r0, &(0x7f00000007c0)=[{{&(0x7f00000000c0)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @remote}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000140)=""/245, 0xf5}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000240)=""/173, 0xad}], 0x3, &(0x7f0000000580)=""/67, 0x43}, 0x8}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000600)=""/101, 0x65}], 0x1, &(0x7f0000000740)=""/78, 0x4e}, 0x3}], 0x2, 0x0, &(0x7f0000000840)) kernel console output (not intermixed with test programs): ve_1) entered blocking state [ 444.977967][T15731] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.000679][T15731] bridge_slave_1: entered allmulticast mode [ 445.023225][T15731] bridge_slave_1: entered promiscuous mode [ 445.223341][T15840] xt_hashlimit: overflow, try lower: 72057594037927936/255 [ 445.515149][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 445.634590][T15731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 445.695614][T15731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 446.065624][T15861] No such timeout policy "syz0" [ 446.109560][T15861] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2727'. [ 446.203684][T15731] team0: Port device team_slave_0 added [ 446.308876][T15731] team0: Port device team_slave_1 added [ 446.359217][T15865] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 446.475511][ T5838] Bluetooth: hci2: command tx timeout [ 446.554947][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 446.589055][T15731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 446.645085][T15731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 446.696086][T15731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 446.757129][T15731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 446.784910][T15731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 446.848712][T15731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 446.953337][T15870] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 447.241495][T15731] hsr_slave_0: entered promiscuous mode [ 447.260856][T15731] hsr_slave_1: entered promiscuous mode [ 447.298105][T15731] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 447.365173][T15731] Cannot create hsr debugfs directory [ 447.371130][T15891] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2735'. [ 447.511057][T15893] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 447.595321][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 447.828709][T15895] syzkaller1: entered promiscuous mode [ 447.859834][T15895] syzkaller1: entered allmulticast mode [ 448.135911][T15900] lo speed is unknown, defaulting to 1000 [ 448.282535][T15899] lo speed is unknown, defaulting to 1000 [ 448.311106][T15915] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2743'. [ 448.407216][T15913] can: request_module (can-proto-0) failed. [ 448.567610][ T5838] Bluetooth: hci2: command tx timeout [ 448.635224][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 448.924301][T15936] sctp: [Deprecated]: syz.4.2748 (pid 15936) Use of int in max_burst socket option. [ 448.924301][T15936] Use struct sctp_assoc_value instead [ 449.667185][T15954] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2754'. [ 449.676722][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 449.732364][T15731] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 449.807352][T15731] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 449.832730][T15731] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 449.867095][T15731] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 449.912709][T15962] lo: left promiscuous mode [ 449.918115][T15962] tunl0: left promiscuous mode [ 449.923415][T15962] gre0: left promiscuous mode [ 449.928960][T15962] gretap0: left promiscuous mode [ 449.940008][T15962] erspan0: left promiscuous mode [ 449.945511][T15962] ip_vti0: left promiscuous mode [ 449.951677][T15962] ip6_vti0: left promiscuous mode [ 449.958749][T15962] sit0: left promiscuous mode [ 449.965251][T15962] ip6tnl0: left promiscuous mode [ 449.975723][T15962] ip6gre0: left promiscuous mode [ 449.981077][T15962] syz_tun: left promiscuous mode [ 449.986854][T15962] ip6gretap0: left promiscuous mode [ 449.993647][T15967] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2757'. [ 450.005638][T15962] bond0: left promiscuous mode [ 450.011532][T15962] nlmon0: left promiscuous mode [ 450.018830][T15962] caif0: left promiscuous mode [ 450.040977][T15962] batadv0: left promiscuous mode [ 450.076387][T15962] veth0: left promiscuous mode [ 450.135001][T15962] veth1: left promiscuous mode [ 450.200791][T15962] wg0: left promiscuous mode [ 450.269703][T15962] wg1: left promiscuous mode [ 450.299119][T15962] wg2: left promiscuous mode [ 450.319370][T15962] veth0_to_bridge: left promiscuous mode [ 450.364651][T15962] veth0_to_bond: left promiscuous mode [ 450.381112][T15962] bond_slave_0: left promiscuous mode [ 450.387803][T15962] veth1_to_bond: left promiscuous mode [ 450.393623][T15962] bond_slave_1: left promiscuous mode [ 450.400690][T15962] veth0_to_team: left promiscuous mode [ 450.422340][T15962] team_slave_0: left promiscuous mode [ 450.428266][T15962] veth1_to_team: left promiscuous mode [ 450.434076][T15962] team_slave_1: left promiscuous mode [ 450.448932][T15962] veth0_to_batadv: left promiscuous mode [ 450.459843][T15962] batadv_slave_0: left promiscuous mode [ 450.468634][T15962] veth1_to_batadv: left promiscuous mode [ 450.482811][T15962] xfrm0: left promiscuous mode [ 450.490643][T15962] veth0_to_hsr: left promiscuous mode [ 450.497876][T15962] hsr_slave_0: left promiscuous mode [ 450.503764][T15962] veth1_to_hsr: left promiscuous mode [ 450.510032][T15962] hsr_slave_1: left promiscuous mode [ 450.515807][T15962] veth1_virt_wifi: left promiscuous mode [ 450.522729][T15962] veth0_virt_wifi: left promiscuous mode [ 450.529950][T15962] net veth1_virt_wifi virt_wifi0: left promiscuous mode [ 450.549995][T15962] vlan0: left promiscuous mode [ 450.576285][T15962] vlan1: left promiscuous mode [ 450.582172][T15962] macvlan0: left promiscuous mode [ 450.587851][T15962] macvlan1: left promiscuous mode [ 450.593834][T15962] ipvlan0: left promiscuous mode [ 450.599657][T15962] ipvlan1: left promiscuous mode [ 450.605678][T15962] macvtap0: left promiscuous mode [ 450.610988][T15962] macsec0: left promiscuous mode [ 450.625191][T15962] geneve0: left promiscuous mode [ 450.630635][T15962] geneve1: left promiscuous mode [ 450.638548][T15962] mac80211_hwsim hwsim10 wlan0: left promiscuous mode [ 450.646475][T15962] mac80211_hwsim hwsim11 wlan1: left promiscuous mode [ 450.653694][T15962] batadv_slave_1.: left promiscuous mode [ 450.667972][T15962] batadv_slave_1: left promiscuous mode [ 450.681401][T15962] ip6erspan0: left promiscuous mode [ 450.687215][T15962] bond1: left promiscuous mode [ 450.692381][T15962] sit1: left promiscuous mode [ 450.697628][T15962] bond2: left promiscuous mode [ 450.703052][T15962] vxlan0: left promiscuous mode [ 450.708888][T15962] gre1: left promiscuous mode [ 450.714257][T15962] vlan2: left promiscuous mode [ 450.719770][T15962] bridge0: left promiscuous mode [ 450.724953][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 450.734341][T15962] vxlan1: left promiscuous mode [ 450.739964][T15962] netdevsim netdevsim4 eth0: left promiscuous mode [ 450.747759][T15962] netdevsim netdevsim4 eth1: left promiscuous mode [ 450.755573][T15962] netdevsim netdevsim4 eth2: left promiscuous mode [ 450.762468][T15962] netdevsim netdevsim4 eth3: left promiscuous mode [ 450.769522][T15962] bridge1: left promiscuous mode [ 450.775378][T15962] bond3: left promiscuous mode [ 450.780534][T15962] geneve2: left promiscuous mode [ 450.786163][T15962] ipvlan2: left promiscuous mode [ 450.791716][T15962] macsec1: left promiscuous mode [ 450.798101][T15962] bond4: left promiscuous mode [ 450.803205][T15962] vti60: left promiscuous mode [ 450.809295][T15962] syztnl1: left promiscuous mode [ 450.814650][T15962] gtp0: left promiscuous mode [ 450.819947][T15962] veth2: left promiscuous mode [ 450.826173][T15962] veth3: left promiscuous mode [ 450.831636][T15962] mac80211_hwsim hwsim42 wlan2: left promiscuous mode [ 450.838953][T15962] veth4: left promiscuous mode [ 450.844157][T15962] veth5: left promiscuous mode [ 450.849385][T15962] mac80211_hwsim hwsim50 wlan3: left promiscuous mode [ 451.018344][T15989] netlink: 'syz.3.2763': attribute type 8 has an invalid length. [ 451.134739][T15731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 451.202110][T15731] 8021q: adding VLAN 0 to HW filter on device team0 [ 451.237242][ T3500] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.244567][ T3500] bridge0: port 1(bridge_slave_0) entered forwarding state [ 451.264367][T15996] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2765'. [ 451.292054][ T3500] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.299348][ T3500] bridge0: port 2(bridge_slave_1) entered forwarding state [ 451.518688][T16009] netlink: 'syz.3.2768': attribute type 12 has an invalid length. [ 451.550789][T16009] netlink: 'syz.3.2768': attribute type 12 has an invalid length. [ 451.593136][T16009] netlink: 'syz.3.2768': attribute type 12 has an invalid length. [ 451.698175][T16009] batman_adv: batadv0: Adding interface: ip6gretap4 [ 451.724102][T16009] batman_adv: batadv0: The MTU of interface ip6gretap4 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.756829][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 451.775848][T16009] batman_adv: batadv0: Interface activated: ip6gretap4 [ 452.104579][T15731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 452.127977][T16020] netlink: 'syz.2.2771': attribute type 1 has an invalid length. [ 452.145895][T16029] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 452.165199][T16020] nbd: error processing sock list [ 452.170862][T16020] block nbd1: shutting down sockets [ 452.241709][T16031] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 452.276094][T15731] veth0_vlan: entered promiscuous mode [ 452.311255][T15731] veth1_vlan: entered promiscuous mode [ 452.335609][T16033] netlink: 'syz.4.2776': attribute type 2 has an invalid length. [ 452.368799][T16033] netlink: 'syz.4.2776': attribute type 2 has an invalid length. [ 452.447304][T15731] veth0_macvtap: entered promiscuous mode [ 452.489885][T15731] veth1_macvtap: entered promiscuous mode [ 452.597076][T15731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 452.688201][T15731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 452.753030][T15731] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.781487][T15731] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.795098][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 452.806513][T15731] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.832615][T15731] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.847866][T16057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2783'. [ 452.877173][T16057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2783'. [ 452.926563][T16059] netlink: 512 bytes leftover after parsing attributes in process `syz.2.2785'. [ 453.079628][T16064] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2786'. [ 453.093139][T16064] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.103119][T16064] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.114442][T16064] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.125892][T16064] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.147660][T16064] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2786'. [ 453.242126][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.271014][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 453.351614][ T8551] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.383933][ T8551] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 453.783061][T16083] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2792'. [ 453.835228][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 454.082631][T16077] infiniband syz2: set down [ 454.114079][T16077] infiniband syz2: added team_slave_0 [ 454.388359][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.389863][T16077] RDS/IB: syz2: added [ 454.445198][T16077] smc: adding ib device syz2 with port count 1 [ 454.463619][T16077] smc: ib device syz2 port 1 has pnetid [ 454.666218][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.838108][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.875028][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 455.007343][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.057501][ T5840] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 455.069714][ T5840] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 455.078461][ T5840] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 455.094463][ T5840] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 455.110452][ T5840] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 455.215100][ T13] bridge_slave_1: left allmulticast mode [ 455.221254][ T13] bridge_slave_1: left promiscuous mode [ 455.228553][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.250193][ T13] bridge_slave_0: left allmulticast mode [ 455.256387][ T13] bridge_slave_0: left promiscuous mode [ 455.262273][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.631737][T16095] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2795'. [ 455.825944][T16101] netlink: 'syz.1.2795': attribute type 5 has an invalid length. [ 455.834544][T16101] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2795'. [ 455.915673][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 456.036159][T16103] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2797'. [ 456.070411][T16103] netlink: 'syz.2.2797': attribute type 12 has an invalid length. [ 456.240680][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 456.252436][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 456.263954][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 456.284451][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 456.288550][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 456.301485][ T5838] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 456.332482][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 456.345471][ T13] bond0 (unregistering): Released all slaves [ 456.438105][T16089] lo speed is unknown, defaulting to 1000 [ 456.493032][T16109] lo speed is unknown, defaulting to 1000 [ 456.717958][T16116] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 456.754197][T16114] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 456.848695][T16116] IPVS: Error connecting to the multicast addr [ 456.965090][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 457.195764][ T5840] Bluetooth: hci2: command tx timeout [ 457.517170][T16136] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2806'. [ 457.624343][T16138] FAULT_INJECTION: forcing a failure. [ 457.624343][T16138] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 457.666128][T16138] CPU: 0 UID: 0 PID: 16138 Comm: syz.2.2807 Not tainted 6.15.0-rc6-syzkaller-01215-ga8ae8a0e848e #0 PREEMPT(full) [ 457.666161][T16138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 457.666176][T16138] Call Trace: [ 457.666185][T16138] [ 457.666194][T16138] dump_stack_lvl+0x189/0x250 [ 457.666230][T16138] ? __lock_acquire+0xaac/0xd20 [ 457.666265][T16138] ? __pfx_dump_stack_lvl+0x10/0x10 [ 457.666296][T16138] ? __pfx__printk+0x10/0x10 [ 457.666318][T16138] ? __might_fault+0xb0/0x130 [ 457.666361][T16138] should_fail_ex+0x414/0x560 [ 457.666390][T16138] _copy_from_user+0x2d/0xb0 [ 457.666423][T16138] vmemdup_user+0x59/0xd0 [ 457.666447][T16138] map_get_next_key+0x1be/0x5f0 [ 457.666477][T16138] ? bpf_lsm_bpf+0x9/0x20 [ 457.666505][T16138] ? security_bpf+0x7e/0x300 [ 457.666532][T16138] __sys_bpf+0x7bf/0x860 [ 457.666563][T16138] ? __pfx___sys_bpf+0x10/0x10 [ 457.666606][T16138] ? ksys_write+0x1f0/0x250 [ 457.666630][T16138] ? rcu_is_watching+0x15/0xb0 [ 457.666663][T16138] __x64_sys_bpf+0x7c/0x90 [ 457.666689][T16138] do_syscall_64+0xf6/0x210 [ 457.666716][T16138] ? clear_bhb_loop+0x60/0xb0 [ 457.666742][T16138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.666763][T16138] RIP: 0033:0x7fc5e418e969 [ 457.666791][T16138] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 457.666810][T16138] RSP: 002b:00007fc5e4fcb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 457.666833][T16138] RAX: ffffffffffffffda RBX: 00007fc5e43b5fa0 RCX: 00007fc5e418e969 [ 457.666848][T16138] RDX: 0000000000000020 RSI: 0000200000000180 RDI: 0000000000000004 [ 457.666861][T16138] RBP: 00007fc5e4fcb090 R08: 0000000000000000 R09: 0000000000000000 [ 457.666874][T16138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 457.666886][T16138] R13: 0000000000000000 R14: 00007fc5e43b5fa0 R15: 00007fff67b28008 [ 457.666920][T16138] [ 457.995148][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 458.226238][T16149] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2810'. [ 458.397857][ T5840] Bluetooth: hci4: command tx timeout [ 458.428570][T16152] xt_NFQUEUE: number of total queues is 0 [ 458.457601][T16152] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2811'. [ 458.517880][T16152] netlink: 'syz.2.2811': attribute type 1 has an invalid length. [ 458.553963][T16089] chnl_net:caif_netlink_parms(): no params data found [ 458.732718][T16166] netlink: 'syz.2.2815': attribute type 10 has an invalid length. [ 458.741344][T16166] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2815'. [ 458.786183][T16166] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.800017][T16166] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.809577][T16166] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.828220][T16166] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.849630][T16166] geneve0: entered promiscuous mode [ 458.863218][T16166] team0: Port device geneve0 added [ 459.035363][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 459.127494][T16175] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2817'. [ 459.230086][T16089] bridge0: port 1(bridge_slave_0) entered blocking state [ 459.243188][T16089] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.251097][T16089] bridge_slave_0: entered allmulticast mode [ 459.261595][T16089] bridge_slave_0: entered promiscuous mode [ 459.272296][T16089] bridge0: port 2(bridge_slave_1) entered blocking state [ 459.280388][ T5840] Bluetooth: hci2: command tx timeout [ 459.280970][T16089] bridge0: port 2(bridge_slave_1) entered disabled state [ 459.305489][T16089] bridge_slave_1: entered allmulticast mode [ 459.321739][T16089] bridge_slave_1: entered promiscuous mode [ 459.600412][T16089] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 459.631945][T16089] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 459.758965][T16089] team0: Port device team_slave_0 added [ 459.786321][T16089] team0: Port device team_slave_1 added [ 460.075447][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 460.246900][T16185] netlink: 'syz.4.2819': attribute type 6 has an invalid length. [ 460.367668][T16164] lo speed is unknown, defaulting to 1000 [ 460.416568][ T13] hsr_slave_0: left promiscuous mode [ 460.432133][ T13] hsr_slave_1: left promiscuous mode [ 460.442637][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.451433][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.461159][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.469058][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.490476][ T5840] Bluetooth: hci4: command tx timeout [ 460.519167][ T13] veth1_macvtap: left promiscuous mode [ 460.526085][ T13] veth0_macvtap: left promiscuous mode [ 460.532133][ T13] veth1_vlan: left promiscuous mode [ 460.537890][ T13] veth0_vlan: left promiscuous mode [ 461.120830][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 461.255879][ T13] team0 (unregistering): Port device team_slave_1 removed [ 461.299064][ T13] team0 (unregistering): Port device team_slave_0 removed [ 461.365210][ T5840] Bluetooth: hci2: command tx timeout [ 461.801363][T16089] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 461.809218][T16089] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 461.841179][T16089] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 461.903392][T16089] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 461.931231][T16089] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 462.005378][T16089] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 462.145405][T16109] chnl_net:caif_netlink_parms(): no params data found [ 462.165130][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 462.302148][T16089] hsr_slave_0: entered promiscuous mode [ 462.338936][T16089] hsr_slave_1: entered promiscuous mode [ 462.353783][T16089] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 462.362962][T16089] Cannot create hsr debugfs directory [ 462.565940][ T5840] Bluetooth: hci4: command tx timeout [ 462.774474][T16109] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.787308][T16109] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.794691][T16109] bridge_slave_0: entered allmulticast mode [ 462.815799][T16109] bridge_slave_0: entered promiscuous mode [ 462.827290][T16109] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.836255][T16109] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.843552][T16109] bridge_slave_1: entered allmulticast mode [ 462.851726][T16109] bridge_slave_1: entered promiscuous mode [ 462.973093][T16214] IPVS: set_ctl: invalid protocol: 59 172.20.20.170:20004 [ 463.036657][T16109] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 463.052313][T16109] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 463.079004][T16216] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2825'. [ 463.157202][T16109] team0: Port device team_slave_0 added [ 463.200570][T16109] team0: Port device team_slave_1 added [ 463.206266][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 463.290351][T16221] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2827'. [ 463.317873][T16109] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 463.333346][T16109] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 463.365033][T16223] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2828'. [ 463.383240][T16109] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 463.442878][ T5840] Bluetooth: hci2: command tx timeout [ 463.507571][T16109] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 463.538153][T16109] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 463.565834][T16232] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2829'. [ 463.582934][T16109] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.583199][T16234] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2831'. [ 463.624695][T16234] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2831'. [ 463.741906][T16109] hsr_slave_0: entered promiscuous mode [ 463.767480][T16109] hsr_slave_1: entered promiscuous mode [ 463.784087][T16109] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 463.872422][T16109] Cannot create hsr debugfs directory [ 464.235139][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 464.645181][ T5840] Bluetooth: hci4: command tx timeout [ 464.669468][T16089] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 464.707333][T16089] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 464.749091][T16089] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 464.756022][T16256] lo speed is unknown, defaulting to 1000 [ 464.770320][T16089] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 465.274930][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 465.320073][T16089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.417473][T16089] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.450821][ T8557] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 465.460076][ T8557] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 465.472156][T16268] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 465.496532][T16269] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 465.517887][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.525358][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.574083][ T3500] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.581528][ T3500] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.689951][T16109] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 465.737914][T16109] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 465.783375][T16109] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 465.808524][T16109] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 466.113147][T16109] 8021q: adding VLAN 0 to HW filter on device bond0 [ 466.214031][T16109] 8021q: adding VLAN 0 to HW filter on device team0 [ 466.261899][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 466.269163][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 466.315280][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 466.409070][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.416302][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.491446][T16089] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.651259][T16089] veth0_vlan: entered promiscuous mode [ 466.692119][T16089] veth1_vlan: entered promiscuous mode [ 466.788042][T16089] veth0_macvtap: entered promiscuous mode [ 466.830191][T16089] veth1_macvtap: entered promiscuous mode [ 466.876933][T16089] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 466.907779][T16089] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.930414][T16089] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.944604][T16089] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.956054][T16089] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.964918][T16089] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.049726][T16109] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 467.269113][ T1303] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.300313][ T1303] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.329099][T16109] veth0_vlan: entered promiscuous mode [ 467.355208][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 467.447387][T16298] lo speed is unknown, defaulting to 1000 [ 467.448364][T16109] veth1_vlan: entered promiscuous mode [ 467.502307][ T3500] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.543874][ T3500] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.777908][T16109] veth0_macvtap: entered promiscuous mode [ 467.828324][T16109] veth1_macvtap: entered promiscuous mode [ 467.947335][T16109] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 467.988370][T16109] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 468.044218][T16109] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.076954][T16109] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.097896][T16109] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.125081][T16109] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.151852][T16319] xt_cluster: node mask cannot exceed total number of nodes [ 468.395228][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 469.132796][T16335] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2852'. [ 469.444903][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 469.489766][T16342] syz.2.2853 uses old SIOCAX25GETINFO [ 469.524413][T16321] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2849'. [ 469.551427][T16321] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2849'. [ 469.579799][T16321] netlink: 'syz.3.2849': attribute type 13 has an invalid length. [ 469.594287][T16324] lo speed is unknown, defaulting to 1000 [ 469.615282][T16345] netlink: 165 bytes leftover after parsing attributes in process `syz.1.2855'. [ 469.623652][T16338] netlink: 42 bytes leftover after parsing attributes in process `syz.2.2853'. [ 469.638856][T16345] netlink: 277 bytes leftover after parsing attributes in process `syz.1.2855'. [ 469.646768][T16338] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2853'. [ 469.734504][T16342] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2853'. [ 469.749309][T16342] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 469.882595][ T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 469.912160][ T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 470.028631][T16356] netlink: 277 bytes leftover after parsing attributes in process `syz.1.2856'. [ 470.048113][ T3459] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 470.060711][ T3459] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 470.403126][T16364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2857'. [ 470.475416][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 470.695078][ T30] audit: type=1800 audit(1747708448.258:10): pid=16378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2859" name="memory.events" dev="tmpfs" ino=3311 res=0 errno=0 [ 470.764592][ T30] audit: type=1804 audit(1747708448.328:11): pid=16378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2859" name="memory.events" dev="tmpfs" ino=3311 res=1 errno=0 [ 471.502303][T16384] netlink: 'syz.4.2861': attribute type 21 has an invalid length. [ 471.524891][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 471.798243][T16389] netlink: 'syz.2.2863': attribute type 9 has an invalid length. [ 471.836336][ T5838] Bluetooth: hci4: command 0x0405 tx timeout [ 472.251035][ T3500] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.454298][ T3500] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.565251][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 472.648675][ T3500] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.767764][ T3500] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.863464][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 472.872652][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 472.881592][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 472.889824][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 472.901937][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 472.984477][ T3500] bridge_slave_1: left allmulticast mode [ 472.990286][ T3500] bridge_slave_1: left promiscuous mode [ 472.996673][ T3500] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.006055][ T3500] bridge_slave_0: left allmulticast mode [ 473.011708][ T3500] bridge_slave_0: left promiscuous mode [ 473.017965][ T3500] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.391753][ T3500] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 473.403588][ T3500] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 473.414574][ T3500] bond0 (unregistering): Released all slaves [ 473.438513][T16411] lo speed is unknown, defaulting to 1000 [ 473.594922][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 474.148743][ T3500] hsr_slave_0: left promiscuous mode [ 474.187214][ T3500] hsr_slave_1: left promiscuous mode [ 474.203403][ T3500] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 474.227609][ T3500] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 474.247461][ T3500] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 474.264280][ T3500] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 474.334008][ T3500] veth1_macvtap: left promiscuous mode [ 474.343321][ T3500] veth0_macvtap: left promiscuous mode [ 474.349743][ T3500] veth1_vlan: left promiscuous mode [ 474.360077][ T3500] veth0_vlan: left promiscuous mode [ 474.500007][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 474.511159][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 474.521123][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 474.532222][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 474.541717][ T5838] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 474.645652][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 474.955469][ T5840] Bluetooth: hci0: command tx timeout [ 475.255306][ T3500] team0 (unregistering): Port device team_slave_1 removed [ 475.302307][ T3500] team0 (unregistering): Port device team_slave_0 removed [ 475.675523][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 475.805678][T16432] vxcan7: entered allmulticast mode [ 475.813590][T16430] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2871'. [ 475.831910][T16411] chnl_net:caif_netlink_parms(): no params data found [ 476.060824][T16436] lo speed is unknown, defaulting to 1000 [ 476.113421][T16411] bridge0: port 1(bridge_slave_0) entered blocking state [ 476.137353][T16411] bridge0: port 1(bridge_slave_0) entered disabled state [ 476.145267][T16411] bridge_slave_0: entered allmulticast mode [ 476.153312][T16411] bridge_slave_0: entered promiscuous mode [ 476.204991][T16411] bridge0: port 2(bridge_slave_1) entered blocking state [ 476.225347][T16411] bridge0: port 2(bridge_slave_1) entered disabled state [ 476.245455][T16411] bridge_slave_1: entered allmulticast mode [ 476.277145][T16411] bridge_slave_1: entered promiscuous mode [ 476.525399][T16468] netlink: 'syz.4.2882': attribute type 7 has an invalid length. [ 476.533772][T16411] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 476.579968][T16464] bridge_slave_0: left allmulticast mode [ 476.595812][T16464] bridge_slave_0: left promiscuous mode [ 476.601767][T16464] bridge0: port 1(bridge_slave_0) entered disabled state [ 476.613726][T16464] bridge_slave_1: left allmulticast mode [ 476.629040][T16464] bridge_slave_1: left promiscuous mode [ 476.635085][ T5840] Bluetooth: hci4: command tx timeout [ 476.639435][T16464] bridge0: port 2(bridge_slave_1) entered disabled state [ 476.669833][T16464] bond0: (slave bond_slave_0): Releasing backup interface [ 476.698734][T16464] bond0: (slave bond_slave_1): Releasing backup interface [ 476.715443][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 476.751308][T16464] team0: Port device team_slave_0 removed [ 476.769918][T16464] team0: Port device team_slave_1 removed [ 476.777223][T16464] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 476.784693][T16464] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 476.794622][T16464] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 476.802500][T16464] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 476.826961][T16411] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 476.931093][T16460] lo speed is unknown, defaulting to 1000 [ 476.956134][T16472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 476.989699][T16474] netlink: 'syz.4.2883': attribute type 9 has an invalid length. [ 477.035471][ T5840] Bluetooth: hci0: command tx timeout [ 477.139473][T16411] team0: Port device team_slave_0 added [ 477.152570][T16411] team0: Port device team_slave_1 added [ 477.290325][T16411] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 477.305623][T16411] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 477.361231][T16411] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 477.404012][T16411] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 477.421745][T16411] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 477.458296][T16411] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 477.674252][T16411] hsr_slave_0: entered promiscuous mode [ 477.684301][T16411] hsr_slave_1: entered promiscuous mode [ 477.699978][T16411] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 477.713757][T16411] Cannot create hsr debugfs directory [ 477.754980][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 477.827128][T16493] netlink: 4516 bytes leftover after parsing attributes in process `syz.3.2888'. [ 477.930105][T16489] netlink: 1084 bytes leftover after parsing attributes in process `syz.3.2888'. [ 478.145611][T16500] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2891'. [ 478.276267][T16500] batadv0: entered promiscuous mode [ 478.282147][T16500] macsec1: entered allmulticast mode [ 478.307326][T16500] batadv0: entered allmulticast mode [ 478.344142][T16500] batadv0: left allmulticast mode [ 478.364972][T16500] batadv0: left promiscuous mode [ 478.372719][T16506] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 478.450890][T16436] chnl_net:caif_netlink_parms(): no params data found [ 478.468935][T16507] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2892'. [ 478.716799][ T5838] Bluetooth: hci4: command tx timeout [ 478.787836][T16506] lo speed is unknown, defaulting to 1000 [ 478.795396][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 479.080824][T16436] bridge0: port 1(bridge_slave_0) entered blocking state [ 479.096792][T16436] bridge0: port 1(bridge_slave_0) entered disabled state [ 479.111341][T16436] bridge_slave_0: entered allmulticast mode [ 479.118487][ T5838] Bluetooth: hci0: command tx timeout [ 479.133488][T16436] bridge_slave_0: entered promiscuous mode [ 479.188000][T16436] bridge0: port 2(bridge_slave_1) entered blocking state [ 479.207424][T16436] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.214724][T16436] bridge_slave_1: entered allmulticast mode [ 479.277624][T16436] bridge_slave_1: entered promiscuous mode [ 479.616279][T16535] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2898'. [ 479.628269][T16535] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2898'. [ 479.637676][T16535] netlink: 'syz.3.2898': attribute type 7 has an invalid length. [ 479.645591][T16535] netlink: 'syz.3.2898': attribute type 8 has an invalid length. [ 479.653459][T16535] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2898'. [ 479.834889][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 479.907745][ T3500] erspan0 (unregistering): left promiscuous mode [ 479.932120][ T3500] gretap0 (unregistering): left promiscuous mode [ 479.979194][ T3500] bond4 (unregistering): (slave gretap1): Releasing active interface [ 480.427847][ T3500] bond0 (unregistering): Released all slaves [ 480.445397][ T3500] bond1 (unregistering): Released all slaves [ 480.559050][ T3500] bond2 (unregistering): Released all slaves [ 480.664502][ T3500] bond3 (unregistering): Released all slaves [ 480.771993][ T3500] bond4 (unregistering): Released all slaves [ 480.787913][ T3500] bond5 (unregistering): Released all slaves [ 480.798058][ T5838] Bluetooth: hci4: command 0x040f tx timeout [ 480.842397][T16436] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 480.851726][T16532] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2897'. [ 480.885387][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 481.195248][ T5840] Bluetooth: hci0: command tx timeout [ 481.308186][T16548] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 481.591631][T16539] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.601414][T16539] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.611326][T16539] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.620815][T16539] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.691903][T16436] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 481.705816][ T3500] tipc: Disabling bearer [ 481.729112][ T3500] tipc: Left network mode [ 481.860566][ T3500] IPVS: stopping backup sync thread 12919 ... [ 481.924998][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 482.013436][T16552] netlink: 'syz.3.2902': attribute type 4 has an invalid length. [ 482.094078][T16436] team0: Port device team_slave_0 added [ 482.133509][T16436] team0: Port device team_slave_1 added [ 482.166298][T16557] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 482.308346][T16436] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 482.335006][T16436] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 482.392560][T16436] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 482.420293][T16436] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 482.437934][T16436] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 482.473538][T16436] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 482.680241][T16436] hsr_slave_0: entered promiscuous mode [ 482.698023][T16436] hsr_slave_1: entered promiscuous mode [ 482.704614][T16436] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 482.712560][T16436] Cannot create hsr debugfs directory [ 482.747786][T16568] syz_tun: left promiscuous mode [ 482.759011][T16568] team0: Port device syz_tun removed [ 482.771529][T16568] bond0: (slave bond_slave_0): Releasing backup interface [ 482.781728][T16568] bond0: (slave bond_slave_1): Releasing backup interface [ 482.791441][T16568] C: left promiscuous mode [ 482.800506][T16568] team0: Port device C removed [ 482.806582][T16568] team_slave_1: left promiscuous mode [ 482.816013][T16568] team0: Port device team_slave_1 removed [ 482.822705][T16568] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 482.832816][T16568] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 482.842605][T16568] geneve0: left promiscuous mode [ 482.849053][T16568] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.857846][T16568] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.866675][T16568] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.875497][ T5840] Bluetooth: hci4: command 0x040f tx timeout [ 482.881644][T16568] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.895767][T16568] team0: Port device geneve0 removed [ 482.902087][T16568] batman_adv: batadv0: Removing interface: ip6gretap2 [ 482.909930][T16568] batman_adv: batadv0: Removing interface: ip6gretap3 [ 482.919632][T16568] bond1: (slave vcan1): Releasing backup interface [ 482.927611][T16568] bond1: (slave vcan2): making interface the new active one [ 482.939793][T16568] bond1: (slave vcan2): Releasing backup interface [ 482.948343][T16568] batman_adv: batadv0: Removing interface: vxlan1 [ 482.955266][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 483.030538][T16411] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 483.042070][T16411] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 483.089581][T16411] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 483.194272][T16411] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 483.436792][ T3500] hsr_slave_0: left promiscuous mode [ 483.594523][T16581] siw: device registration error -23 [ 483.621475][T16581] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2911'. [ 483.737946][T16582] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2910'. [ 483.800651][T16588] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2910'. [ 483.995032][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 484.753699][T16591] wg1: left promiscuous mode [ 484.761029][T16591] wg1: left allmulticast mode [ 484.766060][T16591] wg2: left allmulticast mode [ 484.773543][T16591] veth0_to_bond: left allmulticast mode [ 484.801065][T16591] bridge2: left promiscuous mode [ 484.806387][T16591] bridge2: left allmulticast mode [ 484.811637][T16591] ip6erspan0: left promiscuous mode [ 484.821915][T16591] vxcan7: left allmulticast mode [ 484.873404][T16597] Cannot find del_set index 1 as target [ 484.965164][ T5840] Bluetooth: hci4: command 0x040f tx timeout [ 485.038736][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 485.049581][T16601] netlink: 'syz.3.2916': attribute type 27 has an invalid length. [ 485.092936][T16600] vlan0: entered allmulticast mode [ 485.141976][T16600] macvtap0: entered allmulticast mode [ 485.274005][ T3500] IPVS: stop unused estimator thread 0... [ 485.373742][T16607] veth3: entered promiscuous mode [ 485.434164][T16613] netlink: 'syz.2.2919': attribute type 10 has an invalid length. [ 485.447895][T16613] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2919'. [ 485.480862][T16614] sctp: [Deprecated]: syz.2.2919 (pid 16614) Use of int in max_burst socket option. [ 485.480862][T16614] Use struct sctp_assoc_value instead [ 485.561475][T16411] 8021q: adding VLAN 0 to HW filter on device bond0 [ 485.587466][T16611] lo speed is unknown, defaulting to 1000 [ 485.644529][T16411] 8021q: adding VLAN 0 to HW filter on device team0 [ 485.697836][ T24] IPVS: starting estimator thread 0... [ 485.713294][ T3459] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.720572][ T3459] bridge0: port 1(bridge_slave_0) entered forwarding state [ 485.791603][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.798875][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 485.805338][T16620] IPVS: using max 24 ests per chain, 57600 per kthread [ 486.074984][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 486.506978][T16436] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 486.570495][T16436] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 486.589179][T16436] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 486.787836][T16436] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 487.116268][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 487.405157][T16650] batadv_slave_0: entered promiscuous mode [ 487.471299][T16411] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 487.500682][T16436] 8021q: adding VLAN 0 to HW filter on device bond0 [ 487.563261][T16436] 8021q: adding VLAN 0 to HW filter on device team0 [ 487.581910][T16652] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2928'. [ 487.633487][T16652] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 487.647891][ T3459] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.655121][ T3459] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.725697][ T3500] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.732950][ T3500] bridge0: port 2(bridge_slave_1) entered forwarding state [ 487.919485][T16660] 8021q: adding VLAN 0 to HW filter on device bond6 [ 487.927537][T16660] bridge0: port 2(bond6) entered blocking state [ 487.934058][T16660] bridge0: port 2(bond6) entered disabled state [ 487.941054][T16660] bond6: entered allmulticast mode [ 487.949312][T16660] bond6: entered promiscuous mode [ 488.016217][T16411] veth0_vlan: entered promiscuous mode [ 488.054354][T16411] veth1_vlan: entered promiscuous mode [ 488.079808][T16436] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 488.143543][T16411] veth0_macvtap: entered promiscuous mode [ 488.155394][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 488.170305][T16411] veth1_macvtap: entered promiscuous mode [ 488.235952][T16675] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2935'. [ 488.412170][T16411] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 488.574552][T16411] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 488.609219][T16411] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.637979][T16411] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.660517][T16411] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.671485][T16411] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.701093][T16682] batadv1: entered promiscuous mode [ 488.984493][T16436] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 489.205270][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 489.263039][T16689] (unnamed net_device) (uninitialized): option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 489.288668][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 489.302113][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 489.466664][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 489.474542][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 489.483820][T16436] veth0_vlan: entered promiscuous mode [ 489.542343][T16436] veth1_vlan: entered promiscuous mode [ 489.654874][T16436] veth0_macvtap: entered promiscuous mode [ 489.663320][T16687] netlink: 'syz.2.2938': attribute type 303 has an invalid length. [ 489.701564][T16436] veth1_macvtap: entered promiscuous mode [ 489.709242][T16687] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2938'. [ 489.934454][T16436] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 489.964030][T16707] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2870'. [ 489.976660][T16436] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 489.994170][T16436] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.024885][T16436] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.052787][T16436] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.070552][T16436] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.235044][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 490.505857][T16730] block nbd1: server does not support multiple connections per device. [ 490.542743][T16730] block nbd1: shutting down sockets [ 490.617531][T16736] netlink: 'syz.1.2948': attribute type 4 has an invalid length. [ 490.627996][T16735] syzkaller0: entered promiscuous mode [ 490.643461][T16735] syzkaller0: entered allmulticast mode [ 490.684531][T16738] netlink: 'syz.4.2949': attribute type 1 has an invalid length. [ 490.697159][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.710937][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.924448][ T8551] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.952951][ T8551] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.072445][T16741] lo speed is unknown, defaulting to 1000 [ 491.128037][T16753] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2954'. [ 491.172663][T16755] mac80211_hwsim hwsim61 wlan0: entered promiscuous mode [ 491.212724][T16755] macvtap1: entered allmulticast mode [ 491.241310][T16755] mac80211_hwsim hwsim61 wlan0: entered allmulticast mode [ 491.275203][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 491.278161][T16755] batman_adv: batadv0: Adding interface: macvtap1 [ 491.284358][T16758] netlink: 'syz.2.2955': attribute type 30 has an invalid length. [ 491.310337][T16755] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 491.344409][T16760] netlink: 'syz.4.2956': attribute type 10 has an invalid length. [ 491.353119][T16755] batman_adv: batadv0: Interface activated: macvtap1 [ 491.749893][ T8557] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.873345][T16768] lo speed is unknown, defaulting to 1000 [ 492.032337][ T8557] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 492.169165][ T8557] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 492.312311][ T8557] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 492.322955][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 492.701837][ T8557] bridge_slave_1: left allmulticast mode [ 492.710510][ T8557] bridge_slave_1: left promiscuous mode [ 492.733318][ T8557] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.744716][ T8557] bridge_slave_0: left allmulticast mode [ 492.765142][ T8557] bridge_slave_0: left promiscuous mode [ 492.771098][ T8557] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.329046][ T8557] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 493.365095][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 493.366008][ T8557] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 493.409563][ T8557] bond0 (unregistering): Released all slaves [ 493.451463][T16785] xt_bpf: check failed: parse error [ 493.562099][T16778] lo speed is unknown, defaulting to 1000 [ 493.983764][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 493.997235][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 494.009192][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 494.018430][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 494.026941][ T5838] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 494.286911][T16797] lo speed is unknown, defaulting to 1000 [ 494.394886][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 494.756796][ T8557] hsr_slave_0: left promiscuous mode [ 494.825355][ T8557] hsr_slave_1: left promiscuous mode [ 494.835602][ T8557] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 494.843086][ T8557] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 494.885962][ T8557] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 494.894748][ T8557] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 495.009438][ T8557] veth1_macvtap: left promiscuous mode [ 495.021591][ T8557] veth0_macvtap: left promiscuous mode [ 495.034598][ T8557] veth1_vlan: left promiscuous mode [ 495.047230][ T8557] veth0_vlan: left promiscuous mode [ 495.145393][T16819] netlink: 'syz.2.2970': attribute type 1 has an invalid length. [ 495.435154][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 495.963411][ T8557] team0 (unregistering): Port device team_slave_1 removed [ 496.012528][ T8557] team0 (unregistering): Port device team_slave_0 removed [ 496.075923][ T5838] Bluetooth: hci4: command tx timeout [ 496.475272][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 496.804748][T16830] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2973'. [ 496.961017][T16837] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2976'. [ 497.467407][T16850] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2980'. [ 497.476644][T16850] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2980'. [ 497.515404][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 497.607428][T16797] chnl_net:caif_netlink_parms(): no params data found [ 497.693431][T16861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2982'. [ 498.106013][T16797] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.124999][T16797] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.139134][T16797] bridge_slave_0: entered allmulticast mode [ 498.161641][T16797] bridge_slave_0: entered promiscuous mode [ 498.166951][ T5838] Bluetooth: hci4: command tx timeout [ 498.199344][T16797] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.239687][T16797] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.254658][T16797] bridge_slave_1: entered allmulticast mode [ 498.288495][T16797] bridge_slave_1: entered promiscuous mode [ 498.304425][T16873] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 498.479821][T16797] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 498.533269][T16797] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 498.555210][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 498.732156][T16797] team0: Port device team_slave_0 added [ 498.783774][T16797] team0: Port device team_slave_1 added [ 498.935203][T16797] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 498.953231][T16797] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 499.019535][T16797] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.058793][T16900] RDS: rds_bind could not find a transport for 100:806:aaaa:aaaa:aaaa:0:20:0, load rds_tcp or rds_rdma? [ 499.073083][T16797] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.083106][T16797] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 499.121355][T16797] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 499.214756][T16911] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'nat' [ 499.273794][T16911] netem: incorrect gi model size [ 499.289878][T16911] netem: change failed [ 499.309589][T16797] hsr_slave_0: entered promiscuous mode [ 499.334146][T16797] hsr_slave_1: entered promiscuous mode [ 499.350790][T16797] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 499.359901][T16797] Cannot create hsr debugfs directory [ 499.504412][T16920] netlink: 'syz.1.3002': attribute type 1 has an invalid length. [ 499.597219][T16918] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 499.605085][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 500.235091][ T5838] Bluetooth: hci4: command tx timeout [ 500.645731][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 501.121930][T16797] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 501.167697][T16797] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 501.276879][T16797] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 501.311538][T16957] netlink: 'syz.4.3013': attribute type 1 has an invalid length. [ 501.320851][T16797] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 501.444038][T16959] bond7: (slave geneve3): Opening slave failed [ 501.528236][T16967] netlink: 'syz.1.3016': attribute type 36 has an invalid length. [ 501.675097][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 501.793243][T16797] 8021q: adding VLAN 0 to HW filter on device bond0 [ 501.835640][T16977] netlink: 'syz.1.3018': attribute type 2 has an invalid length. [ 501.877817][T16977] þ: entered promiscuous mode [ 501.952277][T16797] 8021q: adding VLAN 0 to HW filter on device team0 [ 502.003421][ T8551] bridge0: port 1(bridge_slave_0) entered blocking state [ 502.010669][ T8551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 502.029629][T16985] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3021'. [ 502.063803][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 502.071064][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 502.099665][T16989] Bluetooth: MGMT ver 1.23 [ 502.147447][T16989] netlink: 'syz.2.3023': attribute type 16 has an invalid length. [ 502.180968][T16989] netlink: 'syz.2.3023': attribute type 17 has an invalid length. [ 502.315814][ T5838] Bluetooth: hci4: command tx timeout [ 502.417146][T17000] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3027'. [ 502.445055][T17003] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 502.486269][T17003] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3028'. [ 502.539472][T17003] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 502.715087][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 502.851560][T16797] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 503.037899][T16797] veth0_vlan: entered promiscuous mode [ 503.068653][T16797] veth1_vlan: entered promiscuous mode [ 503.285955][T16797] veth0_macvtap: entered promiscuous mode [ 503.319527][T16797] veth1_macvtap: entered promiscuous mode [ 503.379798][T16797] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 503.398921][T16797] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 503.428691][T16797] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.449483][T16797] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.503583][T16797] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.525424][T16797] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.537081][T17024] sctp: [Deprecated]: syz.2.3033 (pid 17024) Use of struct sctp_assoc_value in delayed_ack socket option. [ 503.537081][T17024] Use struct sctp_sack_info instead [ 503.734129][T17027] netlink: 'syz.4.3034': attribute type 6 has an invalid length. [ 503.762754][T17026] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3034'. [ 503.762763][T17027] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3034'. [ 503.772298][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 503.795105][T17026] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3034'. [ 503.798044][ T3459] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 503.819248][T17029] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3035'. [ 503.845388][ T3459] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 503.913596][T17029] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3035'. [ 503.972184][ T3459] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 503.991678][ T3459] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 504.105314][ T30] audit: type=1800 audit(1747708481.668:12): pid=17037 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3038" name="xffffffffffffffff00000000000000000000003" dev="tmpfs" ino=116 res=0 errno=0 [ 504.191019][T17042] lo speed is unknown, defaulting to 1000 [ 504.251013][T17044] lo speed is unknown, defaulting to 1000 [ 504.281674][T17048] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 504.290737][T17048] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 504.299563][T17048] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 504.308402][T17048] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 504.474526][T17051] tipc: Started in network mode [ 504.480579][T17051] tipc: Node identity , cluster identity 4711 [ 504.487333][T17051] tipc: Failed to obtain node identity [ 504.492860][T17051] tipc: Enabling of bearer rejected, failed to enable media [ 504.608666][T17053] syzkaller1: entered promiscuous mode [ 504.614300][T17053] syzkaller1: entered allmulticast mode [ 504.794902][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 504.949015][ T3459] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.347439][ T3459] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.629464][ T3459] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.833461][ T3459] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.844436][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 506.205618][ T3459] bridge_slave_1: left allmulticast mode [ 506.212335][ T3459] bridge_slave_1: left promiscuous mode [ 506.219818][ T3459] bridge0: port 2(bridge_slave_1) entered disabled state [ 506.232929][ T3459] bridge_slave_0: left allmulticast mode [ 506.251800][ T3459] bridge_slave_0: left promiscuous mode [ 506.257767][ T3459] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.697705][ T3459] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 506.708882][ T3459] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 506.722021][ T3459] bond0 (unregistering): Released all slaves [ 506.884966][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 506.933553][T17072] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 506.945160][ T52] bond0: (slave bond_slave_0): interface is now down [ 506.965388][ T52] bond0: (slave bond_slave_1): interface is now down [ 507.016483][ T13] bond0: (slave bond_slave_0): interface is now down [ 507.024067][ T13] bond0: (slave bond_slave_1): interface is now down [ 507.075079][ T13] bond0: (slave bond_slave_0): interface is now down [ 507.115111][ T13] bond0: (slave bond_slave_1): interface is now down [ 507.166391][ T3500] bond0: (slave bond_slave_0): interface is now down [ 507.173159][ T3500] bond0: (slave bond_slave_1): interface is now down [ 507.228092][ T1303] bond0: (slave bond_slave_0): interface is now down [ 507.236664][ T1303] bond0: (slave bond_slave_1): interface is now down [ 507.255086][ T1303] bond0: (slave bond_slave_0): interface is now down [ 507.291576][ T1303] bond0: (slave bond_slave_1): interface is now down [ 507.327608][ T3500] bond0: (slave bond_slave_0): interface is now down [ 507.354680][ T3500] bond0: (slave bond_slave_1): interface is now down [ 507.374182][ T3500] bond0: now running without any active interface! [ 507.659703][ T5840] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 507.669778][ T5840] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 507.678246][ T5840] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 507.694250][ T5840] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 507.708548][ T5840] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 507.795019][T17119] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3059'. [ 507.915290][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 507.938296][T17109] lo speed is unknown, defaulting to 1000 [ 508.192264][ T3459] hsr_slave_0: left promiscuous mode [ 508.224924][ T3459] hsr_slave_1: left promiscuous mode [ 508.231147][ T3459] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 508.251874][ T3459] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 508.273046][ T3459] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 508.290318][ T3459] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 508.346078][ T3459] veth1_macvtap: left promiscuous mode [ 508.351695][ T3459] veth0_macvtap: left promiscuous mode [ 508.357651][ T3459] veth1_vlan: left promiscuous mode [ 508.363047][ T3459] veth0_vlan: left promiscuous mode [ 508.964881][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 509.054989][ T3459] team0 (unregistering): Port device team_slave_1 removed [ 509.103638][ T3459] team0 (unregistering): Port device team_slave_0 removed [ 509.604660][T17132] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 509.630994][T17132] tipc: Enabled bearer , priority 10 [ 509.658500][T17126] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 49646 - 0 [ 509.676402][T17126] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 49646 - 0 [ 509.684748][T17126] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 49646 - 0 [ 509.709966][T17126] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 49646 - 0 [ 509.735321][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 509.750043][T17126] netdevsim netdevsim4 eth0: set [1, 2] type 2 family 0 port 35917 - 0 [ 509.780990][T17126] netdevsim netdevsim4 eth1: set [1, 2] type 2 family 0 port 35917 - 0 [ 509.813422][T17126] netdevsim netdevsim4 eth2: set [1, 2] type 2 family 0 port 35917 - 0 [ 509.826807][T17126] netdevsim netdevsim4 eth3: set [1, 2] type 2 family 0 port 35917 - 0 [ 509.836804][T17126] geneve3: entered promiscuous mode [ 509.842061][T17126] geneve3: entered allmulticast mode [ 509.854908][ T5840] Bluetooth: hci4: command tx timeout [ 509.905854][T17153] pim6reg: entered allmulticast mode [ 510.005179][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 510.005179][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 510.232908][T17166] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (253) [ 510.303826][T17169] xt_HMARK: proto mask must be zero with L3 mode [ 510.315212][T17163] xt_HMARK: proto mask must be zero with L3 mode [ 510.448797][T17161] lo speed is unknown, defaulting to 1000 [ 510.535025][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 510.555250][T17109] chnl_net:caif_netlink_parms(): no params data found [ 510.697778][ T30] audit: type=1800 audit(1747708488.258:13): pid=17189 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3072" name="memory.events" dev="tmpfs" ino=355 res=0 errno=0 [ 510.772568][T17180] 8021q: adding VLAN 0 to HW filter on device bond1 [ 510.777793][ T30] audit: type=1804 audit(1747708488.298:14): pid=17189 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.3072" name="memory.events" dev="tmpfs" ino=355 res=1 errno=0 [ 511.035223][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 511.265197][T17196] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.280965][T17196] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.405733][T17204] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3077'. [ 511.450625][T17196] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.493444][T17196] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.595123][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 511.637742][T17208] syz_tun: entered allmulticast mode [ 511.646583][T17208] xt_TPROXY: Can be used only with -p tcp or -p udp [ 511.653667][T17208] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3078'. [ 511.715840][T17196] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.735049][T17196] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.765535][T17109] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.772915][T17109] bridge0: port 1(bridge_slave_0) entered disabled state [ 511.781179][T17109] bridge_slave_0: entered allmulticast mode [ 511.791351][T17109] bridge_slave_0: entered promiscuous mode [ 511.807752][T17208] syz_tun (unregistering): left allmulticast mode [ 511.851070][T17196] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.861815][T17196] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.884746][T17109] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.895729][T17109] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.904729][T17109] bridge_slave_1: entered allmulticast mode [ 511.913309][T17109] bridge_slave_1: entered promiscuous mode [ 511.919257][ T5840] Bluetooth: hci4: command tx timeout [ 512.075074][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 512.078486][T17109] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 512.102970][T17219] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3081'. [ 512.115042][T17219] nbd: couldn't find a device at index 0 [ 512.132127][T17222] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 512.162401][T17109] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 512.278952][T17196] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.294180][T17196] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.329864][T17109] team0: Port device team_slave_0 added [ 512.381728][T17196] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.398773][T17228] xt_TCPMSS: Only works on TCP SYN packets [ 512.409336][T17196] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.429316][T17109] team0: Port device team_slave_1 added [ 512.461357][T17231] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 512.473191][T17196] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.482750][T17196] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.537179][T17196] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.545562][T17196] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.593696][T17109] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 512.606519][T17109] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 512.635039][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 512.639530][T17109] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 512.679187][T17109] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 512.689750][T17109] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 512.716493][T17109] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 512.836469][T17109] hsr_slave_0: entered promiscuous mode [ 512.851916][T17109] hsr_slave_1: entered promiscuous mode [ 512.863818][T17109] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 512.872521][T17109] Cannot create hsr debugfs directory [ 513.115020][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 513.193713][T17251] IPVS: set_ctl: invalid protocol: 50 100.1.1.1:20001 [ 513.205119][T17253] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3091'. [ 513.345499][T17253] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3091'. [ 513.350435][T17258] netlink: 'syz.1.3092': attribute type 1 has an invalid length. [ 513.674971][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 513.837350][T17276] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3096'. [ 513.918569][T17279] syzkaller1: entered promiscuous mode [ 513.924102][T17279] syzkaller1: entered allmulticast mode [ 513.996936][ T5840] Bluetooth: hci4: command tx timeout [ 514.155462][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 514.204808][T17109] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 514.227430][T17109] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 514.289254][T17109] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 514.328718][T17109] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 514.453838][T17294] xt_CT: No such helper "pptp" [ 514.532497][T17109] 8021q: adding VLAN 0 to HW filter on device bond0 [ 514.594742][T17109] 8021q: adding VLAN 0 to HW filter on device team0 [ 514.619728][ T1303] bridge0: port 1(bridge_slave_0) entered blocking state [ 514.626990][ T1303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 514.674677][ T1303] bridge0: port 2(bridge_slave_1) entered blocking state [ 514.682026][ T1303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 514.715839][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 515.067484][T17324] pim6reg: entered allmulticast mode [ 515.204860][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 515.240302][T17109] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 515.253068][T17328] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 515.444494][T17330] lo speed is unknown, defaulting to 1000 [ 515.527184][T17109] veth0_vlan: entered promiscuous mode [ 515.605520][T17109] veth1_vlan: entered promiscuous mode [ 515.708824][T17109] veth0_macvtap: entered promiscuous mode [ 515.737377][T17109] veth1_macvtap: entered promiscuous mode [ 515.791403][T17109] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 515.875956][T17109] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 515.905936][T17109] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.933132][T17109] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.957945][T17109] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.972898][T17109] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.993897][T17345] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3119'. [ 516.012084][T17345] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 516.076201][ T5840] Bluetooth: hci4: command tx timeout [ 516.321569][ T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 516.342741][ T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 516.562290][ T3459] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 516.591107][ T3459] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 516.605559][T17357] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3114'. [ 516.985801][T17378] netlink: 'syz.3.3126': attribute type 3 has an invalid length. [ 517.166960][T17384] IPVS: length: 78 != 8 [ 517.277312][T17387] netlink: 'syz.3.3129': attribute type 1 has an invalid length. [ 517.285930][ C0] net_ratelimit: 3 callbacks suppressed [ 517.285950][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 517.395433][T17387] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3129'. [ 517.606711][T17387] x_tables: duplicate underflow at hook 1 [ 517.812804][T17386] lo speed is unknown, defaulting to 1000 [ 517.834999][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 517.987181][T17395] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 518.168256][T17401] vlan2: entered allmulticast mode [ 518.173463][T17401] mac80211_hwsim hwsim57 wlan0: entered allmulticast mode [ 518.315095][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 518.874993][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 518.900428][ T8551] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 518.994602][ T8551] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.055104][ T8551] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.129814][ T8551] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.250535][ T8551] bridge_slave_1: left allmulticast mode [ 519.256329][ T8551] bridge_slave_1: left promiscuous mode [ 519.262116][ T8551] bridge0: port 2(bridge_slave_1) entered disabled state [ 519.271537][ T8551] bridge_slave_0: left allmulticast mode [ 519.277924][ T8551] bridge_slave_0: left promiscuous mode [ 519.283742][ T8551] bridge0: port 1(bridge_slave_0) entered disabled state [ 519.354895][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 519.638919][ T8551] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 519.651198][ T8551] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 519.661754][ T8551] bond0 (unregistering): Released all slaves [ 519.914971][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 519.980696][T17407] hsr0: entered promiscuous mode [ 520.015364][T17407] hsr0: entered allmulticast mode [ 520.039558][T17407] hsr_slave_0: entered allmulticast mode [ 520.085924][T17407] hsr_slave_1: entered allmulticast mode [ 520.351944][ T8551] hsr_slave_0: left promiscuous mode [ 520.395051][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 520.415121][ T8551] hsr_slave_1: left promiscuous mode [ 520.421326][ T8551] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 520.495122][ T8551] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 520.512869][ T8551] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 520.540203][T17435] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3139'. [ 520.552733][ T8551] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 520.616242][T17438] netlink: 'syz.4.3140': attribute type 1 has an invalid length. [ 520.659953][ T8551] veth1_macvtap: left promiscuous mode [ 520.672691][ T8551] veth0_macvtap: left promiscuous mode [ 520.684028][ T8551] veth1_vlan: left promiscuous mode [ 520.696567][ T8551] veth0_vlan: left promiscuous mode [ 520.899367][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 520.911721][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 520.920985][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 520.933669][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 520.948588][ T5838] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 520.955091][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 521.445432][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 521.455417][ T8551] team0 (unregistering): Port device team_slave_1 removed [ 521.504497][ T8551] team0 (unregistering): Port device team_slave_0 removed [ 521.930377][T17438] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 522.062696][T17444] lo speed is unknown, defaulting to 1000 [ 522.346917][T17452] xt_hashlimit: max too large, truncated to 1048576 [ 522.353929][T17452] No such timeout policy "syz1" [ 522.475176][ C0] net_ratelimit: 1 callbacks suppressed [ 522.475199][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 522.686630][T17468] Unsupported ieee802154 address type: 0 [ 522.801642][T17471] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3150'. [ 522.932672][T17485] SET target dimension over the limit! [ 522.954208][T17481] netlink: 'syz.2.3153': attribute type 160 has an invalid length. [ 522.984983][T17481] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3153'. [ 523.035036][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 523.043039][ T5840] Bluetooth: hci4: command tx timeout [ 523.259635][T17495] xt_CT: No such helper "pptp" [ 523.316526][T17501] netlink: 'syz.1.3157': attribute type 39 has an invalid length. [ 523.515035][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 523.570886][T17444] chnl_net:caif_netlink_parms(): no params data found [ 523.968458][T17516] xt_CT: No such helper "snmp" [ 524.059442][T17444] bridge0: port 1(bridge_slave_0) entered blocking state [ 524.075019][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 524.084987][T17444] bridge0: port 1(bridge_slave_0) entered disabled state [ 524.092295][T17444] bridge_slave_0: entered allmulticast mode [ 524.118069][T17444] bridge_slave_0: entered promiscuous mode [ 524.166214][T17444] bridge0: port 2(bridge_slave_1) entered blocking state [ 524.173413][T17444] bridge0: port 2(bridge_slave_1) entered disabled state [ 524.214524][T17444] bridge_slave_1: entered allmulticast mode [ 524.232867][T17444] bridge_slave_1: entered promiscuous mode [ 524.555081][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 524.790806][T17444] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 524.829142][T17444] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 524.948189][T17444] team0: Port device team_slave_0 added [ 524.963259][T17444] team0: Port device team_slave_1 added [ 525.056323][T17444] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 525.068686][T17444] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 525.115121][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 525.122536][ T5840] Bluetooth: hci4: command tx timeout [ 525.139042][T17444] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 525.176064][T17444] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 525.194837][T17444] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 525.259008][T17444] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 525.461412][T17444] hsr_slave_0: entered promiscuous mode [ 525.477909][T17444] hsr_slave_1: entered promiscuous mode [ 525.493707][T17444] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 525.537468][T17444] Cannot create hsr debugfs directory [ 525.604944][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 526.155169][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 526.293093][T17573] lo speed is unknown, defaulting to 1000 [ 526.645067][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 527.195040][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 527.207913][ T5840] Bluetooth: hci4: command tx timeout [ 527.458519][T17588] lo: entered allmulticast mode [ 527.466646][T17444] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 527.499773][T17444] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 527.551265][T17444] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 527.562804][T17591] xt_TPROXY: Can be used only with -p tcp or -p udp [ 527.596184][T17444] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 527.674920][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 527.906239][T17587] lo: left allmulticast mode [ 527.948815][T17592] lo speed is unknown, defaulting to 1000 [ 528.231598][T17605] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3184'. [ 528.241006][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 528.384090][T17444] 8021q: adding VLAN 0 to HW filter on device bond0 [ 528.473894][T17444] 8021q: adding VLAN 0 to HW filter on device team0 [ 528.528362][ T3459] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.535615][ T3459] bridge0: port 1(bridge_slave_0) entered forwarding state [ 528.579404][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.586659][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 528.682634][T17609] netlink: 'syz.3.3185': attribute type 1 has an invalid length. [ 528.715161][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 528.732840][T17609] bond1: entered promiscuous mode [ 528.738079][T17609] bond1: entered allmulticast mode [ 528.764188][T17595] netlink: 248 bytes leftover after parsing attributes in process `syz.2.3181'. [ 528.827511][T17609] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3185'. [ 528.840623][T17612] geneve2: entered allmulticast mode [ 528.848620][T17612] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.857308][T17612] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.865677][T17612] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.882199][T17613] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3181'. [ 528.893180][T17612] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.964241][T17612] bond1: (slave geneve2): making interface the new active one [ 529.004439][T17612] geneve2: entered promiscuous mode [ 529.033936][T17612] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 529.225373][T17609] bond1: left promiscuous mode [ 529.238755][T17609] geneve2: left promiscuous mode [ 529.253348][T17609] bond1: left allmulticast mode [ 529.272241][T17609] 8021q: adding VLAN 0 to HW filter on device bond1 [ 529.275358][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 529.286491][ T5840] Bluetooth: hci4: command tx timeout [ 529.754938][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 529.806965][T17638] xt_CT: You must specify a L4 protocol and not use inversions on it [ 529.857486][T17444] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 529.911811][T17640] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3190'. [ 529.965085][T17640] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3190'. [ 529.978591][T17640] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3190'. [ 530.064605][T17640] netlink: 'syz.4.3190': attribute type 1 has an invalid length. [ 530.312448][T17444] veth0_vlan: entered promiscuous mode [ 530.318856][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 530.429104][T17444] veth1_vlan: entered promiscuous mode [ 530.461764][T17654] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3195'. [ 530.480496][T17655] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3194'. [ 530.558389][T17444] veth0_macvtap: entered promiscuous mode [ 530.634219][T17444] veth1_macvtap: entered promiscuous mode [ 530.750926][T17444] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 530.795373][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 530.922155][T17668] !: renamed from dummy0 [ 530.941692][T17444] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 530.993443][T17444] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.033939][T17444] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.060914][T17444] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.092373][T17444] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.190786][T17675] netlink: 'syz.4.3199': attribute type 1 has an invalid length. [ 531.285738][T17677] tc_dump_action: action bad kind [ 531.308713][T17672] lo speed is unknown, defaulting to 1000 [ 531.355228][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 531.570822][T17682] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3201'. [ 531.610422][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 531.626956][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 531.835270][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 531.859142][ T8551] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 531.884914][ T8551] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 532.395212][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 532.867027][T17714] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 532.875018][ C0] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 532.881830][T17707] lo speed is unknown, defaulting to 1000 [ 532.971732][T17711] lo speed is unknown, defaulting to 1000 [ 533.164712][ T1303] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.418875][ T1303] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.435145][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 533.596987][ T1303] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.803342][ T5838] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 533.820306][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 533.829779][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 533.844314][ T1303] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.861537][ T5838] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 533.875088][ T5838] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 534.050971][ T1303] bridge_slave_1: left allmulticast mode [ 534.057014][ T1303] bridge_slave_1: left promiscuous mode [ 534.062811][ T1303] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.078427][ T1303] bridge_slave_0: left allmulticast mode [ 534.084132][ T1303] bridge_slave_0: left promiscuous mode [ 534.090105][ T1303] bridge0: port 1(bridge_slave_0) entered disabled state [ 534.477136][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 534.622907][ T1303] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 534.636064][ T1303] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 534.648648][ T1303] bond0 (unregistering): Released all slaves [ 534.677822][T17717] lo speed is unknown, defaulting to 1000 [ 535.515285][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 535.607447][T17729] sctp: [Deprecated]: syz.1.3215 (pid 17729) Use of int in maxseg socket option. [ 535.607447][T17729] Use struct sctp_assoc_value instead [ 535.633056][T17721] lo speed is unknown, defaulting to 1000 [ 535.854753][ T1303] hsr_slave_0: left promiscuous mode [ 535.873481][ T1303] hsr_slave_1: left promiscuous mode [ 535.883786][ T1303] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 535.921167][ T5840] Bluetooth: hci1: command tx timeout [ 535.961891][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 535.966405][ T1303] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 535.971210][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 535.985468][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 535.993533][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 536.002097][ T5838] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 536.030765][ T1303] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 536.046011][ T1303] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 536.085030][ T1303] veth1_macvtap: left promiscuous mode [ 536.090871][ T1303] veth0_macvtap: left promiscuous mode [ 536.098304][ T1303] veth1_vlan: left promiscuous mode [ 536.103835][ T1303] veth0_vlan: left promiscuous mode [ 536.555047][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 536.656587][ T1303] team0 (unregistering): Port device team_slave_1 removed [ 536.702024][ T1303] team0 (unregistering): Port device team_slave_0 removed [ 537.262152][T17748] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3218'. [ 537.329371][T17717] chnl_net:caif_netlink_parms(): no params data found [ 537.511777][T17734] lo speed is unknown, defaulting to 1000 [ 537.595409][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 537.751292][T17717] bridge0: port 1(bridge_slave_0) entered blocking state [ 537.774104][T17717] bridge0: port 1(bridge_slave_0) entered disabled state [ 537.790854][T17717] bridge_slave_0: entered allmulticast mode [ 537.808703][T17717] bridge_slave_0: entered promiscuous mode [ 537.829590][T17717] bridge0: port 2(bridge_slave_1) entered blocking state [ 537.864173][T17717] bridge0: port 2(bridge_slave_1) entered disabled state [ 537.884592][T17717] bridge_slave_1: entered allmulticast mode [ 537.911183][T17717] bridge_slave_1: entered promiscuous mode [ 537.995172][ T5838] Bluetooth: hci1: command tx timeout [ 538.022146][T17717] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 538.066069][T17717] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 538.085256][ T5838] Bluetooth: hci4: command tx timeout [ 538.430918][T17717] team0: Port device team_slave_0 added [ 538.467859][T17717] team0: Port device team_slave_1 added [ 538.619269][T17717] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 538.629912][T17717] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 538.656167][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 538.673184][T17717] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 538.694605][T17717] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 538.713353][T17717] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 538.755076][T17717] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 538.936994][T17717] hsr_slave_0: entered promiscuous mode [ 538.943994][T17717] hsr_slave_1: entered promiscuous mode [ 538.953661][T17717] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 538.961966][T17717] Cannot create hsr debugfs directory [ 538.973530][T17775] netlink: 'syz.1.3225': attribute type 1 has an invalid length. [ 539.372530][T17786] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 0, id = 0 [ 539.541611][T17734] chnl_net:caif_netlink_parms(): no params data found [ 539.675106][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 539.731946][T17794] netlink: 432 bytes leftover after parsing attributes in process `syz.1.3230'. [ 539.815839][T17794] netlink: 'syz.1.3230': attribute type 10 has an invalid length. [ 539.863715][T17760] Set syz1 is full, maxelem 65536 reached [ 539.877263][T17794] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3230'. [ 539.983129][T17794] team0: Port device geneve0 added [ 540.064357][T17734] bridge0: port 1(bridge_slave_0) entered blocking state [ 540.075529][T17734] bridge0: port 1(bridge_slave_0) entered disabled state [ 540.085261][ T5838] Bluetooth: hci1: command tx timeout [ 540.109112][T17734] bridge_slave_0: entered allmulticast mode [ 540.128107][T17734] bridge_slave_0: entered promiscuous mode [ 540.155362][ T5838] Bluetooth: hci4: command tx timeout [ 540.170289][T17804] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.185126][T17804] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.195307][T17804] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.219584][T17804] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.259368][T17816] netlink: 'syz.4.3236': attribute type 1 has an invalid length. [ 540.281068][T17804] geneve2: left allmulticast mode [ 540.302765][T17734] bridge0: port 2(bridge_slave_1) entered blocking state [ 540.311575][T17734] bridge0: port 2(bridge_slave_1) entered disabled state [ 540.328132][T17734] bridge_slave_1: entered allmulticast mode [ 540.338149][T17734] bridge_slave_1: entered promiscuous mode [ 540.352525][T17804] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3233'. [ 540.536435][T17734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 540.589632][T17734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 540.715135][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 540.774627][T17734] team0: Port device team_slave_0 added [ 540.813329][T17734] team0: Port device team_slave_1 added [ 540.925250][T17734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 540.932434][T17734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 540.998405][T17734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 541.033368][T17734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 541.045361][T17734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 541.086175][T17734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 541.229110][T17831] lo speed is unknown, defaulting to 1000 [ 541.286921][T17838] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3243'. [ 541.303479][T17838] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3243'. [ 541.307420][T17734] hsr_slave_0: entered promiscuous mode [ 541.320555][T17734] hsr_slave_1: entered promiscuous mode [ 541.336612][T17734] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 541.345839][T17734] Cannot create hsr debugfs directory [ 541.538086][T17717] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 541.577559][T17717] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 541.596546][T17717] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 541.643414][T17841] tipc: Started in network mode [ 541.653418][T17841] tipc: Node identity ac1414aa, cluster identity 4711 [ 541.671603][T17841] tipc: Enabled bearer , priority 10 [ 541.693745][T17717] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 541.754971][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 541.846011][T17842] syzkaller0: entered promiscuous mode [ 541.852428][T17842] syzkaller0: entered allmulticast mode [ 541.932408][T17853] netlink: 'syz.3.3247': attribute type 1 has an invalid length. [ 542.156625][ T5840] Bluetooth: hci1: command tx timeout [ 542.238269][ T5840] Bluetooth: hci4: command tx timeout [ 542.795086][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 542.798312][ T5833] tipc: Node number set to 2886997162 [ 543.436921][T17853] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 543.708791][T17863] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input8 [ 543.835160][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 544.064528][T17717] 8021q: adding VLAN 0 to HW filter on device bond0 [ 544.132480][T17717] 8021q: adding VLAN 0 to HW filter on device team0 [ 544.172000][ T73] bridge0: port 1(bridge_slave_0) entered blocking state [ 544.179252][ T73] bridge0: port 1(bridge_slave_0) entered forwarding state [ 544.243736][ T1303] bridge0: port 2(bridge_slave_1) entered blocking state [ 544.250937][ T1303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 544.325861][ T5840] Bluetooth: hci4: command 0x0419 tx timeout [ 544.494373][T17872] IPVS: sh: UDP 127.0.0.1:0 - no destination available [ 544.543131][T17734] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 544.569967][T17734] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 544.605758][T17734] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 544.651399][T17734] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 544.802874][T17879] raw_sendmsg: syz.3.3254 forgot to set AF_INET. Fix it! [ 544.835871][T17880] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3256'. [ 544.875140][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 544.997474][T17889] netlink: 'syz.3.3257': attribute type 1 has an invalid length. [ 545.005535][T17734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 545.068730][T17893] netlink: 'syz.1.3259': attribute type 18 has an invalid length. [ 545.077229][T17893] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3259'. [ 545.098705][T17734] 8021q: adding VLAN 0 to HW filter on device team0 [ 545.158967][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.166208][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 545.216918][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.224106][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 545.290632][T17717] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 545.521993][T17717] veth0_vlan: entered promiscuous mode [ 545.572015][T17717] veth1_vlan: entered promiscuous mode [ 545.682382][T17717] veth0_macvtap: entered promiscuous mode [ 545.742616][T17717] veth1_macvtap: entered promiscuous mode [ 545.857052][T17717] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 545.893810][T17717] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 545.915320][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 545.929351][T17717] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.965105][T17717] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.984360][T17717] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.002891][T17717] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.355301][ T1303] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.361781][T17734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 546.367608][ T1303] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.405628][ T5838] Bluetooth: hci4: command 0x0419 tx timeout [ 546.463979][ T1303] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.472931][ T1303] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.668227][T17918] netlink: 2 bytes leftover after parsing attributes in process `syz.2.3212'. [ 546.683937][T17917] tipc: Enabling of bearer rejected, already enabled [ 546.692353][T17918] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 546.737496][T17734] veth0_vlan: entered promiscuous mode [ 546.771751][T17734] veth1_vlan: entered promiscuous mode [ 546.880150][T17925] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3267'. [ 546.934517][T17734] veth0_macvtap: entered promiscuous mode [ 546.955120][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 546.984569][T17925] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 547.009626][T17928] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.032362][T17930] netlink: 'syz.3.3270': attribute type 1 has an invalid length. [ 547.036300][T17928] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.087495][T17928] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.097144][T17928] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.155355][T17928] netdevsim netdevsim4 eth0: unset [1, 2] type 2 family 0 port 35917 - 0 [ 547.177750][T17928] netdevsim netdevsim4 eth1: unset [1, 2] type 2 family 0 port 35917 - 0 [ 547.191099][T17928] netdevsim netdevsim4 eth2: unset [1, 2] type 2 family 0 port 35917 - 0 [ 547.202942][T17928] netdevsim netdevsim4 eth3: unset [1, 2] type 2 family 0 port 35917 - 0 [ 547.219893][T17928] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 49646 - 0 [ 547.231151][T17928] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 49646 - 0 [ 547.248031][T17928] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 49646 - 0 [ 547.261703][T17928] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 49646 - 0 [ 547.332140][T17734] veth1_macvtap: entered promiscuous mode [ 547.420045][T17923] 8021q: adding VLAN 0 to HW filter on device bond0 [ 547.431788][T17923] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 547.448182][ C0] syz_tun: tun_net_xmit 54 [ 547.465479][T17933] tipc: Started in network mode [ 547.470502][T17933] tipc: Node identity , cluster identity 4711 [ 547.485367][ C0] syz_tun: tun_net_xmit 54 [ 547.532282][T17734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 547.583075][T17734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 547.626367][T17734] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.655671][T17734] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.664431][T17734] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.704906][T17734] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.952597][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 547.992823][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 548.000560][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 548.133028][T17960] FAULT_INJECTION: forcing a failure. [ 548.133028][T17960] name failslab, interval 1, probability 0, space 0, times 0 [ 548.155113][ C1] syz_tun: tun_net_xmit 118 [ 548.173162][T17960] CPU: 1 UID: 0 PID: 17960 Comm: syz.2.3278 Not tainted 6.15.0-rc6-syzkaller-01215-ga8ae8a0e848e #0 PREEMPT(full) [ 548.173210][T17960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 548.173230][T17960] Call Trace: [ 548.173240][T17960] [ 548.173249][T17960] dump_stack_lvl+0x189/0x250 [ 548.173293][T17960] ? is_bpf_text_address+0x26/0x2b0 [ 548.173329][T17960] ? __pfx_dump_stack_lvl+0x10/0x10 [ 548.173361][T17960] ? __pfx__printk+0x10/0x10 [ 548.173379][T17960] ? is_bpf_text_address+0x26/0x2b0 [ 548.173415][T17960] ? kernel_text_address+0xa5/0xe0 [ 548.173447][T17960] ? __kernel_text_address+0xd/0x40 [ 548.173476][T17960] ? unwind_get_return_address+0x4d/0x90 [ 548.173504][T17960] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 548.173535][T17960] should_fail_ex+0x414/0x560 [ 548.173565][T17960] should_failslab+0xa8/0x100 [ 548.173598][T17960] __kmalloc_cache_noprof+0x70/0x3d0 [ 548.173627][T17960] ? tipc_udp_enable+0x160/0xb30 [ 548.173662][T17960] tipc_udp_enable+0x160/0xb30 [ 548.173700][T17960] ? __pfx_tipc_udp_enable+0x10/0x10 [ 548.173725][T17960] ? __tipc_nl_bearer_enable+0xab3/0x13f0 [ 548.173751][T17960] ? tipc_nl_bearer_enable+0x22/0x40 [ 548.173775][T17960] ? genl_family_rcv_msg_doit+0x215/0x300 [ 548.173798][T17960] ? genl_rcv_msg+0x60e/0x790 [ 548.173818][T17960] ? netlink_rcv_skb+0x21c/0x490 [ 548.173846][T17960] ? genl_rcv+0x28/0x40 [ 548.173863][T17960] ? netlink_unicast+0x758/0x8d0 [ 548.173886][T17960] ? netlink_sendmsg+0x805/0xb30 [ 548.173913][T17960] ? __sock_sendmsg+0x219/0x270 [ 548.173935][T17960] ? ____sys_sendmsg+0x505/0x830 [ 548.173962][T17960] ? ___sys_sendmsg+0x21f/0x2a0 [ 548.173990][T17960] ? __x64_sys_sendmsg+0x19b/0x260 [ 548.174019][T17960] ? do_syscall_64+0xf6/0x210 [ 548.174042][T17960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.174125][T17960] ? __tipc_nl_bearer_enable+0xab3/0x13f0 [ 548.174158][T17960] __tipc_nl_bearer_enable+0xc21/0x13f0 [ 548.174186][T17960] ? __pfx___mutex_trylock_common+0x10/0x10 [ 548.174219][T17960] ? __pfx___tipc_nl_bearer_enable+0x10/0x10 [ 548.174244][T17960] ? trace_contention_end+0x39/0x120 [ 548.174291][T17960] ? tipc_nl_bearer_enable+0x17/0x40 [ 548.174321][T17960] ? __pfx___mutex_lock+0x10/0x10 [ 548.174355][T17960] ? __nla_parse+0x40/0x60 [ 548.174388][T17960] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 548.174410][T17960] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 548.174440][T17960] tipc_nl_bearer_enable+0x22/0x40 [ 548.174466][T17960] genl_family_rcv_msg_doit+0x215/0x300 [ 548.174499][T17960] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 548.174553][T17960] genl_rcv_msg+0x60e/0x790 [ 548.174583][T17960] ? __pfx_genl_rcv_msg+0x10/0x10 [ 548.174605][T17960] ? __pfx_tipc_nl_bearer_enable+0x10/0x10 [ 548.174635][T17960] ? ref_tracker_free+0x63a/0x7d0 [ 548.174657][T17960] ? __copy_skb_header+0xa7/0x550 [ 548.174701][T17960] netlink_rcv_skb+0x21c/0x490 [ 548.174732][T17960] ? __pfx_genl_rcv_msg+0x10/0x10 [ 548.174757][T17960] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 548.174823][T17960] ? down_read+0x1ad/0x2e0 [ 548.174853][T17960] genl_rcv+0x28/0x40 [ 548.174873][T17960] netlink_unicast+0x758/0x8d0 [ 548.174915][T17960] netlink_sendmsg+0x805/0xb30 [ 548.174959][T17960] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.175000][T17960] ? aa_sock_msg_perm+0x94/0x160 [ 548.175037][T17960] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 548.175065][T17960] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.175102][T17960] __sock_sendmsg+0x219/0x270 [ 548.175134][T17960] ____sys_sendmsg+0x505/0x830 [ 548.175180][T17960] ? __pfx_____sys_sendmsg+0x10/0x10 [ 548.175230][T17960] ? import_iovec+0x74/0xa0 [ 548.175278][T17960] ___sys_sendmsg+0x21f/0x2a0 [ 548.175317][T17960] ? __pfx____sys_sendmsg+0x10/0x10 [ 548.175406][T17960] ? __fget_files+0x2a/0x420 [ 548.175452][T17960] ? __fget_files+0x3a0/0x420 [ 548.175499][T17960] __x64_sys_sendmsg+0x19b/0x260 [ 548.175558][T17960] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 548.175618][T17960] ? do_syscall_64+0xba/0x210 [ 548.175653][T17960] do_syscall_64+0xf6/0x210 [ 548.175684][T17960] ? clear_bhb_loop+0x60/0xb0 [ 548.175715][T17960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.175739][T17960] RIP: 0033:0x7efd3118e969 [ 548.175762][T17960] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 548.175783][T17960] RSP: 002b:00007efd31ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 548.175810][T17960] RAX: ffffffffffffffda RBX: 00007efd313b5fa0 RCX: 00007efd3118e969 [ 548.175827][T17960] RDX: 0000000000004050 RSI: 0000200000000100 RDI: 0000000000000003 [ 548.175842][T17960] RBP: 00007efd31ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 548.175856][T17960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.175869][T17960] R13: 0000000000000000 R14: 00007efd313b5fa0 R15: 00007ffdba0a7d78 [ 548.175910][T17960] [ 548.725318][T17960] tipc: Enabling of bearer rejected, failed to enable media [ 548.778702][ T3459] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 548.794820][ T3459] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 548.831480][T17963] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 548.960670][T17968] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 549.035033][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 549.195020][ C1] syz_tun: tun_net_xmit 118 [ 549.207823][T17980] netlink: 'syz.4.3284': attribute type 1 has an invalid length. [ 549.403061][T17990] netlink: 6432 bytes leftover after parsing attributes in process `syz.2.3288'. [ 549.715704][ T52] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.753286][T18000] tipc: Started in network mode [ 549.760046][T18000] tipc: Node identity ac1414aa, cluster identity 4711 [ 549.785309][T18000] FAULT_INJECTION: forcing a failure. [ 549.785309][T18000] name failslab, interval 1, probability 0, space 0, times 0 [ 549.804866][T18000] CPU: 0 UID: 0 PID: 18000 Comm: syz.2.3291 Not tainted 6.15.0-rc6-syzkaller-01215-ga8ae8a0e848e #0 PREEMPT(full) [ 549.804897][T18000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 549.804911][T18000] Call Trace: [ 549.804919][T18000] [ 549.804928][T18000] dump_stack_lvl+0x189/0x250 [ 549.804969][T18000] ? __pfx_dump_stack_lvl+0x10/0x10 [ 549.805001][T18000] ? __pfx__printk+0x10/0x10 [ 549.805032][T18000] ? __pfx___might_resched+0x10/0x10 [ 549.805066][T18000] ? fs_reclaim_acquire+0x7d/0x100 [ 549.805105][T18000] should_fail_ex+0x414/0x560 [ 549.805132][T18000] ? __pfx_sock_alloc_inode+0x10/0x10 [ 549.805155][T18000] should_failslab+0xa8/0x100 [ 549.805185][T18000] ? __pfx_sock_alloc_inode+0x10/0x10 [ 549.805206][T18000] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 549.805233][T18000] ? sock_alloc_inode+0x28/0xc0 [ 549.805262][T18000] ? __pfx_sock_alloc_inode+0x10/0x10 [ 549.805285][T18000] sock_alloc_inode+0x28/0xc0 [ 549.805307][T18000] alloc_inode+0x67/0x1b0 [ 549.805339][T18000] __sock_create+0x12d/0x9f0 [ 549.805364][T18000] ? __ip_dev_find+0xa2/0x4e0 [ 549.805406][T18000] udp_sock_create4+0xbe/0x4b0 [ 549.805436][T18000] ? __pfx_udp_sock_create4+0x10/0x10 [ 549.805460][T18000] ? net_generic+0x1e/0x240 [ 549.805487][T18000] ? tipc_udp_media_addr_set+0x58/0x160 [ 549.805529][T18000] tipc_udp_enable+0x86d/0xb30 [ 549.805566][T18000] ? __pfx_tipc_udp_enable+0x10/0x10 [ 549.805592][T18000] ? __tipc_nl_bearer_enable+0xab3/0x13f0 [ 549.805692][T18000] ? __tipc_nl_bearer_enable+0xab3/0x13f0 [ 549.805726][T18000] __tipc_nl_bearer_enable+0xc21/0x13f0 [ 549.805755][T18000] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 549.805788][T18000] ? __pfx___tipc_nl_bearer_enable+0x10/0x10 [ 549.805834][T18000] ? tipc_nl_bearer_enable+0x17/0x40 [ 549.805865][T18000] ? __pfx___mutex_lock+0x10/0x10 [ 549.805905][T18000] ? __nla_parse+0x40/0x60 [ 549.805938][T18000] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 549.805962][T18000] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 549.805993][T18000] tipc_nl_bearer_enable+0x22/0x40 [ 549.806019][T18000] genl_family_rcv_msg_doit+0x215/0x300 [ 549.806062][T18000] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 549.806116][T18000] genl_rcv_msg+0x60e/0x790 [ 549.806149][T18000] ? __pfx_genl_rcv_msg+0x10/0x10 [ 549.806171][T18000] ? __pfx_tipc_nl_bearer_enable+0x10/0x10 [ 549.806211][T18000] ? ref_tracker_free+0x63a/0x7d0 [ 549.806233][T18000] ? __copy_skb_header+0xa7/0x550 [ 549.806277][T18000] netlink_rcv_skb+0x21c/0x490 [ 549.806309][T18000] ? __pfx_genl_rcv_msg+0x10/0x10 [ 549.806333][T18000] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 549.806392][T18000] ? down_read+0x1ad/0x2e0 [ 549.806423][T18000] genl_rcv+0x28/0x40 [ 549.806442][T18000] netlink_unicast+0x758/0x8d0 [ 549.806483][T18000] netlink_sendmsg+0x805/0xb30 [ 549.806543][T18000] ? __pfx_netlink_sendmsg+0x10/0x10 [ 549.806593][T18000] ? aa_sock_msg_perm+0x94/0x160 [ 549.806620][T18000] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 549.806646][T18000] ? __pfx_netlink_sendmsg+0x10/0x10 [ 549.806677][T18000] __sock_sendmsg+0x219/0x270 [ 549.806705][T18000] ____sys_sendmsg+0x505/0x830 [ 549.806743][T18000] ? __pfx_____sys_sendmsg+0x10/0x10 [ 549.806786][T18000] ? import_iovec+0x74/0xa0 [ 549.806822][T18000] ___sys_sendmsg+0x21f/0x2a0 [ 549.806857][T18000] ? __pfx____sys_sendmsg+0x10/0x10 [ 549.806934][T18000] ? __fget_files+0x2a/0x420 [ 549.806963][T18000] ? __fget_files+0x3a0/0x420 [ 549.807005][T18000] __x64_sys_sendmsg+0x19b/0x260 [ 549.807041][T18000] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 549.807120][T18000] ? do_syscall_64+0xba/0x210 [ 549.807152][T18000] do_syscall_64+0xf6/0x210 [ 549.807179][T18000] ? clear_bhb_loop+0x60/0xb0 [ 549.807208][T18000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.807229][T18000] RIP: 0033:0x7efd3118e969 [ 549.807248][T18000] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 549.807267][T18000] RSP: 002b:00007efd31ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 549.807290][T18000] RAX: ffffffffffffffda RBX: 00007efd313b5fa0 RCX: 00007efd3118e969 [ 549.807306][T18000] RDX: 0000000000004050 RSI: 0000200000000100 RDI: 0000000000000003 [ 549.807321][T18000] RBP: 00007efd31ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 549.807334][T18000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 549.807346][T18000] R13: 0000000000000000 R14: 00007efd313b5fa0 R15: 00007ffdba0a7d78 [ 549.807383][T18000] [ 549.807463][T18000] socket: no more sockets [ 550.074994][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 550.081662][T18000] tipc: Enabling of bearer rejected, failed to enable media [ 550.234897][ C1] syz_tun: tun_net_xmit 118 [ 550.339510][ T52] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.430329][ T52] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.704716][ T52] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.828821][ T52] bridge_slave_1: left allmulticast mode [ 550.834491][ T52] bridge_slave_1: left promiscuous mode [ 550.840886][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.850168][ T52] bridge_slave_0: left allmulticast mode [ 550.856644][ T52] bridge_slave_0: left promiscuous mode [ 550.865069][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.119396][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 551.213716][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 551.226241][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 551.240398][ T52] bond0 (unregistering): Released all slaves [ 551.274951][ C1] syz_tun: tun_net_xmit 118 [ 551.589480][ T52] hsr_slave_0: left promiscuous mode [ 551.598271][ T52] hsr_slave_1: left promiscuous mode [ 551.604482][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 551.612078][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 551.629386][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 551.636936][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 551.663157][ T52] veth1_macvtap: left promiscuous mode [ 551.668982][ T52] veth0_macvtap: left promiscuous mode [ 551.674594][ T52] veth1_vlan: left promiscuous mode [ 551.681216][ T52] veth0_vlan: left promiscuous mode [ 551.917554][T18005] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3293'. [ 552.154970][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 552.319284][ C1] syz_tun: tun_net_xmit 118 [ 552.389866][T18024] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3294'. [ 552.475026][ C0] ================================================================== [ 552.483176][ C0] BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x471/0x4b0 [ 552.491118][ C0] Read of size 2 at addr ffff888052583c2a by task syz-executor/18027 [ 552.499200][ C0] [ 552.501541][ C0] CPU: 0 UID: 0 PID: 18027 Comm: syz-executor Not tainted 6.15.0-rc6-syzkaller-01215-ga8ae8a0e848e #0 PREEMPT(full) [ 552.501565][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 552.501576][ C0] Call Trace: [ 552.501583][ C0] [ 552.501591][ C0] dump_stack_lvl+0x189/0x250 [ 552.501621][ C0] ? __virt_addr_valid+0x18c/0x540 [ 552.501644][ C0] ? rcu_is_watching+0x15/0xb0 [ 552.501662][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 552.501687][ C0] ? rcu_is_watching+0x15/0xb0 [ 552.501702][ C0] ? lock_release+0x4b/0x3e0 [ 552.501730][ C0] ? __virt_addr_valid+0x18c/0x540 [ 552.501753][ C0] ? __virt_addr_valid+0x469/0x540 [ 552.501777][ C0] print_report+0xb4/0x290 [ 552.501799][ C0] ? rose_timer_expiry+0x471/0x4b0 [ 552.501820][ C0] kasan_report+0x118/0x150 [ 552.501845][ C0] ? rose_timer_expiry+0x471/0x4b0 [ 552.501871][ C0] rose_timer_expiry+0x471/0x4b0 [ 552.501894][ C0] call_timer_fn+0x17e/0x5f0 [ 552.501923][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 552.501945][ C0] ? call_timer_fn+0xbe/0x5f0 [ 552.501968][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 552.501997][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 552.502013][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 552.502031][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 552.502053][ C0] __run_timer_base+0x61a/0x860 [ 552.502075][ C0] ? ktime_get+0x3e/0x1f0 [ 552.502099][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 552.502119][ C0] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 552.502148][ C0] run_timer_softirq+0xb7/0x180 [ 552.502170][ C0] handle_softirqs+0x283/0x870 [ 552.502189][ C0] ? __irq_exit_rcu+0xca/0x1f0 [ 552.502208][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 552.502230][ C0] __irq_exit_rcu+0xca/0x1f0 [ 552.502246][ C0] ? __pfx___irq_exit_rcu+0x10/0x10 [ 552.502267][ C0] irq_exit_rcu+0x9/0x30 [ 552.502281][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 552.502305][ C0] [ 552.502311][ C0] [ 552.502318][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 552.502336][ C0] RIP: 0010:lock_release+0x2b5/0x3e0 [ 552.502363][ C0] Code: 51 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 75 56 f7 c3 00 02 00 00 74 01 fb 65 48 8b 05 fb 4c d8 10 <48> 3b 44 24 28 0f 85 8b 00 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e [ 552.502378][ C0] RSP: 0018:ffffc9000417f670 EFLAGS: 00000206 [ 552.502394][ C0] RAX: 5a40f9a859016e00 RBX: 0000000000000206 RCX: 5a40f9a859016e00 [ 552.502406][ C0] RDX: 0000000000000000 RSI: ffffffff8d93fb71 RDI: ffffffff8bc1dbe0 [ 552.502418][ C0] RBP: ffff88801bfee4f0 R08: ffffc9000417f807 R09: 0000000000000000 [ 552.502430][ C0] R10: ffffc9000417f7f8 R11: fffff5200082ff01 R12: 0000000000000000 [ 552.502441][ C0] R13: 0000000000000000 R14: ffffffff8df3dce0 R15: ffff88801bfeda00 [ 552.502463][ C0] ? unwind_next_frame+0xa5/0x2390 [ 552.502487][ C0] ? unwind_next_frame+0xa5/0x2390 [ 552.502507][ C0] unwind_next_frame+0x19a9/0x2390 [ 552.502531][ C0] ? unwind_next_frame+0xa5/0x2390 [ 552.502553][ C0] ? kasan_save_free_info+0x46/0x50 [ 552.502572][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 552.502592][ C0] arch_stack_walk+0x11c/0x150 [ 552.502618][ C0] ? __kasan_slab_free+0x62/0x70 [ 552.502640][ C0] stack_trace_save+0x9c/0xe0 [ 552.502661][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 552.502681][ C0] ? cgroup_rstat_updated+0x144/0xb50 [ 552.502713][ C0] kasan_save_track+0x3e/0x80 [ 552.502732][ C0] ? kasan_save_track+0x3e/0x80 [ 552.502750][ C0] ? kasan_save_free_info+0x46/0x50 [ 552.502790][ C0] ? vhci_read+0x49a/0x5b0 [ 552.502810][ C0] kasan_save_free_info+0x46/0x50 [ 552.502825][ C0] __kasan_slab_free+0x62/0x70 [ 552.502846][ C0] kmem_cache_free+0x192/0x3f0 [ 552.502872][ C0] vhci_read+0x49a/0x5b0 [ 552.502894][ C0] ? __pfx_vhci_read+0x10/0x10 [ 552.502920][ C0] ? common_file_perm+0x199/0x200 [ 552.502942][ C0] ? bpf_lsm_file_permission+0x9/0x20 [ 552.502966][ C0] ? security_file_permission+0x75/0x290 [ 552.502983][ C0] ? rw_verify_area+0x258/0x650 [ 552.503002][ C0] ? __pfx_vhci_read+0x10/0x10 [ 552.503022][ C0] vfs_read+0x1fd/0x980 [ 552.503046][ C0] ? __pfx_vfs_read+0x10/0x10 [ 552.503066][ C0] ? __fget_files+0x2a/0x420 [ 552.503091][ C0] ? __fget_files+0x2a/0x420 [ 552.503113][ C0] ? __fget_files+0x3a0/0x420 [ 552.503135][ C0] ? __fget_files+0x2a/0x420 [ 552.503162][ C0] ksys_read+0x145/0x250 [ 552.503183][ C0] ? __pfx_ksys_read+0x10/0x10 [ 552.503205][ C0] ? do_syscall_64+0xba/0x210 [ 552.503227][ C0] do_syscall_64+0xf6/0x210 [ 552.503247][ C0] ? clear_bhb_loop+0x60/0xb0 [ 552.503272][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.503289][ C0] RIP: 0033:0x7fb78a38d37c [ 552.503303][ C0] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 552.503317][ C0] RSP: 002b:00007fb7889f6bc0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 552.503334][ C0] RAX: ffffffffffffffda RBX: 00007fb7889f76c0 RCX: 00007fb78a38d37c [ 552.503347][ C0] RDX: 0000000000000400 RSI: 00007fb7889f6cf0 RDI: 00000000000000ca [ 552.503358][ C0] RBP: 00007fb7889f6d00 R08: 0000000000000000 R09: 00007ffff9aff1d7 [ 552.503370][ C0] R10: 0000000000000008 R11: 0000000000000246 R12: 00007fb7889f6cf0 [ 552.503381][ C0] R13: 000600046003fd00 R14: 00007ffff9aff0f0 R15: 00007ffff9aff1d8 [ 552.503401][ C0] [ 552.503408][ C0] [ 553.032537][ C0] Allocated by task 17734: [ 553.036955][ C0] kasan_save_track+0x3e/0x80 [ 553.041641][ C0] __kasan_slab_alloc+0x6c/0x80 [ 553.046499][ C0] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 553.052408][ C0] kmalloc_reserve+0xbd/0x290 [ 553.057089][ C0] __alloc_skb+0x142/0x2d0 [ 553.061510][ C0] inet6_rt_notify+0xb6/0x240 [ 553.066199][ C0] fib6_add_rt2node+0x15eb/0x3040 [ 553.071318][ C0] fib6_add+0x8da/0x18a0 [ 553.075594][ C0] ip6_route_add+0x187/0x2f0 [ 553.080196][ C0] addrconf_add_dev+0x24f/0x340 [ 553.085054][ C0] addrconf_init_auto_addrs+0x5cf/0xb50 [ 553.090614][ C0] addrconf_notify+0xacc/0x1010 [ 553.095486][ C0] notifier_call_chain+0x1b3/0x3e0 [ 553.100601][ C0] __dev_notify_flags+0x18d/0x2e0 [ 553.105655][ C0] netif_change_flags+0xe8/0x1a0 [ 553.110607][ C0] do_setlink+0xcb9/0x40d0 [ 553.115050][ C0] rtnl_newlink+0x160b/0x1c70 [ 553.119750][ C0] rtnetlink_rcv_msg+0x7cc/0xb70 [ 553.124719][ C0] netlink_rcv_skb+0x21c/0x490 [ 553.129493][ C0] netlink_unicast+0x758/0x8d0 [ 553.134262][ C0] netlink_sendmsg+0x805/0xb30 [ 553.139052][ C0] __sock_sendmsg+0x219/0x270 [ 553.143729][ C0] __sys_sendto+0x3bd/0x520 [ 553.148245][ C0] __x64_sys_sendto+0xde/0x100 [ 553.153013][ C0] do_syscall_64+0xf6/0x210 [ 553.157524][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.163420][ C0] [ 553.165744][ C0] Freed by task 17734: [ 553.169816][ C0] kasan_save_track+0x3e/0x80 [ 553.174499][ C0] kasan_save_free_info+0x46/0x50 [ 553.179525][ C0] __kasan_slab_free+0x62/0x70 [ 553.184296][ C0] kmem_cache_free+0x192/0x3f0 [ 553.189067][ C0] skb_release_data+0x688/0x8b0 [ 553.193926][ C0] consume_skb+0x9e/0xf0 [ 553.194990][ C1] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 553.198165][ C0] netlink_broadcast_filtered+0x103c/0x1140 [ 553.210998][ C0] nlmsg_notify+0xf0/0x1a0 [ 553.215427][ C0] fib6_add_rt2node+0x15eb/0x3040 [ 553.220463][ C0] fib6_add+0x8da/0x18a0 [ 553.224727][ C0] ip6_route_add+0x187/0x2f0 [ 553.229335][ C0] addrconf_add_dev+0x24f/0x340 [ 553.234208][ C0] addrconf_init_auto_addrs+0x5cf/0xb50 [ 553.239789][ C0] addrconf_notify+0xacc/0x1010 [ 553.244737][ C0] notifier_call_chain+0x1b3/0x3e0 [ 553.249880][ C0] __dev_notify_flags+0x18d/0x2e0 [ 553.254916][ C0] netif_change_flags+0xe8/0x1a0 [ 553.259864][ C0] do_setlink+0xcb9/0x40d0 [ 553.264290][ C0] rtnl_newlink+0x160b/0x1c70 [ 553.268977][ C0] rtnetlink_rcv_msg+0x7cc/0xb70 [ 553.273942][ C0] netlink_rcv_skb+0x21c/0x490 [ 553.278716][ C0] netlink_unicast+0x758/0x8d0 [ 553.283502][ C0] netlink_sendmsg+0x805/0xb30 [ 553.288278][ C0] __sock_sendmsg+0x219/0x270 [ 553.292959][ C0] __sys_sendto+0x3bd/0x520 [ 553.297472][ C0] __x64_sys_sendto+0xde/0x100 [ 553.302241][ C0] do_syscall_64+0xf6/0x210 [ 553.306749][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.312662][ C0] [ 553.314987][ C0] The buggy address belongs to the object at ffff888052583a80 [ 553.314987][ C0] which belongs to the cache skbuff_small_head of size 704 [ 553.329572][ C0] The buggy address is located 426 bytes inside of [ 553.329572][ C0] freed 704-byte region [ffff888052583a80, ffff888052583d40) [ 553.343371][ C0] [ 553.345698][ C0] The buggy address belongs to the physical page: [ 553.352116][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52580 [ 553.354942][ C1] syz_tun: tun_net_xmit 118 [ 553.360864][ C0] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 553.373894][ C0] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 553.381441][ C0] page_type: f5(slab) [ 553.385425][ C0] raw: 00fff00000000040 ffff888141ee3b40 dead000000000122 0000000000000000 [ 553.394010][ C0] raw: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000 [ 553.402595][ C0] head: 00fff00000000040 ffff888141ee3b40 dead000000000122 0000000000000000 [ 553.411269][ C0] head: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000 [ 553.419949][ C0] head: 00fff00000000002 ffffea0001496001 00000000ffffffff 00000000ffffffff [ 553.428628][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 553.437299][ C0] page dumped because: kasan: bad access detected [ 553.443719][ C0] page_owner tracks the page as allocated [ 553.449436][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 17734, tgid 17734 (syz-executor), ts 544911092080, free_ts 543600860300 [ 553.470537][ C0] post_alloc_hook+0x1d8/0x230 [ 553.475348][ C0] get_page_from_freelist+0x21e0/0x22c0 [ 553.480896][ C0] __alloc_frozen_pages_noprof+0x181/0x370 [ 553.486705][ C0] alloc_pages_mpol+0x232/0x4a0 [ 553.491568][ C0] allocate_slab+0x8a/0x3b0 [ 553.496072][ C0] ___slab_alloc+0xbfc/0x1480 [ 553.500765][ C0] kmem_cache_alloc_node_noprof+0x280/0x3c0 [ 553.506688][ C0] kmalloc_reserve+0xbd/0x290 [ 553.511376][ C0] __alloc_skb+0x142/0x2d0 [ 553.515801][ C0] inet6_rt_notify+0xb6/0x240 [ 553.520483][ C0] fib6_add_rt2node+0x15eb/0x3040 [ 553.525523][ C0] fib6_add+0x8da/0x18a0 [ 553.529778][ C0] ip6_route_add+0x187/0x2f0 [ 553.534395][ C0] addrconf_add_linklocal+0x45f/0x6c0 [ 553.539773][ C0] addrconf_addr_gen+0x490/0x580 [ 553.544718][ C0] addrconf_init_auto_addrs+0x711/0xb50 [ 553.550283][ C0] page last free pid 17858 tgid 17857 stack trace: [ 553.556881][ C0] __free_frozen_pages+0xb14/0xce0 [ 553.562009][ C0] __slab_free+0x326/0x400 [ 553.566427][ C0] qlist_free_all+0x9a/0x140 [ 553.571017][ C0] kasan_quarantine_reduce+0x148/0x160 [ 553.576526][ C0] __kasan_slab_alloc+0x22/0x80 [ 553.581386][ C0] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 553.586857][ C0] ptlock_alloc+0x20/0x70 [ 553.591197][ C0] pte_alloc_one+0x6d/0x160 [ 553.595706][ C0] __pte_alloc+0x25/0x160 [ 553.600052][ C0] __handle_mm_fault+0x49e9/0x5380 [ 553.605175][ C0] handle_mm_fault+0x3f6/0x8c0 [ 553.609944][ C0] __get_user_pages+0x16f0/0x2a40 [ 553.614997][ C0] __gup_longterm_locked+0xd66/0x15b0 [ 553.620392][ C0] gup_fast_fallback+0x1843/0x1d60 [ 553.625527][ C0] iov_iter_extract_pages+0x35a/0x5e0 [ 553.630920][ C0] extract_iter_to_sg+0xdeb/0x2480 [ 553.636051][ C0] [ 553.638386][ C0] Memory state around the buggy address: [ 553.644022][ C0] ffff888052583b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 553.652201][ C0] ffff888052583b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 553.660265][ C0] >ffff888052583c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 553.668328][ C0] ^ [ 553.673696][ C0] ffff888052583c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 553.681765][ C0] ffff888052583d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 553.689828][ C0] ================================================================== [ 553.698196][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 553.705424][ C0] CPU: 0 UID: 0 PID: 18027 Comm: syz-executor Not tainted 6.15.0-rc6-syzkaller-01215-ga8ae8a0e848e #0 PREEMPT(full) [ 553.717684][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 553.727753][ C0] Call Trace: [ 553.731042][ C0] [ 553.733891][ C0] dump_stack_lvl+0x99/0x250 [ 553.738510][ C0] ? __asan_memcpy+0x40/0x70 [ 553.743126][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 553.748352][ C0] ? __pfx__printk+0x10/0x10 [ 553.752960][ C0] panic+0x2db/0x790 [ 553.756879][ C0] ? __pfx_panic+0x10/0x10 [ 553.761316][ C0] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 553.767231][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 553.773139][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 553.779482][ C0] ? print_memory_metadata+0x314/0x400 [ 553.784959][ C0] ? rose_timer_expiry+0x471/0x4b0 [ 553.790085][ C0] check_panic_on_warn+0x89/0xb0 [ 553.795042][ C0] ? rose_timer_expiry+0x471/0x4b0 [ 553.800166][ C0] end_report+0x78/0x160 [ 553.804441][ C0] kasan_report+0x129/0x150 [ 553.809021][ C0] ? rose_timer_expiry+0x471/0x4b0 [ 553.814160][ C0] rose_timer_expiry+0x471/0x4b0 [ 553.819121][ C0] call_timer_fn+0x17e/0x5f0 [ 553.823739][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 553.829220][ C0] ? call_timer_fn+0xbe/0x5f0 [ 553.833915][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 553.839060][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 553.844273][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 553.849495][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 553.854976][ C0] __run_timer_base+0x61a/0x860 [ 553.859844][ C0] ? ktime_get+0x3e/0x1f0 [ 553.864188][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 553.869590][ C0] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 553.875862][ C0] run_timer_softirq+0xb7/0x180 [ 553.880738][ C0] handle_softirqs+0x283/0x870 [ 553.885558][ C0] ? __irq_exit_rcu+0xca/0x1f0 [ 553.890336][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 553.895638][ C0] __irq_exit_rcu+0xca/0x1f0 [ 553.900237][ C0] ? __pfx___irq_exit_rcu+0x10/0x10 [ 553.905450][ C0] irq_exit_rcu+0x9/0x30 [ 553.909703][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 553.915346][ C0] [ 553.918281][ C0] [ 553.921215][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 553.927204][ C0] RIP: 0010:lock_release+0x2b5/0x3e0 [ 553.932509][ C0] Code: 51 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 75 56 f7 c3 00 02 00 00 74 01 fb 65 48 8b 05 fb 4c d8 10 <48> 3b 44 24 28 0f 85 8b 00 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e [ 553.952132][ C0] RSP: 0018:ffffc9000417f670 EFLAGS: 00000206 [ 553.958315][ C0] RAX: 5a40f9a859016e00 RBX: 0000000000000206 RCX: 5a40f9a859016e00 [ 553.966292][ C0] RDX: 0000000000000000 RSI: ffffffff8d93fb71 RDI: ffffffff8bc1dbe0 [ 553.974267][ C0] RBP: ffff88801bfee4f0 R08: ffffc9000417f807 R09: 0000000000000000 [ 553.982243][ C0] R10: ffffc9000417f7f8 R11: fffff5200082ff01 R12: 0000000000000000 [ 553.990222][ C0] R13: 0000000000000000 R14: ffffffff8df3dce0 R15: ffff88801bfeda00 [ 553.998219][ C0] ? unwind_next_frame+0xa5/0x2390 [ 554.003345][ C0] ? unwind_next_frame+0xa5/0x2390 [ 554.008465][ C0] unwind_next_frame+0x19a9/0x2390 [ 554.013588][ C0] ? unwind_next_frame+0xa5/0x2390 [ 554.018708][ C0] ? kasan_save_free_info+0x46/0x50 [ 554.023912][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 554.030091][ C0] arch_stack_walk+0x11c/0x150 [ 554.034880][ C0] ? __kasan_slab_free+0x62/0x70 [ 554.039858][ C0] stack_trace_save+0x9c/0xe0 [ 554.044545][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 554.049924][ C0] ? cgroup_rstat_updated+0x144/0xb50 [ 554.055313][ C0] kasan_save_track+0x3e/0x80 [ 554.059999][ C0] ? kasan_save_track+0x3e/0x80 [ 554.064861][ C0] ? kasan_save_free_info+0x46/0x50 [ 554.070106][ C0] ? vhci_read+0x49a/0x5b0 [ 554.074533][ C0] kasan_save_free_info+0x46/0x50 [ 554.079569][ C0] __kasan_slab_free+0x62/0x70 [ 554.084346][ C0] kmem_cache_free+0x192/0x3f0 [ 554.089130][ C0] vhci_read+0x49a/0x5b0 [ 554.093387][ C0] ? __pfx_vhci_read+0x10/0x10 [ 554.098165][ C0] ? common_file_perm+0x199/0x200 [ 554.103231][ C0] ? bpf_lsm_file_permission+0x9/0x20 [ 554.108615][ C0] ? security_file_permission+0x75/0x290 [ 554.114256][ C0] ? rw_verify_area+0x258/0x650 [ 554.119135][ C0] ? __pfx_vhci_read+0x10/0x10 [ 554.123937][ C0] vfs_read+0x1fd/0x980 [ 554.128122][ C0] ? __pfx_vfs_read+0x10/0x10 [ 554.132814][ C0] ? __fget_files+0x2a/0x420 [ 554.137423][ C0] ? __fget_files+0x2a/0x420 [ 554.142033][ C0] ? __fget_files+0x3a0/0x420 [ 554.146727][ C0] ? __fget_files+0x2a/0x420 [ 554.151345][ C0] ksys_read+0x145/0x250 [ 554.155611][ C0] ? __pfx_ksys_read+0x10/0x10 [ 554.160390][ C0] ? do_syscall_64+0xba/0x210 [ 554.165085][ C0] do_syscall_64+0xf6/0x210 [ 554.169611][ C0] ? clear_bhb_loop+0x60/0xb0 [ 554.174296][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.180218][ C0] RIP: 0033:0x7fb78a38d37c [ 554.184643][ C0] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 554.204260][ C0] RSP: 002b:00007fb7889f6bc0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 554.212745][ C0] RAX: ffffffffffffffda RBX: 00007fb7889f76c0 RCX: 00007fb78a38d37c [ 554.220763][ C0] RDX: 0000000000000400 RSI: 00007fb7889f6cf0 RDI: 00000000000000ca [ 554.228760][ C0] RBP: 00007fb7889f6d00 R08: 0000000000000000 R09: 00007ffff9aff1d7 [ 554.236752][ C0] R10: 0000000000000008 R11: 0000000000000246 R12: 00007fb7889f6cf0 [ 554.244744][ C0] R13: 000600046003fd00 R14: 00007ffff9aff0f0 R15: 00007ffff9aff1d8 [ 554.252742][ C0] [ 554.256121][ C0] Kernel Offset: disabled [ 554.260474][ C0] Rebooting in 86400 seconds..