last executing test programs: 13.131430922s ago: executing program 1 (id=5625): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000535a4924a38046be5c019f91e0d7906d08b164c6dbc1df43161938316a64ca4f898de1832d5499eb6d8082ee062fd7fe24ba796985e21bcf96b611adb58926de965fffbe3e9a623729385f146c5b1528c854e077d92235b1442bd8c388fbf49aafc2e14b4af055decb9ba38435fee49b08b8270c64c1a942bed6d87fe00773cb8f120b570608000000e7a496f26ce957149d2aad2cfb5a1b69b2b00f615008dfb808cae19bc7f8573b708375dab79fbcefeb2c94a14bd94b3c5063de0f0e94ba8ca9413915989cdce7a3219604c17c00"/232, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0x0, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000000301010400000000000000000200000824000180140001"], 0x38}}, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x4e24, @private=0xa010100}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x19}}, {0x2, 0x4e22, @local}, 0x83, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000040)='syzkaller0\x00', 0x9, 0x9, 0x4}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x800) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x3}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000640)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmsg$OSF_MSG_ADD(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x175c}, 0x1, 0x0, 0x0, 0x4044084}, 0x1dc8b08251aa3334) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r6) r7 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r7, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) connect$vsock_stream(r7, &(0x7f0000000000)={0x28, 0x0, 0x2711, @my=0x1}, 0x10) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r8, 0x29, 0x39, &(0x7f0000000700)=ANY=[@ANYBLOB="000202013b7b0b5262"], 0x18) sendmmsg$inet6(r8, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4db, @loopback, 0x3}, 0x1c, &(0x7f0000000340)}}], 0x1, 0x4c040) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_tracing={0x1a, 0x1a, &(0x7f0000000900)=@raw=[@btf_id={0x18, 0x4, 0x3, 0x0, 0x2}, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x883}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x80000000}}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x2}], &(0x7f0000000a00)='GPL\x00', 0x5, 0x36, &(0x7f0000000a40)=""/54, 0x41100, 0x12, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000ac0)={0x2, 0xc, 0x8, 0x1}, 0x10, 0x4131, r7, 0x7, &(0x7f0000000b00)=[r0, r0, r0, 0xffffffffffffffff, r0, r0, r0, r0], &(0x7f0000000b40)=[{0x5, 0x1, 0x4, 0x3}, {0x2, 0x3, 0x4, 0x9}, {0x3, 0x2, 0x1, 0xc}, {0x1, 0x2, 0xf, 0x7}, {0x5, 0x3, 0x7, 0x7}, {0x2, 0x5, 0x3, 0xb}, {0x1, 0x5, 0xe, 0xc}], 0x10, 0x7ff}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 12.594700007s ago: executing program 1 (id=5638): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000003cc0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@union, @var={0x1, 0x0, 0x0, 0xe, 0x1, 0x2}]}}, 0x0, 0x36, 0x0, 0x0, 0x0, 0x10000, @value=r0}, 0x28) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x20, 0x0, 0x0, 0x0, 0x9}, {0x0, [0x30, 0x5f, 0x61, 0x61, 0x2e, 0x61, 0x61]}}, 0x0, 0x21}, 0x28) (async) bind$inet(r2, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) (async, rerun: 64) sendmsg$inet(r2, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40) (async, rerun: 64) sendto$inet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) splice(r2, 0x0, r3, 0x0, 0xf3a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000057c0)={0x11, 0xc, &(0x7f0000005880)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x30, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0xfffffed0) (async) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000004080)={0x1b, 0x0, 0x0, 0x9, 0x0, 0xffffffffffffffff, 0xbc, '\x00', 0x0, r1, 0x5, 0x3}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000005780)={r4, 0x58, &(0x7f0000005700)}, 0x10) (async) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000005a40)={r4, 0x58, &(0x7f00000059c0)}, 0x10) (async) recvmmsg(r5, &(0x7f00000054c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000180)=""/184, 0xb8}, {&(0x7f0000000240)=""/61, 0x3d}, {&(0x7f00000002c0)=""/163, 0xa3}], 0x3}, 0xfffffffd}, {{&(0x7f0000000080)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000001600)=[{&(0x7f00000003c0)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000001500)=""/229, 0xe5}], 0x3}, 0x6}, {{&(0x7f0000001640)=@hci, 0x80, &(0x7f00000027c0)=[{&(0x7f00000016c0)=""/22, 0x16}, {&(0x7f0000001700)=""/32, 0x20}, {&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000002740)=""/75, 0x4b}], 0x4, &(0x7f0000002800)=""/172, 0xac}, 0x1}, {{&(0x7f00000028c0)=@can, 0x80, &(0x7f0000003b00)=[{&(0x7f0000002940)=""/4092, 0xffc}, {&(0x7f0000003940)=""/44, 0x2c}, {&(0x7f0000003980)=""/33, 0x21}, {&(0x7f00000039c0)=""/101, 0x65}, {&(0x7f0000003a40)=""/173, 0xad}], 0x5, &(0x7f0000003b80)=""/79, 0x4f}, 0x9}, {{&(0x7f0000003c00)=@sco, 0x80, &(0x7f0000003d00)=[{&(0x7f0000003c80)=""/36, 0x24}], 0x1, &(0x7f0000003d40)=""/48, 0x30}, 0xb}, {{&(0x7f0000003d80)=@sco={0x1f, @none}, 0x80, &(0x7f0000005380)=[{&(0x7f0000003e00)=""/122, 0x7a}, {&(0x7f0000003e80)=""/193, 0xc1}, {&(0x7f0000003f80)=""/240, 0xf0}, {&(0x7f0000005640)=""/189, 0xbd}, {&(0x7f0000004140)=""/248, 0xf8}, {&(0x7f0000004240)=""/4096, 0x1000}, {&(0x7f0000005240)=""/229, 0xe5}, {&(0x7f0000005340)=""/16, 0x10}], 0x8, &(0x7f0000005400)=""/186, 0xba}, 0x8}], 0x6, 0x40010100, 0x0) (async) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r7, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80}, 0x4050) (async) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) (async, rerun: 64) getpeername(r6, &(0x7f0000005900)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000005980)=0x80) (rerun: 64) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) (async) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @multicast}) write$tun(r9, &(0x7f00000004c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) 12.343383785s ago: executing program 1 (id=5643): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="2001000016000100000000000000000064010100000000000000000000000000000000000000000000000000000000010000000000030000000080a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe80000000000000000000000000002c000004d633000000fc0200000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffedffffffffffffff03000000000000000000000000000000000000000000000000000000000000000200000000000000fefffffffffffbff0000000000000000960700002dbd70000000000000000002be0000000000000000000000b1a0010008001f00040000000c002000"], 0x120}, 0x1, 0x0, 0x0, 0x40040}, 0x0) close(r0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_DISCONNECT(r3, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000240)={0x64, r4, 0x20, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x27}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2f}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3f}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x11}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2f}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x15}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x42}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x30}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x27}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x39}]}, 0x64}, 0x1, 0x0, 0x0, 0x41}, 0x40004) read$nci(r0, 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r6) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000700)={0x24, r7, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}]}, 0x24}}, 0x40090) r8 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000001c0), r5) sendmsg$NLBL_CIPSOV4_C_LIST(r6, &(0x7f0000000600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x64, r8, 0x0, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfa}]}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x20008080}, 0x4010) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r10], 0x1c}}, 0x840) write$nci(r0, &(0x7f0000000300)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x1, 0x3, 0x5, 0x2, @a_listen={0x9, 0x3, 0x1, 0x80, 0x2, 0x6, 0x2f, "", 0x6, 0x8, 0xd, 0x9, 0x7, "2eb1a87670d39d"}}, 0x16) 11.341520842s ago: executing program 1 (id=5664): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000680), r0) sendmsg$NFC_CMD_START_POLL(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000740)={0x2c, r1, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@NFC_ATTR_TM_PROTOCOLS={0x8, 0xe, 0x98}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x24}]}, 0x2c}, 0x1, 0x0, 0x0, 0x18080}, 0x8000) socket$nl_netfilter(0x10, 0x3, 0xc) 11.206509682s ago: executing program 1 (id=5667): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="700000001000ffff2bbd700001dcdf2500000000", @ANYBLOB="01000000230800004800128009000100766c616e00000000380002"], 0x70}, 0x1, 0x0, 0x0, 0x20048045}, 0x40000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c00038008"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="130823bd7000fddbdf25170000004c00068004000300f4a154373e191a93402278160a5b19034404040067636d2861940d4c8418936573290000000000000000000000000000000000000000000000001c0000007876d6d34836"], 0x60}, 0x1, 0x0, 0x0, 0x20048044}, 0x20008000) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x52, 0x20, 0x0, 0x0, {0x1c}, [@typed={0xe, 0x1, 0x0, 0x0, @str='\\,$!*(,,&\x00'}]}, 0x24}}, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r3, 0x0, 0x2, &(0x7f0000000080)=0x3, 0x4) 11.071725657s ago: executing program 1 (id=5671): r0 = socket(0x2, 0x3, 0xff) setsockopt$inet_int(r0, 0x0, 0x3, 0x0, 0x0) sendmmsg$inet(r0, &(0x7f0000005a00)=[{{&(0x7f0000000240)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000140)=[@ip_retopts={{0x18, 0x0, 0x7, {[@ssrr={0x89, 0x7, 0x4, [@remote]}]}}}], 0x18}}], 0x1, 0xc050) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) getsockname$packet(r2, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x10, 0x3, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000080)={0x2, 'vlan0\x00'}, 0x18) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="d5"], 0x24}}, 0x0) recvmmsg$unix(r4, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/166, 0xa6}, {&(0x7f00000015c0)=""/70, 0x46}, {&(0x7f0000001980)=""/4097, 0x1001}, {&(0x7f0000001840)=""/115, 0x73}, {&(0x7f0000001480)=""/195, 0xc3}, {&(0x7f00000002c0)=""/236, 0xec}, {&(0x7f0000000000)=""/126, 0x7e}, {&(0x7f00000018c0)=""/133, 0x85}], 0x8}}], 0x1, 0x40010122, 0x0) write(r4, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c0000001000010500000000fbdbf82000000000", @ANYRES32=r3, @ANYBLOB="0160000000000900010069706970000000000c00028008000100000000000000", @ANYRES16=r2], 0x3c}}, 0x40848c0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="6c0000001000010400000000fedbdf2500000000", @ANYRES32=r3, @ANYBLOB="0000000001a001004c0012800900010069706970000000003c000280050005001e000000060010000700000008000100", @ANYRES32=r3, @ANYBLOB="080002000a01010105000500fe00000008001400"], 0x6c}, 0x1, 0x0, 0x0, 0x4000}, 0x20004002) socket(0x2, 0x3, 0xff) (async) setsockopt$inet_int(r0, 0x0, 0x3, 0x0, 0x0) (async) sendmmsg$inet(r0, &(0x7f0000005a00)=[{{&(0x7f0000000240)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000140)=[@ip_retopts={{0x18, 0x0, 0x7, {[@ssrr={0x89, 0x7, 0x4, [@remote]}]}}}], 0x18}}], 0x1, 0xc050) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) (async) getsockname$packet(r2, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socket(0x10, 0x3, 0x0) (async) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000080)={0x2, 'vlan0\x00'}, 0x18) (async) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="d5"], 0x24}}, 0x0) (async) recvmmsg$unix(r4, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/166, 0xa6}, {&(0x7f00000015c0)=""/70, 0x46}, {&(0x7f0000001980)=""/4097, 0x1001}, {&(0x7f0000001840)=""/115, 0x73}, {&(0x7f0000001480)=""/195, 0xc3}, {&(0x7f00000002c0)=""/236, 0xec}, {&(0x7f0000000000)=""/126, 0x7e}, {&(0x7f00000018c0)=""/133, 0x85}], 0x8}}], 0x1, 0x40010122, 0x0) (async) write(r4, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c0000001000010500000000fbdbf82000000000", @ANYRES32=r3, @ANYBLOB="0160000000000900010069706970000000000c00028008000100000000000000", @ANYRES16=r2], 0x3c}}, 0x40848c0) (async) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="6c0000001000010400000000fedbdf2500000000", @ANYRES32=r3, @ANYBLOB="0000000001a001004c0012800900010069706970000000003c000280050005001e000000060010000700000008000100", @ANYRES32=r3, @ANYBLOB="080002000a01010105000500fe00000008001400"], 0x6c}, 0x1, 0x0, 0x0, 0x4000}, 0x20004002) (async) 5.170182299s ago: executing program 2 (id=5724): r0 = socket(0x10, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r1) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x1, 0x6, 0x0, {0xa, 0x4e23, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x97}}}, 0x80, 0x0}, 0x2000f765) ioctl$SIOCSIFHWADDR(r1, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @multicast}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00'}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x35}, [@ldst={0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x39) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000ac0)=r3, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x1b) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r5, 0x18000000000002a0, 0x14, 0x0, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e008062000", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x50) socket$vsock_stream(0x28, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl$XFS_IOC_DIOINFO(r4, 0x800c581e, &(0x7f0000000300)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_type(r6, &(0x7f0000000100), 0x2, 0x0) r8 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x0) recvmsg(r8, &(0x7f0000001f00)={&(0x7f00000001c0)=@in6, 0x80, &(0x7f0000001e00)=[{&(0x7f0000000380)=""/231, 0xe7}, {&(0x7f0000000480)=""/82, 0x52}, {&(0x7f0000000c80)=""/4096, 0x1000}, {&(0x7f0000001c80)=""/127, 0x7f}], 0x4, &(0x7f0000001e80)=""/99, 0x63}, 0x40000011) write$cgroup_type(r7, &(0x7f00000009c0), 0x9) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) 2.833270331s ago: executing program 0 (id=5740): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)={0xd0, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MLSCATLST={0x8, 0xc, 0x0, 0x1, [{0x4}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0xa0, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0xfffffffffffffd4d}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC, @NLBL_CIPSOV4_A_MLSLVLLOC={0xffffff61}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8}]}, {0x4}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0xff47}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}]}]}]}, 0xd0}}, 0x0) socket$inet(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) sendmmsg(r2, &(0x7f0000000180), 0x4000190, 0x0) 2.748254369s ago: executing program 4 (id=5741): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x475, 0x8, 0x3}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x4, 0x81, 0x1fd, 0x0, 0xf29f}, 0x1c) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x4003, 0x2, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x13ed, &(0x7f0000001700)={@local, @empty, @val={@void, {0x8100, 0x2, 0x1}}, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "f7849a", 0x13b3, 0x2f, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[@srh={0xac3e0b17b057d8b6, 0x4, 0x4, 0x2, 0x80, 0x10, 0x7f, [@private1={0xfc, 0x1, '\x00', 0x1}, @empty]}, @routing={0x87, 0x4, 0x2, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}, @hopopts={0x2c, 0x7, '\x00', [@calipso={0x7, 0x20, {0x0, 0x6, 0x7, 0x3ff, [0x9, 0x9, 0x9]}}, @ra={0x5, 0x2, 0x5}, @hao={0xc9, 0x10, @empty}]}, @srh={0x6, 0x10, 0x4, 0x8, 0x5, 0x30, 0x93b, [@dev={0xfe, 0x80, '\x00', 0x31}, @remote, @empty, @ipv4={'\x00', '\xff\xff', @empty}, @rand_addr=' \x01\x00', @dev={0xfe, 0x80, '\x00', 0x26}, @mcast1, @mcast2]}, @fragment={0x33, 0x0, 0x3, 0x0, 0x0, 0x9, 0x65}, @dstopts={0x3a, 0x2, '\x00', [@ra={0x5, 0x2, 0x4}, @jumbo={0xc2, 0x4, 0xfff}, @jumbo={0xc2, 0x4, 0x30e7}, @jumbo={0xc2, 0x4, 0x1}]}, @fragment={0x29, 0x0, 0xff, 0x1, 0x0, 0x14, 0x67}], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0xee, 0x0, [0x82e, 0x7], "a790a9cdecdd528635f378d2e6b53d6a52852ea7a7824d0e7ce59d2baf007183da1b6d520ec9fe6e3a89a7c9013ea5c7a0f47faf803e1ef87b2cc4329d2e3c86575582d49b754963acf59456ae782ae5181f97d40b83d73bcbd1357c55d31ea7ff54e2dc55a7b0a99db0f0a95f9b462aafd259e2876654e6a628dd21bd5144935a1b7c4f2db9deef2e53e852d8028cf81206d49030bf795d2f4f97572fcdf3624c4145ec8c79f7c5465f6064e353971a17617676eb3fe5b4fb7c2c1d8bc328a2fd5c9f4e8469dd16f65d0a8886cbc9b71b61799493b8654874b82f3a56f1462de590f393350613112cc120ef1ba6"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x800, [0x0, 0x1, 0xfffa], "7c5b1bddc188ec2d99a19a505e50cf087a9dc3a449477da88c59182cdb226d711914359fdaacb4077d1e7e41d5fc1d79df9181826fcd7775c132a4003edf4b121dd9c5e9794db9ea95622e5300c6c6e1603d356b1b5484fe9da4d61f513944c9214a1311b157f6ed952fd0e79c86c89861d3a6538dc8ab9d29"}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x86dd, [], "dc902d051241a28c7836c6e044c9c050f5239a9bc2d5cbc1a0a93d87aee7cb901d0e54f0540f17d2fdc0736570b368f9b0d1c81e19bc5ec384c06e7151445d507e2912b522bb1948a9ec2a64c24d9b3afe7f97452a28ad0ead0b752e61f301193bbd6b3835d08a93ffb1f48d1b320030204611ec954ab128482a65cfe7c760d2d6cc23f1afff80e25e489e226f0661de500d6335e86898dfc9c83920bb5d7acbe01a9a867187f7b9ed5d9a17653bf33af7456bf8ab67"}, {0x8, 0x88be, 0x2, {{0xe, 0x1, 0xfb, 0x2, 0x0, 0x3, 0x6, 0xc}, 0x1, {0x1ff}}}, {0x8, 0x22eb, 0x0, {{0x9, 0x2, 0xe, 0x1, 0x0, 0x1, 0x5, 0x6}, 0x2, {0x8, 0x3, 0x0, 0x3, 0x0, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x4, "9a68ea18a173eec259a41d60dd763c1889b2ebd8c1071c7afc1a7c682d61ccd98a17b427067251d48fc6d655b055d5ccafabbbca79b3ad70b938bec358c3436e8be3cf1b055f21c2da6f4e2b9c8ee8856b44933948a6bd5651aa5c53247ef2f3297c9d9ef3dbf5fb40aa79200701a8d9bdbb7460a93e82ba6947a8cc8ed68e3d4fb75588b88e588462f9fa526bb54a4fbea4683bb3f96d90785e9365d846abb62a332e256b10ef5afc67aba88d33d633192d78ce90b74350f57ecece43bb2cfb0e63f2f4092181596eee68512616441ad7bb83983f6e1ad84d604db907c222e6820802a0ab6250a66e361158d938be6e028f5082695fdf77be5ff4cc2f6fa991cd9dc55e29c40d5d6fef5912a3f9936093aba20ae1ccebe406215afaf10b7c4e5a2c3e640e88e86044bd6b718cc7fc8eae55d955d144faffbc5a56f46305462adcc67eb88aec181d2321326e9521e15c2beaa753db74d0730738c0cc54ae430b40848c3d25730b80a3ede45bd2bcc31d1cd68a4baa690a56ee42c3b5de723adeaa484f73129dcb9eed6a78c8129fc2238701df9eb31d5e3f4bc2cbd11f8ea6fa4f3f87c784521bdd96d93ce3723b7c941ec212f7eda431aab876338bc327ba48bb11e7662c2bcfa98be9b9c614aeb4d763041b3853b03808edf9c9a41f19b90bc28a824e6b2d4c280d62698bea2028b1cb60f76b03ac468b76f456d415f91d4d0c236b00499bd71c719085361a99fd8a15f32f711f508efb87e0c95e39e50b6569de32268e57ecf831f9623bbc9a581935a752a2171020fe206351da0fb0b6792dd9c84b9f1932725702c12d3b212b90617344a49bf1885caf95dc70b2c0057bc5150249c7c936291724999e4391c7cdbd2c5d4e4441ed079b1f5612bc9e954d34d1fe90bdfb3e991dc597740bb33fe9896512c826bf0e85d6ab2ed08c560e4e07571ce5fdd4e039af9aee685f0814123ee278d06e42a96d88f22d6161652fa510bc6005d3e3a0725532973a8c6c007703307190a4afe538f134b5479ca2ec038eb88cd3c6ab349b01e74c34596a6978af2bc63648d9bdc487a1c741d296d652e4f985627bf30743f3219de307ec2d367b84f2fbb88cebcc9a405ec9f246950bed07e83993a0aafce9ef31f0757effe321ec767195a8303a587eb26afede81db223848fe0568b78e3532bb2b13ce1eb8097e5c32ab7f90f0d24bcff09de5b3f92e26d16e69a94ef74b09a7806a452198276820e316b3ad3d4a711e8aaabfe021f9fc906cd62ca231c40691e2d9b82d43a30e26cfd5b7fbfaf374b9fb7951dd1baf071e9cb43fdd32a7081ac3f26db33938aeabf759cd47e77270664316a2135496cb209e4379c34c5a6c4dff1d25824b7c9b070b6edd398eb418e775acc64aaabf52a3842e704dd3a269fdc8e65fc674056e563ff125ea805dcdb86cc30065b8b737f24a8863b6549ec4853a7d4e2af514f6f17307ad9dbfba26ad600ac234e94862ea1e27873677b653067278a61ef81008403ce9cba997f6b393510a2e89c26da43be29fe2d13e9cc20a9d8a268f4d3b19a34caa4bf42d838b06d125301b2adc747fa5cd829b02815782e98a9b6fc8ec5e98f0bef7a4d5d81567e16575ab8b77598fae3b02acde36adaddb2502d915c84c9ea87cf62bc39416e1a19390325b1d6c59c6e9072953fcb4a2f51ca5e23f8ef4acba8e3d9b8cc78378cc84f7e9794e3af872c190f65f0c0b0eaad4dd6fd181f41964e030815e6cb07f0a9db272b61c7a2cc507ac7757534c8cf228ebafd310d21aca433cf5237ed13a891ff5adcdcb21535314d25f9a1a4c351775d712a39b2f07608d32d03e47cb25e79facf43ab275fcc456a71ff2f151603acc0b3a3719baf38fcd0cbf27ab6b9aa21564aaacb19ddc06e71e66aa7f43e7ecbc73a639ed33da84bb5da758df6303dc3361797346c17c1f3fb18ee74f206e0ebd526796aecf703732b94f3542df21743020a75cd0d5972b9169f38ec50a05dc5f6558cd78eecb24576b3c055de817abbaa6defb4e104aa310338560f55042f46fb1493bd9799e05467af8fb9fcca53fdad09e106560621563dd35e7966e03e212a59011e16e1e0e266fcd41d02b95b969b4ff69cd1260f09182624565fe9358c2caf616c5434a017c02a66acb0c47064406065fdb2e6fcf09206e9c2c98952cf6d22ee67c7619ad215cbad10a80904cba892ca96fbbce4ada507e2aab95cb420c21f770d6ba806ba29036d40bd9c70d0116b6fa89bd3e21ff1adf6291a9348102dbd9af1a08ddce2cd29ec47838afabec212c5e70e07e63e772b1461c649d802b5e578e6a383584ccdd70480dfc8178d1f13baff999ed97be683006894852991a4e19b765101181f63a00ea41585c0f0be827c671b4d06b0729aad8c76786a2d249f31915f15cf4ef056109ecfc2267248adc26b0591e6c88e17c795321b630db49998b6efd51210c07b20dfcfd506858bd31076a701d5a10d24e04ef7e07babb43cac8b56bbadce6bd45f75c469f26e9f52613821e0a3308a656a31f6d0264ac2645955488e8fd0ca5ad3620a4641924e04c7d2174e9da3e18bbc6dc182a642a295aad9d8820ae7b5baeebdb2a9f68f47fd814ea027f87181ae7892098cbeff8b1eac6cca487815df53e5e34cc325376afa8a4d06e5cf2a08c6cb810ae502582ffc5c78d78400b95b7b0f912424b3d2d1f99090467fc8c2becd0629a6e374d830b295469ec28bba47e90dc7123eb67fec5faca554217f99f5de5802d29451883b22114fa4b388cc8af81893ccb44b9034bbd3adb91109ca67eecb0295a0bdfb98b218bf520905125d717be597496e65082a669610629e38a0096781702daafceb18aa9f5369575c64cd7abed072ac161993e18d9000fcb106c1d3b489e3b0ed83231008c202351ad01a2f570c4addc344a36abf6b69d4cda418c43a5238777bfb4f12dec408210490c598cf271d19419299227bffd79b131dea114e96e826233ea959d583503fc8abf84b296679f0ff6ff10c6f53b7391a2cc916af7c9f82926a495251be91b7d4e5a5d7639a0fa0aaeaea834835bc21a5b14e25b8edd84585e248f6fc385d29f1c61c0db3b617b38643905b311a70d27d584e12285a6a5ed43d77415d3321044cc3d215eb8ddd43239af1092f478af1ffe7af59eeeda4c6f175bda28721015dc7917c7faadabd2dcd1f53a1b24e3b84fb956dda007ab0eb134693a0b7a73871f1d8bead8d07412e697f578fb5dc6a19c9e70259f1273a9fc0b55b3540a35f5fed072750a386a066099b458e159ab8dac322a7bf61726f48825cdd6a5a947d8aa548d4e8941f58ce034f0bc5c9d099a93e29710490bf92c8dd7e4f148937ada5f6e76d5fd5b88956c575afd17bc63680ca2e063a42098cc4b353b95644fdd397f365002b10f5ce21d0a7222b79904c35a960a21398f64052434085c45bda30a3e760affbe852d4678d737397a71430ceab904ebe074075174e94f00d15799296b1d13e216eeb8f91b9dec7c45842f25b0d039f6320c08025631fe769e0a358444d7ae7307e03a17798eb064de8f6f9c41c849796169e4f956e7fa4aa4074d9e5cce4a324fc4f2130d762f348f4e926c267c030b1801168c9598b90a724795536a4b20fa616a562dad48c88f8fe61ad29b7dbd239f64434abfecbb3f4d02eafcb2834ae8d46bad0d450acc3737abd22b63abea05668b1ca45a92bf99b293337f61e0ba42fd5035ba8d2716fdca48a345ebcb8cb21e9c96976d9e885a8a37e0b4160e45d6d369cd7400966ce78b1bed2a13c0c394a7d596d3a2d1fba00ef71c150d66f09713ab61f91f4ec7301c4336553b1c171fe82d08907a636cd491af743f97a93eb7814813164774f916f50dca2acc38ae7edadfe6e220c03311972ea0ad740b2db030d30713b105d933fafacd50e059ba0a01e56592759e1e1f2863620fb9a38925b5c3e51c5d90edad5c4b157574e0b06cb8f669e056e4eb4507c25ed639649e61c3f5d548c544a94bffeaf6b551e441bfe93cb6c6440822f1029ffcf74bb244b7d14a371f1bb526d66431ba3ab60861ebef807a5f41ae45d7b1aa33f249ee96c2d6da9e023c500abbf77834cf1ed1055a5571fa32c6e3db6a07003da2165d4196ea88a2f63122f66ab336c48ce740893cedfa5e569ace6c1190d3f3977ea00f4cd59d627707938e583d1892aff8a47739a20dd7efd1043f0fc4961d96c4b2f2147a71c274e8d4618390f41781e2780de3d719145e4c83095e65d3464a611c3b608d36c203ec92e2eaaa9cf2fa437e2c673f95d92c47ba621ff09d040bc6ea5878902f2cde6aadd798916b704cc8bd8f6999bc145906ad90be04f574819288c3c65a71ef847d436030c937e70fa7725bd06eccf72c79c4bb4856346e3b8c005849a023532f55f56d0081713c3dc0952ca520b5438d071600cbdeb1cf1609003bb1afe29487d571e3d4264317596f4cfaaec3ec67349bf65a7c028ccb9e1b3ecc67c4ac9ea77a8f726a5022d2d91fd381e0fb2ed262e2ed62446c9d33771031295da79b07a3606605a4bd62fe574368a676d8f141bd09c72d40eb7097f38fb2e7748ad7c86517e7010a5867dc0862516510b110093013712eecbb71a92e8f274fe04ca48e15f4b86a957a52fd590a24b0e336240964d5e832f0e1c6b1006133153f12a18ef87a0fea7e6227f34028dd0941a599c0a641d681694806aa07f6077410b2acd35cceffc385cccf2041b940069da541531045b154f85f69e55b1ad4228ca475dfa83153f7b54223854e94460b5a2e05b6c9cd74159564e380f5e14abae26805d2a11ef4c35c16f32643f7b96df3a718c3ea6cc1b6eb97841a50be0daebea399342d7844425966f9421d835cfeb5a37b73e3b09d80750a4c1a1e8b638b522a324eee1709c4c67527d8e980711c19de21fb4952a53eb74ff0544846d92b7c5176f47e0d138224b91f40b5c5950d3de6840a8e48f252090b960af266a3e84f9953073a530adbe22280fd906e18643cdbaafa28e361cafb696eea7bfa1a718680989b11f7634070097476a9a4d86db74dea915ffcba1faf1580bdb7f21af283b3670ea87ba35a125e60878c8003ea4b2ac60a1fdfd85e28581219825df5a193d3684540a2279bff95526429da463c62217da226639373e853472f4b39ecbf9b8a5be42076a50ca600d43049b270b3539e7d5fd84eaeb3c8528b75b8cbbb80c764979d402dccf180237e94c1c319de1c8a9bc5aef1348c988ed534ce1edba59ed9f7aac8d81d9e01e6468adbb3b809ac076dc0550418d4a278453ee1eabb23cbfb72a8d1ba357a64fb664ac3944088ef69b8aa8f74689085b185be5bf491fcd1e9842c851dbb5da32bdd6f29c5e783e37e6cb6ea27b54e488056f70dc197760bd8e24d5b8fe905885d68c52de4a1904978c255a5d824a42be1a067055c8c4df78f1550a847fec57717f1881f08572ba394bc982119aa8f1583078e16b4cfe437f0b9dbffd84a6dd87b566c24a60ed8d7b8ddcc1b28d5187dc54652c55cef864f03b0761c354d12d60f46875729432e64354a0226f7f80e55acaadc26512781660071d92dd812347f9873cc2ef9d2582609b8a7e2f182c550ea08daae96e5a582926944f702e9eacfbb1423c8152936d3a48fc0783ceeb302e4673c6c256e9a72b2da0fde4ac874eb969e89359b58afcbe4be5d1492712111e916b708d143ff2b889de523d4b6c2f67ef3a242b7f247a04c5d67dc229e3067ef46fcfa8d5139ad16cc5acdf4eb7cc46f"}}}}}}}, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000005cdcdf4a678976e9640601fe800000000000000000a5d9c5f7d3250000000000bbfe8000000000000000000000000000aa80004e22b4e5e8331643f74bfba86f9ef0ac8abb124b7c77add3f051461cadf6935205ceb38291af07c77abe3b52a9179c9f6970f3084f9a286bec4cbc38e148b2a073a2478bac4373b736e280e1f26096a2bfddc6fa06df5e709ca80c8ebd98c6e18a7e8bd4d0b4dbf35583b268dbab25e1a9ada966c121db956d692e41d7311b", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="9002000090780000080a00000002000098ca04020303d72204914ffe0ef98960f28f1d3aafafb8ab3e13128098cf093cc9cd7b8ec814f9bcfdfea9051a00000001fffffffe00000003000000060000000100010001000000"], 0x0) recvmsg$unix(r2, &(0x7f0000000100)={0x0, 0x1d, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x10, 0x803, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x7c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}, @qdisc_kind_options=@q_codel={{0xa}, {0x14, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x9}, @TCA_CODEL_INTERVAL={0x8, 0x3, 0x8}]}}, @qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x2, '\x00', 0x2, 0xff, 0x0, 0x8}}}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x90) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r10, {0xa, 0x9}, {}, {0xc, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x1, 0xd}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x60000080}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x3c, 0x2c, 0xca7, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r11, {0x4, 0x5}, {}, {0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xffff, 0x6}}]}}]}, 0x3c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000040000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000530000008500000005000000bca90000000000003509000000d44a6be5000d0000000000b702000000000000739af0ff00000000c509040004100000c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007060000f0ffffffb70200000800000018220000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x800, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x1}, 0xe) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000700)=""/4080, 0xff0}], 0x1}, 0x20) socket$packet(0x11, 0x3, 0x300) 2.4348062s ago: executing program 0 (id=5743): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2, 0x1}}, {0x4}}]}]}, 0x58}}, 0x4000010) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket(0x2b, 0x1, 0x1) listen(r4, 0x5) (async) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x4c884}, 0x20008000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x28, 0x3, 0x8, 0x201, 0x0, 0x0, {0x0, 0x0, 0x10}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_UNACK={0x8, 0xb, 0x1, 0x0, 0x1000}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x78, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x3c, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}}}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a01020010000000000000070000000900010073797a300000000008000240000000032c000000180a03000000000000000000070000090c00054000000000000000010900010073797a3000000000140000001100010000000000000000000200000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40c0) 2.376940999s ago: executing program 3 (id=5744): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8ae8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r1, 0xffffffffffffffff, 0x1, 0x0, @void}, 0x10) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f000000bf00)={0x0, 0x0, &(0x7f000000bec0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c0000001600010000000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="1400010000000000000009000000000000000001e623c582982d7451f6036231b3c31f329ad9976765ba36ee1812c6d8c4c60aee2144bfacc72f4590d1e8a03d43869e54f988993857b7984256b761513b11044f02ec7b7c98c0c7755ad5ca8ff597c8ae312a"], 0x2c}}, 0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x840) unshare(0x2c020400) (async) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000000)=0x20, 0x4) (async) listen(r7, 0x0) (async) close(r7) (async) write$nci(r2, &(0x7f0000000a80)=ANY=[@ANYBLOB="7f0092983aa230a62b6fa3c05f1df975e9647d193b95b5bdc81baf4be178ca123f352ace1b808034b17366792df1d87479805bb2389c4875db05000000000000000600354e5cc6834be89354ebf7045e54a47f9142867a62ffa322cf7c11983c73449454e3e6b4c3a6c0bf5a5f92c960a9f493250a9afbf0615ff8091caa5884da6d521698e7599103b9777bebe892fc0e7d8142b6ce8df48de02650"], 0x9c) (async) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)=@generic={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x18) 2.283103865s ago: executing program 0 (id=5745): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000000)={{0x2, 0x4e22, @empty}, {0x6, @multicast}, 0x18, {0x2, 0x4e20, @broadcast}, 'vxcan1\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005400e50100000000fdffffff07000000", @ANYRES32, @ANYBLOB="040001"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x30) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000010a010200000000"], 0x14}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'ip_vti0\x00', &(0x7f0000000200)={'ip_vti0\x00', 0x0, 0x40, 0x40, 0x400000a, 0xffffffff, {{0x5, 0x4, 0x3, 0x8, 0x14, 0x6b, 0x1, 0xf7, 0x29, 0x0, @broadcast, @broadcast}}}}) write$tun(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="70000000ffff00004000002f90780000655800189078040000000000000086dd"], 0xfdef) recvmmsg(r0, &(0x7f00000058c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 1.978593204s ago: executing program 3 (id=5746): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xa, 0x4, 0x4, 0xe, 0x10, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xb, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000002080000850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x8, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0, 0x2, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2c00a800}, 0x94) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) (async) sendmsg$unix(r4, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x358, 0xffffffff, 0xe8, 0xe8, 0xc8, 0xffffffff, 0xffffffff, 0xe8, 0x288, 0xe8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000007000000850000001b000000b700000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095", @ANYBLOB="a3fcd9480a36452e70938abae2955e4780ae7b37552f9507d0fae7dbbdeb18e8"], &(0x7f00000003c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r7}, 0xc) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e61, @rand_addr=0x64010101}, 0x10) (async) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='nv', 0x2) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) (async) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r8, 0x0) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000540)={{{@in=@private, @in6=@initdev}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000000640)=0xe8) (async) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r8, 0x8983, &(0x7f00000004c0)={0x8, 'dvmrp1\x00', {'pim6reg1\x00'}, 0x7}) (async) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) 1.828016154s ago: executing program 2 (id=5747): r0 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_SIOCETHTOOL(r0, 0x80108906, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r1 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="1709a70000000000000101000000"], 0x14}, 0x1, 0x0, 0x0, 0x4004001}, 0x4000) sendmsg$kcm(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a00100000000580607ee622", 0x2e}], 0x1}, 0x0) 1.811676382s ago: executing program 3 (id=5748): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000340)={{0xffffffffffffffff, &(0x7f0000000000)='@..#.\x00', 0x200, &(0x7f0000000040)={@_ha_fsid={[0x8, 0x7]}, {0x401, 0x1, 0x7, 0x4}}, 0x1, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0xa}, 0x2, &(0x7f0000000300)=[{0x3, 0x1, &(0x7f0000000100)='\x00', &(0x7f0000000140)="716aeb1f9f2028550f5606cfee69e58a75475b5778ac1811e190ef656445195f333eb3dd48a12af27449046790d685a1d864baa8a1104a329026b3945f03bc01d4aa272ee6d8e12120f6479ed1e4dbdbd3d8742765c08234b8b8c990c6e0717559f27bdbee4e0d36233ee403ccdce4e66997888251aa23103acb9972255239d350a78ac033c00053a08c169916af413367225b6f7d82310ac133a92f6f6d54362802fb584434e68561adb6bec8ee1b16d2a3fd4b7741cf45", 0xb8, 0x2}, {0x1, 0x4, &(0x7f0000000200)='-+-!\'-\x00', &(0x7f0000000240)="e62d5e27ca69643b83dcf0afd0311bba00bb8dcd7cc9ad843edca2428d9489ff30cff1a460f91f7477b5cb408574829d88d9db71766b69af716e1ae2e65834d719e0a8fb32a06785173021b3ea0dd3b515ef47030a9056fd70e7754e44723bd5a3d3d2b4667569eba1f59d8a479e660c42de92f2694efa3ab65ffdd12a959d02ec89340dbc4e9480f1", 0x89, 0x10}]}) sendmmsg$alg(r0, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000003c0)="a7d655bc3c886252f23da7e24f34480ad303aa500dbeda36a823a40dbeab8f4d3429f3db12f22321b22371f852a677d7dc0eb1d10eeba388a74a41ac045576405a", 0x41}, {&(0x7f0000000440)="cdae3b52e4826577d63366816805345d54ec3086dc6469fc3ae37cf9a6255da5d9b3a93195eaf1d3e3b5a0c36edadf4c3bfea0e723e0d9520245d8a738610e7ab1971ff7042ca282c9f94c46b1324ee6c6f4c103b5230d8dadd027", 0x5b}, {&(0x7f00000004c0)="1c683895c995b8d50ab104aa4307e12fc6cdd82191943cd0e27174b6a2c35feec8060fb68a3358cacebcba5b6daa93190bfcdd7f6dba4136ef8cc747e2ddbab6a660aee96e358930af97035c546e995adeb40c2730648b6bd114a95517a60d2d098403e245187fe793660c93b0658a49004730868dc9e2c8c249bbb4eef0ace44ddde134716f95abdfa6e268d2be340c0a15fc083ac2f396ff4ccb2b1a9e", 0x9e}], 0x3, &(0x7f00000005c0)=[@iv={0xe0, 0x117, 0x2, 0xc6, "b5344f88bcb705f7d0522fa857bf7e0c923f1fc0664ce06ebbe9d2122945982086a3ab2e9e3d4ce26e3c2c6725b14666ca4347442c253b06100f40f00cea0e6fa7d05791340f7a044031ec6c4893dc5e4edec0f347b8556df798bef2019472b766229d413a568c5c7be0a1e96c17d68b5e691b0fb8edd4809e8d1ea152dfc4e1981a7a692e0a3bde1add473bdf77d641d1443314589b398409f2e970bc4e8971086dea102894ecc16757557081e6e5236b0cbd620c200e6fc604e00775c09a655c087e6b13cd"}, @op={0x18}, @iv={0xd8, 0x117, 0x2, 0xbd, "6f11b5fb2d6f2e96719ceaaed671bf4e8ba2c1626db69b77b0301dda91a181d824809a7db2743ed20f31620d74930adc3f91a53caf7dcb0c091ac09b90b0bee33c3de257ad566111b48d39782884649348e05e857cc6a3b68029798fec7d63360372572ec6503c5de9dc2fa266204337a46a877c66b83c7ecbb2deec1ef2c21ad6b1f74f1b983d3965f0449b7b75c7154218b13260266b1eecbbee5f9ef3505681a23e4286063d753909562205fe8f46cb80bcf3540de29ca275430c67"}, @assoc={0x18, 0x117, 0x4, 0x39}], 0x1e8, 0x24000000}], 0x1, 0x4000004) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000900)={r0, &(0x7f0000000800)='-+-!\'-\x00', 0x100, &(0x7f0000000840)={@_ha_fsid={[0x9, 0xffff63bf]}, {0x0, 0x0, 0x7, 0x3}}, 0x1000, &(0x7f0000000880), &(0x7f00000008c0)=0xfffff55a}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000940)=r0, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000980), 0x80000, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000009c0)={0x0, @in6={{0xa, 0x4e22, 0x91, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4}}}, &(0x7f0000000a80)=0x84) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r1) ioctl$EXT4_IOC_SETFSUUID(r3, 0x4008662c, &(0x7f0000000ac0)={0x0, 0x0, "64af70353f3fde2c7b13650508aae651"}) r4 = accept$phonet_pipe(r0, &(0x7f0000000b00), &(0x7f0000000b40)=0x10) setsockopt$PNPIPE_INITSTATE(r4, 0x113, 0x4, &(0x7f0000000b80)=0x1, 0x4) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000bc0)={@initdev, @multicast2, 0x0}, &(0x7f0000000c00)=0xc) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={&(0x7f0000000c40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x70, 0x70, 0x8, [@var={0xd, 0x0, 0x0, 0xe, 0x1, 0x1}, @union={0xf, 0x5, 0x0, 0x5, 0x0, 0x9, [{0x9, 0x3, 0x9}, {0x10, 0x4, 0x180}, {0x0, 0x3, 0xad}, {0x7, 0x1, 0x6}, {0x6, 0x0, 0x6}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x4, 0x9}}]}, {0x0, [0x30, 0x2e, 0x5f, 0x61, 0x5f, 0x30]}}, &(0x7f0000000d00)=""/98, 0x90, 0x62, 0x0, 0x4}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000dc0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x40, '\x00', r5, r6, 0x2, 0x0, 0x1}, 0x50) r7 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r7, &(0x7f0000000f80)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000f40)={&(0x7f0000000e80)={0x90, 0x464, 0x300, 0x70bd2c, 0x25dfdbff, "9fa376bf8dbfaef4d551b98b69c926792bc1e8879c2baaa090351f33d77ba77decbc7bfe7d4e6a78ebf4183d4187348903fada65a8553001ce6ce11637575ed4754593361464fff93542c9be38bb2decf106ac0dfc0d11d81baf4fb9402deb38b6f668440572428294f740b29756435e13dfd622cb9b970c52813c9bcb4b6c26", ["", ""]}, 0x90}, 0x1, 0x0, 0x0, 0x48004}, 0x4c081) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000fc0)={r2, 0x50, "e5c615c35c8953d22fe4374a7b010a5997df2422d45ba68f69c42d7193c23d7f54d1c2a812a6f5e7638f2babcc991b68b23dbc10b330cb48e901ebfa1dd90da3326caf268fc37da8e5229b28534f0b6e"}, &(0x7f0000001040)=0x58) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000010c0), r1) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000001180)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001140)={&(0x7f0000001100)={0x24, r8, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x800) recvmsg(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000011c0)=""/91, 0x5b}, {&(0x7f0000001240)=""/236, 0xec}, {&(0x7f0000001340)=""/66, 0x42}], 0x3, &(0x7f0000001400)=""/136, 0x88}, 0x100) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000001500)={r2, 0xaa, "ec04b17a01b0eeaf5d76890a9ed36f290e76214db15e3bb17fab6212f0ee644260d2a6ddd41463f690ab8ab01f7c8e61f30a19755a8de9b991c966846fac3bf2a0de18e06da5d21e282d361b70b210e3b36a4edd874d48a80400d1a11367046870e76495312e28d9e6120d9f04aed4e416fa9bf53f5ad5081a7986f56a5bdf7e3481f142c48bbe9d099b892e207a27af5b89de7b89fe1dc37beb130559a987cf32463be206c086d30edb"}, &(0x7f00000015c0)=0xb2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000001600)={0x0, 0x8, 0xa, 0x8, @vifc_lcl_ifindex=r5, @rand_addr=0x64010102}, 0x10) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r9, 0x0, 0x2, &(0x7f0000001640)={0xa45a, [0x1, 0x100]}, 0x10) r10 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$ARPT_SO_GET_REVISION_TARGET(r10, 0x0, 0x63, &(0x7f0000001680)={'TPROXY\x00'}, &(0x7f00000016c0)=0x1e) r11 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) recvmmsg(r11, &(0x7f0000005f80)=[{{&(0x7f0000001700)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000003940)=[{&(0x7f0000001780)=""/145, 0x91}, {&(0x7f0000001840)=""/4096, 0x1000}, {&(0x7f0000002840)=""/88, 0x58}, {&(0x7f00000028c0)=""/4096, 0x1000}, {&(0x7f00000038c0)=""/2, 0x2}, {&(0x7f0000003900)=""/57, 0x39}], 0x6, &(0x7f00000039c0)=""/105, 0x69}, 0x1fc4fe1f}, {{&(0x7f0000003a40)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000003c40)=[{&(0x7f0000003ac0)=""/92, 0x5c}, {&(0x7f0000003b40)=""/199, 0xc7}], 0x2, &(0x7f0000003c80)=""/160, 0xa0}, 0x3}, {{0x0, 0x0, &(0x7f0000003e00)=[{&(0x7f0000003d40)=""/157, 0x9d}], 0x1}, 0xffff}, {{&(0x7f0000003e40)=@nfc_llcp, 0x80, &(0x7f0000003fc0)=[{&(0x7f0000003ec0)=""/252, 0xfc}], 0x1, &(0x7f0000004000)=""/4096, 0x1000}, 0x1}, {{&(0x7f0000005000)=@ethernet, 0x80, &(0x7f00000050c0)=[{&(0x7f0000005080)=""/15, 0xf}], 0x1, &(0x7f0000005100)=""/149, 0x95}, 0x6}, {{0x0, 0x0, &(0x7f00000054c0)=[{&(0x7f00000051c0)=""/114, 0x72}, {&(0x7f0000005240)=""/228, 0xe4}, {&(0x7f0000005340)=""/12, 0xc}, {&(0x7f0000005380)=""/136, 0x88}, {&(0x7f0000005440)=""/17, 0x11}, {&(0x7f0000005480)=""/36, 0x24}], 0x6}, 0xfffffff8}, {{&(0x7f0000005540)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000005b00)=[{&(0x7f00000055c0)=""/110, 0x6e}, {&(0x7f0000005640)=""/220, 0xdc}, {&(0x7f0000005740)=""/133, 0x85}, {&(0x7f0000005800)=""/202, 0xca}, {&(0x7f0000005900)=""/232, 0xe8}, {&(0x7f0000005a00)=""/254, 0xfe}], 0x6, &(0x7f0000005b80)=""/152, 0x98}, 0x2}, {{&(0x7f0000005c40)=@rc={0x1f, @none}, 0x80, &(0x7f0000005e40)=[{&(0x7f0000005cc0)=""/190, 0xbe}, {&(0x7f0000005d80)=""/156, 0x9c}], 0x2, &(0x7f0000005e80)=""/200, 0xc8}, 0x2}], 0x8, 0x40000101, &(0x7f0000006180)) write$cgroup_subtree(r0, &(0x7f00000061c0)={[{0x2d, 'cpuset'}, {0x2d, 'devices'}, {0x2b, 'net_prio'}, {0x2b, 'net'}, {0x2d, 'rdma'}, {0x2d, 'cpuacct'}]}, 0x2f) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000006340)={@fallback=r6, r1, 0x2a, 0xc, 0x0, @void, @value=r1}, 0x20) 1.751330282s ago: executing program 0 (id=5749): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r3, @ANYBLOB="1f003300d0000000080211000001080211000000505050505050", @ANYRES8], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00'}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x20000080) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, 0x0, 0x0) listen(r6, 0xfffffffc) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x8002}, 0x50) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x1c, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xfffff7dd}, {{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x1}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r8}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000001b00)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}, 0x94) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), r7) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc2(&(0x7f00000004c0), r12) sendmsg$TIPC_NL_LINK_GET(r12, &(0x7f0000001880)={0x0, 0x0, &(0x7f0000001840)={&(0x7f0000000500)={0x14, r13, 0x1, 0x70bd28, 0x25dfdbff}, 0x14}}, 0x44000) r14 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r14, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="0702000200000014000180060001000200000008180300ac2e000000000000000000"], 0x28}}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r10) sendmsg$BATADV_CMD_GET_NEIGHBORS(r7, &(0x7f0000000680)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0x64, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x4004886}, 0x20000000) 1.58948081s ago: executing program 2 (id=5750): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000078000000090a010400000000000000000700000008000a40000000000900020073797e31000000000900010073797a300000000008000540000000213c0011800a0001006c696d69740000002c0002800c00024000000000000000030c000140000000000000010108000440000000010800054000000001140000001000010000000000000000000084000a"], 0xc0}}, 0x0) 1.56790694s ago: executing program 4 (id=5751): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)={0x34, r1, 0x1, 0x70bd2c, 0x8000, {0x34}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x20000000) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x2c, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8041}, 0x0) (async) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r2, 0x10, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x0, 0x34}}}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40895}, 0x4000) 1.427151135s ago: executing program 2 (id=5752): r0 = socket(0x10, 0x803, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x2, 0x6, 0x0, 0x2, 0x2, 0x0, 0x0, 0x40000}, 0x10}, 0x1, 0x7}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000056000100000000000000000007020000", @ANYRES32=r1, @ANYBLOB="200001"], 0x38}}, 0x0) 1.424422089s ago: executing program 4 (id=5753): r0 = socket(0x18, 0x803, 0x2) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89fc, &(0x7f0000000000)={'veth1_virt_wifi\x00', @local}) syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @link_local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "3000bb", 0x10, 0x2b, 0x0, @private2, @local, {[@fragment={0x0, 0x0, 0x3, 0x0, 0x0, 0x1}], {0x0, 0x0, 0x8}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000500)="7c5331fc9356b5b1000600008100", 0x0, 0xd5a2, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket(0x2c, 0x19559ff95703cef9, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000240)={r3, r0}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="c4000000190001000000000000000000ff0200000000000000000000000000010000000000000000000000000000000080000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="002bb7000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000010000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000a00100001"], 0xc4}}, 0x0) getpeername$packet(r3, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=@flushpolicy={0x9, 0x1d, 0x1, 0x0, 0x0, "", [@policy_type={0xa, 0x10, {0x1}}, @policy={0x0, 0x7, {{@in=@local, @in6=@loopback, 0x4e22, 0x0, 0x4e21, 0x2, 0x0, 0xc0, 0x80, 0x2e, r6, r4}, {0x5, 0x5, 0x9, 0x1, 0x0, 0x10, 0x4, 0x1d69}, {0xe6, 0x6, 0x200, 0x7071}, 0xfffffff8, 0x0, 0x2, 0x1, 0x0, 0x3}}]}, 0x1c}}, 0x0) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYRESHEX=r2, @ANYRES8=r3, @ANYBLOB="05000000001000001400128009000100626f6e64000000000400028008000a00", @ANYRESOCT=r1, @ANYBLOB="d94c9c94e90cb74910fdaa574a0f7fcb421716e712ebd0402440a6a40d217bcc1ec9ce5aefae3ab421c4b9043edbda8785ab8cce846a1916282f055db751e4b7593cf3a47866cb6cfe0527640f157bdb3cb8060000000000000082e99619d8d9bdd72c3beb00a9748e0452e697f2aa7dac7ee844d88e80013d185a98d35deb527f79e34705d621ff113900cd1e1b433b9bd53a4a3a346465a371a5c9d8d8be1301eef5a475f71ab4b79d069251bc0315d8e6563b2c14aa18116f498cbe0a94c819feed5d8d8837"], 0x3c}, 0x1, 0x0, 0x0, 0x48084}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r7, 0x800454e0, &(0x7f00000001c0)=r1) 1.364207879s ago: executing program 2 (id=5754): socket$unix(0x1, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e20, @broadcast}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @private=0xfffffffe}}) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r2 = socket(0x1e, 0x4, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), r2) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000480)={0x0, 'veth0_to_hsr\x00', {0x2}, 0x51}) write$tun(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaabb0180c200000e88a800008100007eab91b32dd80cffd20adf8cf828782802010045fc006953d778f6c9a77f00"], 0x32) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r7, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r8, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r9}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r8, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000810) recvmmsg$unix(r1, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000000080)}}], 0x1, 0x0, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=@newlink={0x1ac, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x600, 0x0, 0x48815, 0x40103}, [@IFLA_AF_SPEC={0x184, 0x1a, 0x0, 0x1, [@AF_INET={0x20, 0x2, 0x0, 0x1, {0x1c, 0x1, 0x0, 0x1, [{0x8, 0x16, 0x0, 0x0, 0x7}, {0x8, 0x9, 0x0, 0x0, 0x1}, {0x8, 0x1a, 0x0, 0x0, 0x1}]}}, @AF_MPLS={0x4}, @AF_INET6={0x94, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IFLA_INET6_TOKEN={0x14, 0x7, @loopback}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x14, 0x7, @loopback}, @IFLA_INET6_TOKEN={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x1}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xa0}, @IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}]}, @AF_BRIDGE={0x4}, @AF_INET6={0x24, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xf}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x5b}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xe1}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xf7}]}, @AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x17, 0x0, 0x0, 0x8}]}}, @AF_INET={0x58, 0x2, 0x0, 0x1, {0x54, 0x1, 0x0, 0x1, [{0x8, 0x13, 0x0, 0x0, 0xff}, {0x8, 0x11, 0x0, 0x0, 0x100}, {0x8, 0x21}, {0x8, 0xc, 0x0, 0x0, 0xfffffff7}, {0x8, 0x2}, {0x8, 0x15, 0x0, 0x0, 0x4}, {0x8, 0x12, 0x0, 0x0, 0x5}, {0x8, 0x1e, 0x0, 0x0, 0x8}, {0x8, 0x7, 0x0, 0x0, 0x5}, {0x8, 0x1c, 0x0, 0x0, 0x3}]}}, @AF_INET={0x38, 0x2, 0x0, 0x1, {0x34, 0x1, 0x0, 0x1, [{0x8, 0x11, 0x0, 0x0, 0x6}, {0x8, 0x1a, 0x0, 0x0, 0x3}, {0x8, 0x6}, {0x8, 0xa, 0x0, 0x0, 0xff}, {0x8, 0x20, 0x0, 0x0, 0x8}, {0x8, 0x10, 0x0, 0x0, 0xffffffc0}]}}]}, @IFLA_TXQLEN={0x8, 0xd, 0x3}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) readv(r10, &(0x7f0000000780)=[{&(0x7f0000000380)=""/210, 0xd2}, {&(0x7f0000000540)=""/139, 0x8b}, {&(0x7f0000000600)=""/47, 0x2f}, {&(0x7f0000000280)=""/90, 0x5a}, {&(0x7f0000000740)=""/49, 0x31}], 0x5) recvmmsg(r1, &(0x7f0000008280)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/55, 0x37}], 0x1}, 0x8}], 0x1, 0x40000180, 0x0) preadv(r5, &(0x7f0000003c00)=[{&(0x7f0000001480)=""/255, 0xff}, {&(0x7f00000000c0)=""/1, 0x1}, {0x0}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/4096, 0x1000}], 0x5, 0x23a1, 0x1) close(r2) 1.193311009s ago: executing program 4 (id=5755): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f00000000c0)={0x1d, r3}, 0x10) (async) sendmsg$can_bcm(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)={0x1, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{0x2, 0x0, 0x0, 0x1}, 0x5, 0x1, 0x0, 0x0, "5f468b975dbb0f60"}}, 0x48}, 0x1, 0x0, 0x0, 0x44084}, 0x20004050) (async) sendmsg$can_bcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1, 0x1, 0x3, {}, {0x0, 0x2710}, {0x3, 0x1, 0x1, 0x1}, 0x1, @can={{0x4, 0x0, 0x0, 0x1}, 0x7, 0x2, 0x0, 0x0, "d467aef0f23fe738"}}, 0x48}, 0x1, 0x0, 0x0, 0x4001}, 0x4000000) sendmsg$can_bcm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="02"], 0x48}}, 0x40884) (async) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="c000000040000701feffffff00000000017c1200040042800c0001800600060088470000970002809470c4b9d425894604f2ef9d2877c76e6cff2cc03746b35836c0acd8948b974978ed58bdf5911ccfaed74609301189929cf0be024fe625adfb8a2230958e80bbcd69193952aff71c16a71b319c97f68d31a04ce3e42faf6f9a9080bc71d6fc8e88a759a2622cf548697149accdc2c647d3d025be3f7e971d8dcc3968e0c25aee12f24713c04065f88e291eec1dc708de4772dc00040008"], 0xc0}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_newroute={0x1c, 0x1a, 0x1, 0x70bd29, 0x10000, {0x2, 0x20, 0x20, 0x0, 0xfc, 0x0, 0x0, 0x56e2465202c96bfd, 0x2000}}, 0x1c}}, 0x0) (async) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) (async) connect$vsock_stream(r4, &(0x7f0000001c80)={0x28, 0x0, 0x2710, @host}, 0x10) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r4, 0xf501, 0x0) (async) r5 = socket$kcm(0x10, 0x2, 0x0) (async) r6 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) recvfrom$llc(r6, 0x0, 0x0, 0x2100, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x7, &(0x7f0000000140)=@framed={{0x18, 0x7}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @alu={0x6, 0x0, 0xd}, @exit={0x95, 0x0, 0x7b00}, @call={0x85, 0x0, 0x0, 0x13}]}, &(0x7f0000000040)='GPL\x00', 0x4}, 0x94) (async) sendmsg$kcm(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a00100000000580607ee622", 0x2e}], 0x1}, 0x0) 859.092732ms ago: executing program 4 (id=5756): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0xa, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1}, &(0x7f0000000580)=0x2, &(0x7f0000000080)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r2}, &(0x7f0000000240), &(0x7f0000000280)=r0}, 0x20) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010005081000418e00000004fcff", 0x58}], 0x1) 817.153543ms ago: executing program 3 (id=5757): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f0000000500)=@ccm_128={{0x303}, "0e57b3d487e2db32", "4f2c3e223509000000000000000000d3", '\x00', "6775c975b6b15e11"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "021000", "72392a24199b5903"}, 0x28) (async) writev(r0, &(0x7f00000039c0)=[{&(0x7f00000005c0)="c800b66cf7e6a5", 0x7}, {&(0x7f0000000800)="1c7e6b9e688e6270cf440480946456f950e37af773e53874c663dd2a336df10d2d1187d48719ed7fd17ca09b6bdaa49710183eb991f93aef84adb0a2dad9bb05b690e65758d5c66e64d6fdd07ce5771e98a47f7756a093c6e8b0fbe23987d01aaa11e71a70d31d458bc5c33cc2e17453daf057527e57e5b7c0f1c45fcf0308bc40cb43c41a47e18b7b4bc100a4ebe7d2bfd31fc526da97e4b202fe79ddce36ec2f00627d3b86c3fa66bcbf6ec036aef16e0c4f39b441abda436dd5e85a00"/220, 0xdc}, {&(0x7f0000003a00)="b02dc15e16fc4458d1da7cb57ea5ab0a57d5cb8303eb2a80056e49a5ba22ace51e907ce6c025b28b8260d980ecf60e3a8dbc4c6411d93758f4dafa6005012df40f244bb7dc117f6dcb47b2c0db287d012a4ef56a7e42d5b582dc87c696d1dc06900cca9fe89465a6af3dab7a4d414c8421006b2605677457f1d0be1aa8696d1bfe8850a203b5b1118798566d70941214a483ef362b09624f15f61f60bf678d124803deec272fb0e296941ca39a9a42b4478cacdb29aca7dcbd81a1b7f5e197e597e564b8a37e8497e6d8bd40d6bbf65310f27f94427fc807e7f357ef6225912bec74d4dc61102c62ceab81d236e55b6e6b66da692f313c31fa1d70c225644ce91dd3589ccfc3c7ae884f08095209fda872169b8a258f089bd4538baa32b678edb692931d288e4fe89aaf3a177a849b77a03b86db494544d31f7d223b88b65d56b2318b0acea2f0594a3070e0089218fe92c0a2ec11e5515bcb56281ebd0b0cbbccace8c6a58db769260c5fa8559b27b5eb096ec895066d8db9e658584f3f12f1bcf47e936ffbbefb1f4a12906f6c8fec6bd9b64cb14c06801ded8f28234eec6375f04e66ce87043117792c1de38dbb44e9f688a7967c482f0e60cc7265334fe18156c261c29b62d957f4078bd94070325d24745200ba4408da49116cf7a18609243b9e1c672d31a9ba581200fd1986b7ad5a1dbcf3011eeaf8ceaeb8195e75611d443559d490af51db138c604084c7e60e8247ecb1b52375fad86127e303e12ae1817043feeb1bf249b5904dac5b146c4b52c3454247c0428933a517a78aedd1d18131ef73f0706cddd8a3cd35c3d0cba0dff681f62b0da54f8d85866fd2bcc92c531fb9e9553e2335470ba6c3691664919830ecb2d00dbcd870b21aca0281454567f02fed4891f0ed9266444e5e7aa0ae0859906ca754b3d51aaa18929d619f10b790935e30bad1c7d0ad6a50a04f16b26a5acda9a43c860d9e40c2efbf934b51b495713bfb23f86cb9da1ab3b2b871e1ed7dc8c936f254a9160faff5475c6ebaaec67807b1cbcca130b6810009b52a8c1472ca25ca7c47a0dab8d1678b2cceba8c4645eba3e3b47e157148525c12bcedc91f5e067c6d6cd27dcb8241d76a5fcb733bea6b364d0a4db81837e3d956f21c6016b3c2c6f202e6a1a4f2723e8701e0202f24556eaa8eee0a05dcfd02f95937abea6020af216a8a4d9ac83181aced9ff87bc545beda95f55897d78f6d7b2fe0c8de4448f1f01276c0f23e5c3c56ccf724b6587a02b8a86b12872d9e66792281cc423a75321bb06e0fceeffbabb42cd2391328325d009fe346fbb3aaaa9bf45fb3a3a279af8b8527f0ef6a755d5c1bc39b31005a600d63936d47965e17747f54c07c2a77a988dddfc4122a59c6a474656080edc38731129ebca77f1c8533c84871fa77c40d32e9b93158dad0ec6d2a1bda7a41512afb94c1ccf79c5f22d015c54333dcc234d2f2144b87d77ca23d9413b02be1fa6955c561da08a4c3b10ac88440c63ba4b03f27535e240fd869e27b2dbb7c7de0f46fad5bf9a1a20cf9f6355bfddd22257459a25d9cc21f3a7364169d6c05bff0d000fd7d17aedb4df967bb70e6e52c7b6933d56d56807adb71975cb1500bdc2f63e43ac7070e9e9971a8a21fba6af8a03b4441db112a2eb78c384ba3b2bcb62ae59ef98911dd03b2cc77550bc8bb0a533f034f2d69cc6a856773c7487f6c8df7b7d3c0cd3396b2d38cc1edb4f387e3d0681ce5d346871298df5cbae645ef6a730899766f46096188d367527dbff1ed94183b072c49d4391c7e24447fd90459a87fdffaba679ba97a20031f9576a823e58eb00933018fe75bf26d21ca5ab46fd8e52c3facef663b8a35131f829179f418ecbdfedb7189feeb1f20c5764ab8cded707ce1570ae025198e946f8fa086a2485d3c0f8814ca092d38c8b1c2a242c8c60929d8b8cfe5147b4c2f52dfbccb0b3b5d3cd37a4899efb2b859332fabd15163c874808d868d64543164b4bdc703cea32266cbdb6cf980dd217388c34edfc0674bca324ce0ed2831b1e56ff68e13dd654c4f294723da0f855eb9164e868d00c82dd5f8a8c5415bd70096548f26c3b47ee7c94a81bf71f3ee2a58b8126a4c02e5891088f85a7326791202de872980649c8fb907863e35040d3dff398b90e7234b94b71f4d28fc7fe3b77284f7237b7d08330507eaa9d21106d63bc6bac6760284f3f244767a98eefed071c2e146852c1861c20b04bf19bf012ea97980037e3c7c4aff5bba82f1a6831fe7683671c27ddb1f593612b0e4b11286b8b04a0ae1d7cd43f2fddc7fb0292bfd4e8df4f57f04fd98fb3e233fa662b6b8e143020b9ec57490229ead83ed5ca0bc80dd73f5e77601a2efc7dfb29666cd37ad926f3a45e4c313d0c1c47d0e0579d357cf86a0710535c0ed27cf0e00279b95c782dcfc4d03ad6649cd40f5ff2808ed1a29fd33b3096afb03434e29401ccd6f5d48a49b03f317632291518f5e0b6497cd77737d62ed3d2acaec9923892bb2b15da59144dfaa493b8842196341e7d084920b02469a3b634ee4e488199281e6577fba0364b07235dcf4d23b805ba69dc8c4efba42a9476ba0d9c58bfe8c30ce5b8b5808d1b1f935b2d732510d20a2936881263871f01255b8512ca48ebc0d25a76466413bca6afcba1a149dad595fd115a64d26f22dc6667e4d25ff6c670c1c991e18e7a96558ea29d7a82e897a3197c9d863d47bffb7b2328ffe103781d87cc181f7282bc3d4e67d8447d1bfd8aff462a63c32f5dc8d42ff2358d58f863c3e42841971c868370e5f99a6f6b5237b74cbe7a73fa7088961ea39c415dae5b1e0622049d5ce8516d1de7b90c9dc8d944e31231b0fa86aa7167e2ffdfe4a103b2dd82090c6523dca38075c17cd874cbadc97205433a42145f79965d066f373c7458a9be0919047626938478ca9c9756a827dab0fe1c6182f5aff267692ac744ad1f581d65a07448ed07c29d220fe240543d039138288354e88eeba5d7087122edf93a20cb720953ca60cd79f54a00d9fc5982b5b89bcb9d39e02c204bd70bf60360cdc61149df5b1ba58c2c3a0975b65dc8e5c005f6dd57db9ad35db6748497c604143586752b87c01b28d498101de04f8632ab868eaa99ef440b496f7b670ea36ad12f04613cdaad135fd00d886b9b1398dcf780ef1cd66d00a9ebce59d18d934550eeab2de6d7d1a8489e7470236866e603f933ebc4486b9c1a65b435f435bccfbc39355548d2ebae63ff37b0c508a0e84a7a6303757738a262f2c25cdaee74fa41afc5180a8cfab4066a5c6651c7bb460b498144599b25e6c7c95b6e9e543dadfc550aae4ba30927c917705f0b8d9e29e6df453bcf482b89b68c3f6a92ad7b6a175cb5862337f8a1131d3c1b26ee3b3729ea553515bf88a8af15fb9e722f4f745532ebf3a2feeaf92d5fd8518165c29fafc97a3bde46052931e4dc22dc829c168e665d111660a2f91e087e987eadce4e1677bca57640e3453de32d83d0f03ac5cca6bf33355a6590e54524451154100dcfb39e374da33281e5afc6d3f92d64b58a5b6227349b88fa8b2cc4660ceafa30cb9e266b29520afa982991ec9dbb347ef5768bf02912b043d09771a1b0f38bd7238f68932e2d02ede3e158301488ecc939d196f996f66d223cc25e2484922b2374b5aa4590909b9e5057c7fab17fcddd4a98a67995c6b90dafd4572437e3474fefad5f9158cd0aec17a8fc2162be6b1022e334691862c8a15b2364a4263066fd7f5a96f79a72a18efe198c7347ab46e4e5330359bb4c431d1179b292e51a472a35434f5d86989edd60867aaf963e752aad1569ee84cb5dc7c653e4ce6320bf9fa7c68ed0660eef9eaef510efcb6ca7087ee1e9c5f940a1a0cf232d2e6ddd59bd7b85428ac07f3a81b1311c203b24c4edd3e0fd6d826948ceae2fb93c8a56f64a8580524f8f10365c58319148fdc2ef0e76520341f2f96d23df3039bfdcdd41771a8c05368a0866cb8d4012e8b0645e5cf637e0957dcb4052bde179b3db3821b9b0cac0a3cff3f7070e0b1c3fa227d77c121fd3812d6238d42cd4d7fb631855d1d68e846ab20162c363540a5b59e4a2f38915029874346b6eeb5f59c12a03a6a58a85e6b9e051152b942d704f92ab3aa89d346291848536b7f94a7fde3b02e1423e76775cf4d1231ae67cd850f712c8437f3ff19af09fb067e4d0e5762d24586bf9e2513926a055045405ce876bde9ac6fc6d4cb2186eaff2bbeb1047ddf693c0f2d4170f8581e950c6bab1af4dbd41aee06788e589bb7867d18982ad95fdb474b74e1cdbb387928aa38a4285cf166d74a0d29178a032194464d6da1ff6cc11058622f78982d63e9b06fcb41aa007930e1dd9bf4a80ff995c00a185344cd0722e10946f3e48a04d260284b562d13ffdac1522e2054f48fe7223d271192aac68931a388b0cd3286cd10dceb165b6a7875b48527ead7d6245436ae505cb4ee5cbd672f1b820c577124f50339f7e5a16dcd077117f8da04d7351edf24204d1bddeaf6e478a03321023871fb145215e08e02bead4e01d23adeec2ef3da110443e62a7f0ced14a57fb8bd810e102482488447b4f3e5b79abef51b027b8b9e4b7c2dc0a218364d724c9fd9e0c385e57e314db88f3f62dd24bc8af0aca895da6c994d776e23fb50f7e2898d8ee4c2928ec1b28518a212c9197014f68ee8848b5b67eb6154b3fb307778fc0b84975c6957c9dc48fe77ff8e0ca34870dce341b21e7f9c51e8360648fb9cb714a8d2cd1b05901ce460f0df1e197817efb55bbc13fc9c77a732c7762611585a556b3c52b7eec19badee51d7a7df6304c3c01377e9e32f81ea1d75d8908a5e42dc2837dddb63f9d32c21e638725ec05c9d030d9f76aa67bd08d9b47c54f71a744816cfa31f43ca939e0cf41c8a7757af4405be7acb839a3dab6ba6f3f921e86714216f9890b04f731fbccf367458ec36a67377aa23c5bdb3dcf0135f83bcac10af5dda7f84c8ff27b794e9424e96c5b71e6e88c16996ac46709ff7b5312a36ee38587a2ea44c981d856b6e3cab59f3e907da9d3b2565d34771243eb6a5341ec05936ead0fa4944135a27287e1db6617828c9359bd949c006ec7540e8f7e72b3855db88fe368df3998a5860c45ee3b222352d41fda77be0d7685842be9b5792a1c1275a8418046274c2b55cdf012932eda0a2d8dd5123afd1f3101ec970d4434db5328c5521e95d5f63c7b869819f84f303e7408a21a96a1cb53567d91dfd6393bdc54e63cc89a9417f5b08d4d049860197853de135c90a54c44194a4e9bdfd25bf21f1d4d635fc0ff2319391cbd0453c9dc371cc4d7e0c0dda4ed75143cbca112caaad6e8fc4328abb4d070b3a8894e12e8e82facda0a5e91d9b0c89767098fe281982dad64a24af041eedf8876c08231c2c338b32e733c29c915982e22b11b16a15ebc1be6ee91bfb6509f550632939c3d5c2881c777604b6735d76f169553b58ec4f1a190b9678952bd81d0cb4711ce5fd71626acfda6a08ad54b1bc416d3fb119f0d38b682d66f00b6b0bd70b6c892fa9ace5df7ff0c3c875b08c5679263e7138ff42341b00f8cf6b10acd6131cb32a99743e73a185af4899cd01641d57999bd6b55c8fb2c64e7ca51586f296145249188162606901517447d22ee529a3dc6dd3d7f4cff664b84315193b834dc1c1e5d398dab805b6e62c670a231c29132264d4a04d2f4752392ec0874ab00328671439492319f6823b646fca5c0254fddcf8fe32a13e983344f511b797", 0x1000}], 0x10000000000000de) (async) readv(r4, &(0x7f00000006c0)=[{&(0x7f0000001980)=""/4099, 0x4000}], 0x1) (async) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000980)=@ipv4_getnetconf={0x34, 0x52, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@NETCONFA_FORWARDING={0x8, 0x2, 0x2}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_RP_FILTER={0x8, 0x3, 0x7}, @NETCONFA_FORWARDING={0x8, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0xc51}, 0x40000c0) (async) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c000000100003052abd70000007000000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800002400128009000100697069700000000014000280060012004e240000080003006401010008000a00", @ANYRES32=r3, @ANYBLOB="8a481f506f0297de2e0c1227cfc34827794d2d3148"], 0x4c}}, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth0_virt_wifi\x00', 0x0}) (async) r8 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r8, &(0x7f00000000c0)='C', 0x5dc, 0x30048841, &(0x7f00000002c0)={0x11, 0x88a8, r7, 0x1, 0xe, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, 0x14) (async) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="00042dbd7000fedbdf2502000000380006800600010002000000060001000200000008000700", @ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x80}, 0x4c007) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r9 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[], 0x60}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) (async) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) (async) shutdown(r0, 0x1) (async) connect$bt_rfcomm(r0, &(0x7f0000005dc0)={0x1f, @none, 0x18}, 0xa) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, &(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0], 0x0, 0x5a, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xb8, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) 811.3067ms ago: executing program 0 (id=5758): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYRESHEX=r0, @ANYRES32=r3, @ANYBLOB="340005"], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) 586.591766ms ago: executing program 4 (id=5759): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x1b, &(0x7f0000000cc0)=ANY=[@ANYBLOB="1830000075000000000000000500000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000020b703000003000000850000000600000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000030000008500000006000000180100002020692500000000002020207b1af8ff00000000bfe79c000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f00000000c0)='GPL\x00', 0x5, 0xf8, &(0x7f0000000100)=""/248, 0x0, 0x2c}, 0x24) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000001d80)={0x0, @in6={{0xa, 0x4e23, 0x20006, @loopback, 0x6}}, 0x7f, 0x2, 0x0, 0x5, 0x392, 0x94}, 0x9c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e24, 0x40, @private1, 0x1}]}, &(0x7f0000000100)=0x10) r2 = socket$can_j1939(0x1d, 0x2, 0x7) write(r2, &(0x7f0000000440)="0e1f2a96c45920ba068e67d63d39cf133e0e7187a0cbee6f55b876c131dd7fec7b276889a0c8e33cbfdf2b452f79db5a23370e037fd13b2f888a7ac255c964a291e4805fea874d3edef03c2593abd01ad5809f69fd6b1b298336d45030c217d2d484b32c0f502857754a7b0474da70b288c49236c408206954964ea659b5309e579fd8e5eaa9175ddfa1950daf5a3bfb21d90765e18b093a070a8dc1ed13fdd1c06163161b4deac2892fcf61a6efbca37388d5", 0xb3) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYRES32=r0], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x401}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2660004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 467.967187ms ago: executing program 3 (id=5760): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)={0x64, r1, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x50, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "9ea2d328893918792a5ca222a6ad61b1143aa3a6ace61df176c9eac62648eecc490695d9"}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x806}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x4c, r2, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xc}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @local}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x37}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001b80)={0x18, 0x25, 0x319, 0x70bd27, 0x8000, {0x5}, [@nested={0x4, 0x4f}]}, 0x18}, 0x1, 0x0, 0x0, 0x48004}, 0x24044004) (async) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001b80)={0x18, 0x25, 0x319, 0x70bd27, 0x8000, {0x5}, [@nested={0x4, 0x4f}]}, 0x18}, 0x1, 0x0, 0x0, 0x48004}, 0x24044004) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000030000619d1074000000000095000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 417.622283ms ago: executing program 2 (id=5761): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r3], 0x5c}}, 0x40) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=@newlink={0x1a0, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7c303, 0xc900}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x2020d}}}}}}, @IFLA_MTU={0x8, 0x4, 0x7ff}, @IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x2c707}, @IFLA_AF_SPEC={0x148, 0x1a, 0x0, 0x1, [@AF_MPLS={0x4}, @AF_INET6={0x68, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x3}, @IFLA_INET6_TOKEN={0x14, 0x7, @private2}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x2}, @IFLA_INET6_TOKEN={0x14, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x6}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x4}, @IFLA_INET6_TOKEN={0x14, 0x7, @loopback}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x7}]}, @AF_BRIDGE={0x4}, @AF_MPLS={0x4}, @AF_INET6={0x50, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x2b}}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x7}, @IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xf}, @IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_MPLS={0x4}, @AF_INET6={0x7c, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @loopback}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x19}}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFLA_INET6_TOKEN={0x14, 0x7, @empty}, @IFLA_INET6_TOKEN={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}]}]}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x84}, 0x0) 230.912224ms ago: executing program 0 (id=5762): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'dvmrp1\x00', 0x8000}) r1 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r1, 0x84, 0x11, &(0x7f0000000000), 0x8) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) epoll_create1(0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) socket$nl_route(0x10, 0x3, 0x0) close(r3) socket(0x2000000000000021, 0x2, 0x2) setsockopt$sock_int(r3, 0x1, 0x2e, &(0x7f0000000040)=0xffff, 0x4) pselect6(0x29, &(0x7f0000000000)={0x7f, 0x8, 0x3, 0x6, 0xa, 0x0, 0x800, 0xa}, 0x0, 0x0, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000000)="2e000300010003", 0x7) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x6, 0x8, 0x8, 0x8}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdc01, {0x0, 0x0, 0x0, r9, {0x0, 0xd}, {0x2, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="8b593f4f0744"}) r10 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r10, &(0x7f0000000180)="05032200d3fc140000004788031c", 0xe, 0x4, &(0x7f0000000140)={0x11, 0xf8, r11, 0x1, 0x0, 0x6, @multicast}, 0x14) 0s ago: executing program 3 (id=5763): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x5, 0x2, 0x4}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) close(0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80800) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000000940)=0x1000008, 0x4) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r4) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x70, r5, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0xb, 0xa}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0xfd6}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xa}], @NL80211_ATTR_CSA_C_OFFSETS_TX={0xa, 0xcd, [0x97, 0x80, 0x9]}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x70}}, 0x804) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f00000000c0)=r9, 0x4) sendmsg$unix(r8, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): : set [1, 0] type 2 family 0 port 6081 - 0 [ 647.114035][T24132] bond3: option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 647.125486][T24132] bond3 (unregistering): Released all slaves [ 647.190671][ T7022] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.305656][T24140] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 647.348146][T24140] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 647.369265][T24140] bond0 (unregistering): Released all slaves [ 647.447897][T24147] nbd: couldn't find a device at index 0 [ 647.485519][T24140] sctp: [Deprecated]: syz.3.4406 (pid 24140) Use of int in max_burst socket option. [ 647.485519][T24140] Use struct sctp_assoc_value instead [ 649.122541][ C1] net_ratelimit: 1086 callbacks suppressed [ 649.122560][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.136642][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.202944][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.211455][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 650.242646][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 650.660047][T24164] __nla_validate_parse: 5 callbacks suppressed [ 650.660064][T24164] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4412'. [ 650.686367][T24184] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 650.694822][T24185] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 650.715735][T24179] netlink: 100 bytes leftover after parsing attributes in process `syz.4.4412'. [ 650.914798][T24199] Cannot find del_set index 3 as target [ 650.973290][T24201] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 651.100962][T24210] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 651.116429][T24210] netlink: 'syz.1.4426': attribute type 1 has an invalid length. [ 651.282429][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.287012][T24229] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4430'. [ 651.322412][T24229] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4430'. [ 651.508346][T24240] mac80211_hwsim hwsim40 wlan0: entered promiscuous mode [ 651.541152][T24240] mac80211_hwsim hwsim40 wlan0: entered allmulticast mode [ 651.599584][T24248] netlink: 'syz.0.4436': attribute type 1 has an invalid length. [ 651.649670][T24248] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 651.868697][T24271] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4442'. [ 652.063833][ T29] audit: type=1107 audit(1781666988.756:11): pid=24265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 652.063944][T24282] netlink: 'syz.0.4445': attribute type 1 has an invalid length. [ 652.081670][T24273] can: request_module (can-proto-0) failed. [ 652.223166][T24282] 8021q: adding VLAN 0 to HW filter on device bond3 [ 652.322406][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.322466][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.332068][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.728559][T24317] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 652.750982][T24317] syzkaller1: linktype set to 1 [ 653.101377][T24349] syzkaller1: entered promiscuous mode [ 653.115960][T24349] syzkaller1: entered allmulticast mode [ 653.165961][T24360] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4464'. [ 653.332643][T24369] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4468'. [ 653.552740][T24385] bond4: entered allmulticast mode [ 653.613280][T24385] macvlan3: entered promiscuous mode [ 653.626697][T24385] macvlan3: entered allmulticast mode [ 653.634561][T24385] bond4: entered promiscuous mode [ 653.640551][T24385] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 653.657888][T24385] bond4: left promiscuous mode [ 653.659163][T24393] netlink: 'syz.1.4475': attribute type 4 has an invalid length. [ 653.671223][T24393] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4475'. [ 653.718613][T24393] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4475'. [ 653.739658][T24393] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4475'. [ 653.816454][ T29] audit: type=1800 audit(1781666990.506:12): pid=24394 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.4474" name="memory.events" dev="tmpfs" ino=1321 res=0 errno=0 [ 653.883387][T24399] nbd: couldn't find a device at index 0 [ 654.111955][T24416] xt_TCPMSS: Only works on TCP SYN packets [ 654.121554][T24413] bond5 (unregistering): Released all slaves [ 654.125163][T24411] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 654.134845][T24411] IPv6: NLM_F_CREATE should be set when creating new route [ 654.142071][T24411] IPv6: NLM_F_CREATE should be set when creating new route [ 654.242525][ C1] net_ratelimit: 6 callbacks suppressed [ 654.242542][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.256360][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.265889][ T6506] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.325850][T24417] netlink: 'syz.4.4480': attribute type 1 has an invalid length. [ 654.518963][T24436] tipc: Started in network mode [ 654.534641][T24436] tipc: Node identity , cluster identity 4711 [ 654.553976][T24436] tipc: Failed to obtain node identity [ 654.559500][T24436] tipc: Enabling of bearer rejected, failed to enable media [ 654.708593][T24447] tipc: Enabled bearer , priority 0 [ 654.901911][T24455] netlink: 'syz.0.4492': attribute type 1 has an invalid length. [ 655.018889][T24456] bond4: (slave gretap2): making interface the new active one [ 655.037616][T24456] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 655.048726][T24462] 8021q: adding VLAN 0 to HW filter on device bond4 [ 655.130330][T24463] lo speed is unknown, defaulting to 1000 [ 655.239197][T24475] tipc: Enabling of bearer rejected, failed to enable media [ 655.261864][ T7007] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 655.287724][ T137] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 655.327188][ T137] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 655.356040][ T137] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 655.571817][T24463] lo speed is unknown, defaulting to 1000 [ 655.966546][T24502] syz_tun: entered allmulticast mode [ 656.175498][T24502] syz_tun (unregistering): left allmulticast mode [ 656.681263][T24522] bridge0: port 1(batadv1) entered blocking state [ 656.713366][T24522] bridge0: port 1(batadv1) entered disabled state [ 656.748139][T24522] batadv1: entered allmulticast mode [ 656.825263][ T6519] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.830901][T24522] batadv1: entered promiscuous mode [ 656.938929][T24535] __nla_validate_parse: 3 callbacks suppressed [ 656.938949][T24535] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4511'. [ 656.957692][T24530] lo speed is unknown, defaulting to 1000 [ 656.979993][T24522] IPVS: Scheduler module ip_vs_ not found [ 657.163486][ T7018] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 657.172782][ T7018] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 657.235604][T24541] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4511'. [ 657.595249][T24555] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4516'. [ 657.735894][T24561] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4516'. [ 657.746444][T24555] 8021q: adding VLAN 0 to HW filter on device bond5 [ 657.776295][T24530] lo speed is unknown, defaulting to 1000 [ 658.083978][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.092325][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.196172][T24551] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4515'. [ 658.383007][T24575] netlink: 'syz.4.4519': attribute type 1 has an invalid length. [ 658.602766][T24579] syzkaller1: entered promiscuous mode [ 658.628248][T24579] syzkaller1: entered allmulticast mode [ 658.652732][T24582] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4521'. [ 658.723646][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.731936][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.285892][T24602] netlink: 'syz.4.4524': attribute type 1 has an invalid length. [ 659.305901][T24602] netlink: 96 bytes leftover after parsing attributes in process `syz.4.4524'. [ 659.345643][T24602] netlink: 1 bytes leftover after parsing attributes in process `syz.4.4524'. [ 659.363259][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.374270][ T137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.382652][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.511201][T24609] netlink: 'syz.4.4526': attribute type 11 has an invalid length. [ 659.614563][T24614] nbd: must specify at least one socket [ 659.836862][T24621] bond6: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 659.851327][T24621] bond6 (unregistering): Released all slaves [ 660.219824][T24641] netlink: 100 bytes leftover after parsing attributes in process `syz.4.4533'. [ 660.374176][T24644] bond6: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 660.397457][T24641] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4533'. [ 660.408624][T24644] bond6 (unregistering): Released all slaves [ 660.711742][T24655] netlink: 'syz.4.4536': attribute type 1 has an invalid length. [ 660.825328][T24659] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 661.037395][T24666] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.065328][T24668] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.282563][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.290832][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.378670][T24685] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 661.688094][T24690] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.765399][T24697] netlink: 'syz.4.4548': attribute type 1 has an invalid length. [ 661.810787][T24697] 8021q: adding VLAN 0 to HW filter on device bond6 [ 661.881421][T24697] bond6: (slave geneve3): making interface the new active one [ 661.901523][T24697] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 662.089053][T24703] __nla_validate_parse: 5 callbacks suppressed [ 662.089071][T24703] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4549'. [ 662.204798][T24708] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4552'. [ 662.451923][T24726] netlink: 96 bytes leftover after parsing attributes in process `syz.1.4557'. [ 662.461914][T24726] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4557'. [ 662.630529][T24736] netlink: 'syz.4.4560': attribute type 1 has an invalid length. [ 662.837874][T24741] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4558'. [ 662.892153][T24760] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4558'. [ 663.163789][T24771] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4570'. [ 663.268847][T24773] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4571'. [ 663.344879][T24783] syz_tun: entered allmulticast mode [ 663.359843][T24783] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4574'. [ 663.423272][T24783] syz_tun (unregistering): left allmulticast mode [ 663.481324][ T29] audit: type=1800 audit(1781667000.166:13): pid=24792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4576" name="memory.events" dev="tmpfs" ino=1560 res=0 errno=0 [ 663.526740][ T29] audit: type=1804 audit(1781667000.216:14): pid=24792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.4576" name="/newroot/302/memory.events" dev="tmpfs" ino=1560 res=1 errno=0 [ 663.667384][T24795] xt_HMARK: spi-set and port-set can't be combined [ 663.875251][T24803] netlink: 'syz.4.4580': attribute type 2 has an invalid length. [ 664.123358][T24816] xt_CT: You must specify a L4 protocol and not use inversions on it [ 664.462641][T24831] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4588'. [ 664.486502][ T7009] net_ratelimit: 15 callbacks suppressed [ 664.486517][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.498574][ T137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.500496][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.149785][T24860] tc_dump_action: action bad kind [ 665.211231][T24861] netlink: 'syz.3.4596': attribute type 14 has an invalid length. [ 665.238795][T24860] ip6tnl0: entered allmulticast mode [ 665.553696][T24872] bond6: option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 665.584494][T24872] bond6 (unregistering): Released all slaves [ 665.624224][T24875] dummy0: left allmulticast mode [ 665.636649][T24875] dummy0: left promiscuous mode [ 665.649753][T24875] bridge0: port 1(dummy0) entered disabled state [ 665.681626][T24875] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 665.839624][T24891] tipc: Resetting bearer [ 665.865249][T24891] tipc: Resetting bearer [ 665.904027][T24899] netlink: 'syz.2.4610': attribute type 1 has an invalid length. [ 666.103294][T24910] netlink: 'syz.2.4615': attribute type 1 has an invalid length. [ 666.125482][T24922] netlink: 'syz.0.4614': attribute type 362 has an invalid length. [ 666.153833][T24910] bond3: entered promiscuous mode [ 666.159316][T24910] 8021q: adding VLAN 0 to HW filter on device bond3 [ 666.245027][T24910] 8021q: adding VLAN 0 to HW filter on device bond3 [ 666.263355][T24910] bond3: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 666.304574][T24910] bond3: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 666.345652][T24910] bond3: (slave ip6gre1): making interface the new active one [ 666.353627][T24910] ip6gre1: entered promiscuous mode [ 666.360661][T24910] bond3: (slave ip6gre1): Enslaving as an active interface with an up link [ 666.528236][ T7022] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.544782][ T7022] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.571295][ T7022] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.581153][ T7022] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.064858][T24954] lo speed is unknown, defaulting to 1000 [ 667.151890][T24967] __nla_validate_parse: 216 callbacks suppressed [ 667.151909][T24967] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4629'. [ 667.254995][T24967] 8021q: adding VLAN 0 to HW filter on device bond0 [ 667.549427][T24982] syzkaller1: entered promiscuous mode [ 667.555873][T24982] syzkaller1: entered allmulticast mode [ 667.608269][T24954] lo speed is unknown, defaulting to 1000 [ 667.615759][T24984] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4634'. [ 667.652025][T24984] vlan4: entered promiscuous mode [ 668.014672][T25002] netlink: 240 bytes leftover after parsing attributes in process `syz.2.4639'. [ 668.130507][T25006] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.4640'. [ 668.183051][T25006] veth0_to_bond: default FDB implementation only supports local addresses [ 668.356825][T25025] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4645'. [ 668.372105][T25028] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4647'. [ 668.428286][T25020] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 668.476424][T25034] netlink: 'syz.3.4644': attribute type 3 has an invalid length. [ 668.517467][T25034] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4644'. [ 668.700029][T25045] openvswitch: netlink: Missing valid actions attribute. [ 668.733898][T25045] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 668.776882][T25045] siw: device registration error -23 [ 668.839615][T25043] bond15 (unregistering): Released all slaves [ 668.964600][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.086454][T25064] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4654'. [ 669.352139][T25070] lo speed is unknown, defaulting to 1000 [ 669.521613][T25087] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4662'. [ 669.584270][T25087] vlan3: entered promiscuous mode [ 669.606512][ T137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.614943][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.633594][ T7004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.641863][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.668992][T25090] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4663'. [ 669.955859][T25101] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 669.978785][T25070] lo speed is unknown, defaulting to 1000 [ 670.002375][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.152188][T25116] team_slave_1: Caught tx_queue_len zero misconfig [ 670.163851][T25115] netlink: 'syz.1.4672': attribute type 10 has an invalid length. [ 670.177235][T25115] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 670.252837][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.261090][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.303649][ T29] audit: type=1800 audit(1781667006.996:15): pid=25124 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4673" name="memory.events" dev="tmpfs" ino=1649 res=0 errno=0 [ 670.969599][T25135] netlink: 'syz.0.4676': attribute type 4 has an invalid length. [ 670.971789][T25137] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 671.068255][T25145] xfrm0: left allmulticast mode [ 671.103472][T25145] tipc: Enabling of bearer rejected, failed to enable media [ 671.456352][T25160] netlink: 'syz.0.4683': attribute type 6 has an invalid length. [ 671.678135][T25178] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 671.709573][ T7007] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 671.728957][ T7007] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 671.777720][T25178] ipvlan2: entered allmulticast mode [ 671.786352][T25178] batadv0: entered allmulticast mode [ 671.792237][T25178] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 671.821316][ T7007] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 671.830654][ T7007] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 671.942194][T25187] netlink: 'syz.4.4691': attribute type 4 has an invalid length. [ 672.083392][T25198] netlink: 'syz.3.4694': attribute type 21 has an invalid length. [ 672.274939][T25203] lo speed is unknown, defaulting to 1000 [ 672.348928][T25206] __nla_validate_parse: 12 callbacks suppressed [ 672.348959][T25206] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4696'. [ 672.366578][T25206] netlink: 'syz.4.4696': attribute type 1 has an invalid length. [ 672.375388][T25206] netlink: 'syz.4.4696': attribute type 2 has an invalid length. [ 672.383489][T25206] netlink: 'syz.4.4696': attribute type 1 has an invalid length. [ 672.391246][T25206] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4696'. [ 672.591248][T25203] lo speed is unknown, defaulting to 1000 [ 672.885734][T25224] netlink: 'syz.4.4701': attribute type 1 has an invalid length. [ 673.035684][T25229] netlink: 220 bytes leftover after parsing attributes in process `syz.1.4704'. [ 674.028106][T25265] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.4716'. [ 674.029171][T25262] netlink: 'syz.0.4714': attribute type 1 has an invalid length. [ 674.081323][T25262] netlink: 96 bytes leftover after parsing attributes in process `syz.0.4714'. [ 674.115380][T25262] netlink: 658 bytes leftover after parsing attributes in process `syz.0.4714'. [ 674.156844][T25262] netlink: 1 bytes leftover after parsing attributes in process `syz.0.4714'. [ 674.180595][T25275] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4718'. [ 674.444840][T25290] bond0: Error: Cannot enslave bond to itself. [ 674.621206][T25315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4728'. [ 674.662460][T25316] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4728'. [ 674.763534][T25323] net_ratelimit: 5 callbacks suppressed [ 674.763554][T25323] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 674.907801][T25330] xt_CT: You must specify a L4 protocol and not use inversions on it [ 675.148789][T25345] IPVS: length: 248 != 24 [ 675.202642][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.368118][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.376491][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.385131][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.393460][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.703073][T25375] team3: entered promiscuous mode [ 675.712682][T25375] team3: entered allmulticast mode [ 675.721052][T25375] 8021q: adding VLAN 0 to HW filter on device team3 [ 675.837977][T25389] validate_nla: 2 callbacks suppressed [ 675.837994][T25389] netlink: 'syz.4.4751': attribute type 1 has an invalid length. [ 675.877942][T25385] bond6: option packets_per_slave: invalid value (1597403241) [ 675.908604][T25385] bond6: option packets_per_slave: allowed values 0 - 65535 [ 675.939172][T25385] bond6 (unregistering): Released all slaves [ 676.005992][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.014563][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.190920][T25405] syzkaller0: entered promiscuous mode [ 676.203642][T25405] syzkaller0: entered allmulticast mode [ 676.242350][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.314467][T25415] sctp: [Deprecated]: syz.3.4759 (pid 25415) Use of int in max_burst socket option. [ 676.314467][T25415] Use struct sctp_assoc_value instead [ 676.898359][T25455] sctp: [Deprecated]: syz.4.4768 (pid 25455) Use of struct sctp_assoc_value in delayed_ack socket option. [ 676.898359][T25455] Use struct sctp_sack_info instead [ 677.126897][T25467] nbd: must specify a size in bytes for the device [ 677.145523][T25464] syzkaller0: entered promiscuous mode [ 677.171486][T25464] syzkaller0: entered allmulticast mode [ 677.236885][T25467] dummy0 (unregistering): left promiscuous mode [ 677.237666][T25472] sctp: [Deprecated]: syz.1.4773 (pid 25472) Use of struct sctp_assoc_value in delayed_ack socket option. [ 677.237666][T25472] Use struct sctp_sack_info instead [ 677.282671][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.390014][T25475] syzkaller1: entered promiscuous mode [ 677.412867][T25475] syzkaller1: entered allmulticast mode [ 677.709905][T25482] __nla_validate_parse: 14 callbacks suppressed [ 677.709924][T25482] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4776'. [ 677.770645][T25482] 8021q: adding VLAN 0 to HW filter on device bond7 [ 677.821962][T25495] tipc: Resetting bearer [ 677.935842][T25502] IPVS: Scheduler module ip_vs_sip not found [ 677.946913][T25505] netlink: 39 bytes leftover after parsing attributes in process `syz.2.4782'. [ 678.035530][T25510] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4783'. [ 678.241645][T25527] bond3: entered allmulticast mode [ 678.248592][T25527] ip6gre1: entered allmulticast mode [ 678.261133][T25527] dvmrp8: entered allmulticast mode [ 678.269954][T25525] bond3: left allmulticast mode [ 678.275127][T25525] ip6gre1: left allmulticast mode [ 678.351823][T25534] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4790'. [ 678.580308][T25545] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4794'. [ 678.612377][T25545] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 678.628494][T25545] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 678.850007][T25562] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4801'. [ 679.028059][T25576] nbd: couldn't find a device at index 0 [ 679.577682][T25605] tipc: Enabled bearer , priority 10 [ 679.650415][T25608] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4813'. [ 679.716714][T25609] netlink: 'syz.2.4812': attribute type 13 has an invalid length. [ 679.746259][T25608] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4813'. [ 679.811524][T25611] sch_tbf: burst 6 is lower than device gretap0 mtu (5390) ! [ 680.034096][T25616] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.4814'. [ 680.217009][T25623] netlink: 'syz.0.4816': attribute type 1 has an invalid length. [ 680.295496][T25623] bond5: entered promiscuous mode [ 680.333117][T25623] 8021q: adding VLAN 0 to HW filter on device bond5 [ 680.372121][T25627] macvtap1: entered allmulticast mode [ 680.421631][T25629] bond5: (slave bridge5): making interface the new active one [ 680.454123][T25629] bridge5: entered promiscuous mode [ 680.475244][T25629] bond5: (slave bridge5): Enslaving as an active interface with an up link [ 680.495095][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.503243][ T7011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.511336][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.572417][ T8382] tipc: Node number set to 2116211145 [ 680.721706][T25656] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 680.773500][T25658] netlink: 'syz.2.4823': attribute type 1 has an invalid length. [ 680.861776][T25664] netlink: 766 bytes leftover after parsing attributes in process `syz.3.4824'. [ 680.924574][T25658] 8021q: adding VLAN 0 to HW filter on device bond4 [ 681.053286][T25658] netlink: 'syz.2.4823': attribute type 1 has an invalid length. [ 681.073622][T25658] netlink: 'syz.2.4823': attribute type 2 has an invalid length. [ 681.091533][T25658] netlink: 'syz.2.4823': attribute type 1 has an invalid length. [ 681.121984][T25658] netlink: 'syz.2.4823': attribute type 3 has an invalid length. [ 681.134263][ T7011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.142393][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.150494][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.158598][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.522383][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.530606][T25707] netlink: 'syz.4.4833': attribute type 10 has an invalid length. [ 681.690138][T25712] netlink: 'syz.0.4835': attribute type 1 has an invalid length. [ 681.808493][ T5360] bridge0: entered promiscuous mode [ 682.040583][T25739] netlink: 'syz.0.4843': attribute type 1 has an invalid length. [ 682.562362][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.650222][T25769] netlink: 'syz.3.4847': attribute type 10 has an invalid length. [ 682.750149][T25781] openvswitch: netlink: IP tunnel dst address not specified [ 683.056151][T25795] __nla_validate_parse: 9 callbacks suppressed [ 683.056185][T25795] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4854'. [ 683.266519][T25800] netlink: 'syz.0.4856': attribute type 1 has an invalid length. [ 683.298766][T25807] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4858'. [ 683.501177][T25814] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.4859'. [ 683.949870][T25835] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 683.986928][T25840] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4865'. [ 684.057336][T25841] bridge9: entered promiscuous mode [ 684.062947][T25841] bridge9: entered allmulticast mode [ 684.303756][T25869] netlink: 92 bytes leftover after parsing attributes in process `syz.2.4872'. [ 684.315899][T25865] netlink: 'syz.0.4870': attribute type 1 has an invalid length. [ 684.339457][T25865] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4870'. [ 684.397328][T25865] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4870'. [ 684.409371][T25871] netlink: 404 bytes leftover after parsing attributes in process `syz.2.4872'. [ 684.422195][T25877] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4871'. [ 684.460494][T25871] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4872'. [ 685.608282][ T7018] net_ratelimit: 6 callbacks suppressed [ 685.608299][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.622278][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.692382][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.245727][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.254161][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.267584][T25973] openvswitch: netlink: Key type 30 is not supported [ 686.504637][T25994] validate_nla: 4 callbacks suppressed [ 686.504656][T25994] netlink: 'syz.1.4902': attribute type 10 has an invalid length. [ 686.722572][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.882921][ T7011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.891310][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.939742][ T29] audit: type=1800 audit(1781667023.626:16): pid=26012 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4909" name=20 dev="tmpfs" ino=1669 res=0 errno=0 [ 686.964842][T26008] mac80211_hwsim hwsim36 wlan0: entered promiscuous mode [ 687.034657][T26008] tipc: Started in network mode [ 687.056857][T26008] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 687.079978][T26008] tipc: New replicast peer: fc01:0000:0000:0000:0000:0000:0000:0000 [ 687.090996][T26008] tipc: Enabled bearer , priority 10 [ 687.370885][T26041] ip6tnl3: entered allmulticast mode [ 687.400234][ T7007] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 687.408440][T26045] netlink: 'syz.3.4913': attribute type 11 has an invalid length. [ 687.428210][T26043] tipc: Enabled bearer , priority 0 [ 687.454561][T26043] syzkaller0: entered promiscuous mode [ 687.470336][T26043] syzkaller0: entered allmulticast mode [ 687.484324][T26043] tipc: Resetting bearer [ 687.545525][T26043] tipc: Resetting bearer [ 687.615677][T26054] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 687.615677][T26054] Please contact the netfilter-devel mailing list or update your nftables rules. [ 687.762374][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.898573][T26070] netlink: 'syz.3.4920': attribute type 62 has an invalid length. [ 688.196226][T26094] __nla_validate_parse: 16 callbacks suppressed [ 688.196244][T26094] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4922'. [ 688.213493][ T6519] tipc: Node number set to 1 [ 688.313814][T26106] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4927'. [ 688.441247][T26106] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4927'. [ 688.524946][T26119] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 688.584656][T26124] nbd: socks must be embedded in a SOCK_ITEM attr [ 688.700979][T26130] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4934'. [ 688.878712][T26134] block nbd2: not configured, cannot reconfigure [ 688.955662][T26147] netlink: 'syz.4.4937': attribute type 7 has an invalid length. [ 689.729847][T26158] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4939'. [ 689.966752][T26106] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 689.989270][T26106] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 690.106091][T26106] tipc: Resetting bearer [ 690.404219][ T7022] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.417734][ T7022] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 690.426900][ T7022] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.435669][ T7022] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 690.477075][ T7022] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.497595][ T7022] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 690.525489][T26169] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4942'. [ 690.526956][ T7022] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.556586][T26169] xt_l2tp: v2 sid > 0xffff: 8388608 [ 690.561701][ T7022] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 690.845508][T26179] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4944'. [ 691.035175][T26196] netlink: 112 bytes leftover after parsing attributes in process `syz.1.4949'. [ 691.116838][T26198] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4950'. [ 691.364350][ T7022] net_ratelimit: 1 callbacks suppressed [ 691.364367][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.378397][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.449351][T26211] sit0: entered promiscuous mode [ 691.470771][T26211] netlink: 'syz.1.4955': attribute type 1 has an invalid length. [ 691.482480][T26211] netlink: 1 bytes leftover after parsing attributes in process `syz.1.4955'. [ 691.629503][T26222] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 691.931188][T26236] netlink: 'syz.1.4964': attribute type 1 has an invalid length. [ 691.982744][T26236] 8021q: adding VLAN 0 to HW filter on device bond6 [ 692.003345][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.011651][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.020451][ T7004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.036273][T26240] netlink: 'syz.3.4963': attribute type 268 has an invalid length. [ 692.452100][T26257] openvswitch: netlink: Flow actions attr not present in new flow. [ 692.643451][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.651817][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.878615][T26284] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 693.042400][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.242596][T26308] __nla_validate_parse: 10 callbacks suppressed [ 693.242614][T26308] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4984'. [ 694.044566][T26342] lo: Caught tx_queue_len zero misconfig [ 694.082479][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 694.308121][T26362] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4999'. [ 694.350154][T26358] syzkaller1: entered promiscuous mode [ 694.360812][T26358] syzkaller1: entered allmulticast mode [ 694.491488][T26362] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4999'. [ 694.692762][T26376] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5002'. [ 694.795459][T26384] Cannot find del_set index 4 as target [ 694.811098][T26384] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5003'. [ 694.877376][T26392] 5Ò: entered promiscuous mode [ 695.105380][T26407] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5011'. [ 695.259178][T26419] 5nè: entered promiscuous mode [ 695.367608][T26429] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5018'. [ 695.389457][T26429] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5018'. [ 695.570204][T26445] : renamed from veth0_to_bond [ 695.595680][T26447] netlink: 'syz.3.5023': attribute type 10 has an invalid length. [ 695.660586][T26454] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5025'. [ 695.935158][T26468] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5029'. [ 696.492774][ T7007] net_ratelimit: 3 callbacks suppressed [ 696.492791][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.506844][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.757029][T26514] vlan3: entered promiscuous mode [ 696.762214][T26514] bridge0: entered promiscuous mode [ 697.103922][T26539] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 697.126253][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.134701][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.202378][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.394738][T26557] syzkaller1: entered promiscuous mode [ 697.422811][T26557] syzkaller1: entered allmulticast mode [ 697.691250][T26564] lo speed is unknown, defaulting to 1000 [ 698.102963][T26597] netlink: 'syz.1.5062': attribute type 11 has an invalid length. [ 698.242684][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.256064][T26602] __nla_validate_parse: 10 callbacks suppressed [ 698.256080][T26602] netlink: 108 bytes leftover after parsing attributes in process `syz.4.5063'. [ 698.406785][ T7004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.414819][T26564] lo speed is unknown, defaulting to 1000 [ 698.415324][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.515822][T26615] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 698.534480][T26615] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.671937][T26615] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 698.684807][T26615] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.814863][T26615] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 698.826212][T26615] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.895333][T26615] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 698.905927][T26615] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.073826][ T7004] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.082937][ T7004] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.137774][ T7022] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.158153][ T7022] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.253166][T26641] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5075'. [ 699.283731][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.296935][ T7023] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.312817][ T7023] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.469496][ T56] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.484749][ T56] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.577802][T26652] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 699.675204][T26652] syzkaller0: entered promiscuous mode [ 699.687659][T26652] syzkaller0: entered allmulticast mode [ 700.011664][T26666] nbd: couldn't find a device at index 0 [ 700.049079][T26669] netlink: 'syz.0.5083': attribute type 1 has an invalid length. [ 700.141109][T26669] 8021q: adding VLAN 0 to HW filter on device bond7 [ 700.154363][T26674] bond7: (slave dummy0): making interface the new active one [ 700.164292][T26674] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 700.938879][T26698] netlink: 6024 bytes leftover after parsing attributes in process `syz.2.5089'. [ 701.017472][T26704] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5090'. [ 701.057923][T26706] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5091'. [ 701.118526][T26712] gre0: Caught tx_queue_len zero misconfig [ 701.674210][T26742] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5101'. [ 701.850509][T26755] netlink: 'syz.2.5104': attribute type 1 has an invalid length. [ 701.859319][T26755] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5104'. [ 701.871130][T26753] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5103'. [ 701.904558][T26753] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5103'. [ 702.030008][T26770] netlink: 'syz.3.5108': attribute type 10 has an invalid length. [ 702.042987][T26770] netlink: 55 bytes leftover after parsing attributes in process `syz.3.5108'. [ 702.244255][ T7007] net_ratelimit: 1 callbacks suppressed [ 702.244273][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.258199][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.337484][T26789] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 702.363854][T26789] netlink: 'syz.4.5115': attribute type 1 has an invalid length. [ 702.424718][T26789] netlink: 'syz.4.5115': attribute type 10 has an invalid length. [ 702.433931][T26789] netlink: 'syz.4.5115': attribute type 10 has an invalid length. [ 702.526886][T26803] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 702.823866][T26818] lo speed is unknown, defaulting to 1000 [ 702.883651][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.891964][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.901181][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.278519][T26846] tun0: tun_chr_ioctl cmd 1074025675 [ 703.292468][T26846] tun0: persist enabled [ 703.478014][T26846] tun0: tun_chr_ioctl cmd 1074025675 [ 703.483850][T26846] tun0: persist enabled [ 703.508910][T26851] tun0: tun_chr_ioctl cmd 1074025673 [ 703.520042][T26818] lo speed is unknown, defaulting to 1000 [ 703.753689][T26868] __nla_validate_parse: 8 callbacks suppressed [ 703.753707][T26868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5140'. [ 703.770231][T26869] netlink: 80 bytes leftover after parsing attributes in process `syz.0.5139'. [ 703.897171][T26869] syzkaller0: left promiscuous mode [ 703.904202][T26869] syzkaller0: left allmulticast mode [ 703.910443][T26869] tipc: Resetting bearer [ 703.922950][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.029463][T26877] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5143'. [ 704.163675][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.172067][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.198220][T26883] xfrm0: entered allmulticast mode [ 704.877664][T26899] FAULT_INJECTION: forcing a failure. [ 704.877664][T26899] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 704.903035][T26899] CPU: 1 UID: 0 PID: 26899 Comm: syz.0.5150 Not tainted syzkaller #0 PREEMPT(full) [ 704.903083][T26899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 704.903105][T26899] Call Trace: [ 704.903112][T26899] [ 704.903120][T26899] dump_stack_lvl+0xe8/0x150 [ 704.903146][T26899] should_fail_ex+0x40c/0x560 [ 704.903178][T26899] _copy_from_user+0x2d/0xb0 [ 704.903199][T26899] rds_setsockopt+0x6e1/0xdf0 [ 704.903227][T26899] ? __pfx_rds_setsockopt+0x10/0x10 [ 704.903249][T26899] ? fd_install+0x94/0x3d0 [ 704.903272][T26899] ? __pfx_aa_sk_perm+0x10/0x10 [ 704.903299][T26899] ? aa_sock_opt_perm+0xff/0x1a0 [ 704.903327][T26899] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 704.903349][T26899] ? __pfx_rds_setsockopt+0x10/0x10 [ 704.903371][T26899] do_sock_setsockopt+0x17c/0x1b0 [ 704.903395][T26899] __x64_sys_setsockopt+0x13d/0x1b0 [ 704.903415][T26899] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.903434][T26899] do_syscall_64+0x174/0x580 [ 704.903455][T26899] ? trace_irq_disable+0x3b/0x140 [ 704.903479][T26899] ? clear_bhb_loop+0x40/0x90 [ 704.903500][T26899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.903517][T26899] RIP: 0033:0x7f11c159ce59 [ 704.903534][T26899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 704.903549][T26899] RSP: 002b:00007f11c23b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 704.903568][T26899] RAX: ffffffffffffffda RBX: 00007f11c1815fa0 RCX: 00007f11c159ce59 [ 704.903581][T26899] RDX: 000000000000000a RSI: 0000000000000114 RDI: 0000000000000003 [ 704.903592][T26899] RBP: 00007f11c23b0090 R08: 0000000000000004 R09: 0000000000000000 [ 704.903603][T26899] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 704.903614][T26899] R13: 00007f11c1816038 R14: 00007f11c1815fa0 R15: 00007ffdb25d6de8 [ 704.903646][T26899] [ 704.943166][T26892] netlink: 80 bytes leftover after parsing attributes in process `syz.4.5147'. [ 704.966541][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.013532][T26903] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5149'. [ 705.279380][T26906] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5151'. [ 705.349356][ T29] audit: type=1804 audit(1781667042.036:17): pid=26910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.5154" name="/newroot/409/cgroup.controllers" dev="tmpfs" ino=2107 res=1 errno=0 [ 705.437760][ T29] audit: type=1800 audit(1781667042.036:18): pid=26910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5154" name="cgroup.controllers" dev="tmpfs" ino=2107 res=0 errno=0 [ 705.470219][T26914] netlink: 'syz.3.5153': attribute type 2 has an invalid length. [ 705.510398][T26910] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5154'. [ 705.532886][ T29] audit: type=1804 audit(1781667042.216:19): pid=26910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.5154" name="/newroot/409/cgroup.controllers" dev="tmpfs" ino=2107 res=1 errno=0 [ 705.880106][T26929] netlink: 204 bytes leftover after parsing attributes in process `syz.3.5158'. [ 705.962468][T26929] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5158'. [ 706.031253][T26936] FAULT_INJECTION: forcing a failure. [ 706.031253][T26936] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 706.055410][T26936] CPU: 1 UID: 0 PID: 26936 Comm: syz.4.5161 Not tainted syzkaller #0 PREEMPT(full) [ 706.055433][T26936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 706.055443][T26936] Call Trace: [ 706.055449][T26936] [ 706.055456][T26936] dump_stack_lvl+0xe8/0x150 [ 706.055480][T26936] should_fail_ex+0x40c/0x560 [ 706.055512][T26936] _copy_to_user+0x31/0xb0 [ 706.055533][T26936] simple_read_from_buffer+0xe1/0x170 [ 706.055560][T26936] proc_fail_nth_read+0x1bb/0x230 [ 706.055585][T26936] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 706.055609][T26936] ? rw_verify_area+0x24a/0x4c0 [ 706.055633][T26936] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 706.055653][T26936] vfs_read+0x213/0xa80 [ 706.055679][T26936] ? rds_setsockopt+0xb09/0xdf0 [ 706.055702][T26936] ? __pfx_vfs_read+0x10/0x10 [ 706.055725][T26936] ? __pfx_rds_setsockopt+0x10/0x10 [ 706.055746][T26936] ? fd_install+0x94/0x3d0 [ 706.055767][T26936] ? __pfx_aa_sk_perm+0x10/0x10 [ 706.055798][T26936] ksys_read+0x150/0x270 [ 706.055825][T26936] ? __pfx_ksys_read+0x10/0x10 [ 706.055855][T26936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.055883][T26936] do_syscall_64+0x174/0x580 [ 706.055902][T26936] ? trace_irq_disable+0x3b/0x140 [ 706.055926][T26936] ? clear_bhb_loop+0x40/0x90 [ 706.055947][T26936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.055963][T26936] RIP: 0033:0x7f168fb5d68e [ 706.055980][T26936] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 706.055994][T26936] RSP: 002b:00007f1690ab8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 706.056013][T26936] RAX: ffffffffffffffda RBX: 00007f1690ab96c0 RCX: 00007f168fb5d68e [ 706.056026][T26936] RDX: 000000000000000f RSI: 00007f1690ab90a0 RDI: 0000000000000004 [ 706.056038][T26936] RBP: 00007f1690ab9090 R08: 0000000000000000 R09: 0000000000000000 [ 706.056048][T26936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 706.056059][T26936] R13: 00007f168fe16038 R14: 00007f168fe15fa0 R15: 00007ffd7c0e1528 [ 706.056089][T26936] [ 706.277331][T26934] netlink: 47 bytes leftover after parsing attributes in process `syz.1.5159'. [ 706.533933][T26952] xt_hashlimit: size too large, truncated to 1048576 [ 706.809432][T26970] hmac(sha224): entered promiscuous mode [ 707.042099][T26980] 8021q: adding VLAN 0 to HW filter on device bond7 [ 707.183754][T26994] netlink: 'syz.2.5176': attribute type 5 has an invalid length. [ 708.003324][ T7007] net_ratelimit: 4 callbacks suppressed [ 708.003342][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.017299][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.082355][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.280527][T27063] lo speed is unknown, defaulting to 1000 [ 708.460951][T27078] netlink: 'syz.2.5191': attribute type 1 has an invalid length. [ 708.506524][T27078] openvswitch: netlink: IP tunnel dst address not specified [ 708.644867][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.653305][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.854024][T27063] lo speed is unknown, defaulting to 1000 [ 709.122619][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.421802][T27127] bond5: entered allmulticast mode [ 709.431591][T27128] macvlan2: entered promiscuous mode [ 709.460629][T27128] macvlan2: entered allmulticast mode [ 709.489045][T27128] bond5: entered promiscuous mode [ 709.510537][T27128] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 709.543716][T27128] bond5: left promiscuous mode [ 709.658485][T27142] __nla_validate_parse: 7 callbacks suppressed [ 709.658502][T27142] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5205'. [ 709.698941][T27140] bridge4: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 709.933712][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.941990][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.999525][T27140] bond15: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 710.055756][T27140] bond15: (slave lo): Enslaving as an active interface with an up link [ 710.073251][T27140] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 710.288832][T27162] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5210'. [ 710.304912][T27162] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5210'. [ 710.322665][T27162] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5210'. [ 710.357812][T27158] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5208'. [ 710.390037][T27170] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5212'. [ 710.454339][T27167] rdma_rxe: rxe_newlink: failed to add bridge_slave_1 [ 710.487557][T27181] netlink: 476 bytes leftover after parsing attributes in process `syz.2.5208'. [ 710.511866][T27167] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5210'. [ 710.524738][T27173] bond6 (unregistering): Released all slaves [ 710.594175][T27167] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5210'. [ 710.724472][T27194] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5214'. [ 710.761728][T27193] tipc: Resetting bearer [ 710.934188][T27208] netlink: 'syz.0.5219': attribute type 1 has an invalid length. [ 711.040837][T27214] bond8: (slave bridge8): making interface the new active one [ 711.070508][T27218] netlink: 'syz.3.5221': attribute type 21 has an invalid length. [ 711.085129][T27214] bond8: (slave bridge8): Enslaving as an active interface with an up link [ 711.094751][T27221] netlink: 'syz.4.5222': attribute type 1 has an invalid length. [ 711.095824][T27222] netlink: 'syz.4.5222': attribute type 1 has an invalid length. [ 711.127187][T27208] bond8: entered promiscuous mode [ 711.132590][T27208] bridge8: entered promiscuous mode [ 711.138181][T27208] bond8: entered allmulticast mode [ 711.144388][T27208] bridge8: entered allmulticast mode [ 711.151158][T27208] 8021q: adding VLAN 0 to HW filter on device bond8 [ 711.510584][T27242] tipc: Resetting bearer [ 711.554603][T27247] netlink: 'syz.1.5228': attribute type 13 has an invalid length. [ 711.565679][T27247] netlink: 'syz.1.5228': attribute type 17 has an invalid length. [ 711.583406][ T7013] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 711.593175][ T7013] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.604089][ T7013] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 711.633463][ T7013] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.634621][T27255] netlink: 'syz.2.5231': attribute type 13 has an invalid length. [ 711.672677][T27255] netlink: 'syz.2.5231': attribute type 17 has an invalid length. [ 711.790695][T27247] sit0: left promiscuous mode [ 711.806566][T27247] syz_tun: left promiscuous mode [ 711.840409][T27247] 8021q: adding VLAN 0 to HW filter on device bond0 [ 711.857077][T27247] 0ªX¹¦À: left allmulticast mode [ 711.864037][T27247] 8021q: adding VLAN 0 to HW filter on device 60ªX¹¦À [ 711.926245][T27247] batman_adv: 60ªX¹¦À: Interface activated: batadv_slave_0 [ 711.938733][T27247] batman_adv: 60ªX¹¦À: Interface activated: batadv_slave_1 [ 711.948352][T27247] xfrm0: left allmulticast mode [ 711.961241][T27247] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 711.972201][T27247] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 711.984733][T27247] veth1_vlan: left promiscuous mode [ 711.991058][T27247] veth0_vlan: left promiscuous mode [ 711.997212][T27247] veth0_vlan: entered promiscuous mode [ 712.009402][T27247] veth1_vlan: entered promiscuous mode [ 712.051034][ T7013] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 712.126539][T27255] 8021q: adding VLAN 0 to HW filter on device bond0 [ 712.143653][T27255] 8021q: adding VLAN 0 to HW filter on device team0 [ 712.156165][T27255] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 712.200047][T27255] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 712.210751][T27255] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 712.235724][T27257] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.251517][ T7018] bridge0: port 1(() entered blocking state [ 712.257522][ T7018] bridge0: port 1(() entered forwarding state [ 712.397296][ T7013] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 712.422071][ T7013] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.466065][ T6519] uyz0: Port: 1 Link ACTIVE [ 712.494600][ T7013] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 713.129156][ T56] net_ratelimit: 7 callbacks suppressed [ 713.129173][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.143173][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.765419][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.774189][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.804410][T27353] netlink: 'syz.4.5258': attribute type 1 has an invalid length. [ 713.843156][T27353] netlink: 'syz.4.5258': attribute type 64 has an invalid length. [ 713.952891][T27360] FAULT_INJECTION: forcing a failure. [ 713.952891][T27360] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 713.978730][T27360] CPU: 1 UID: 0 PID: 27360 Comm: syz.4.5260 Not tainted syzkaller #0 PREEMPT(full) [ 713.978755][T27360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 713.978765][T27360] Call Trace: [ 713.978772][T27360] [ 713.978780][T27360] dump_stack_lvl+0xe8/0x150 [ 713.978805][T27360] should_fail_ex+0x40c/0x560 [ 713.978837][T27360] prepare_alloc_pages+0x230/0x650 [ 713.978872][T27360] __alloc_frozen_pages_noprof+0x12f/0x380 [ 713.978902][T27360] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 713.978932][T27360] ? __pfx_policy_nodemask+0x10/0x10 [ 713.978968][T27360] alloc_pages_mpol+0x212/0x380 [ 713.978991][T27360] alloc_pages_noprof+0xac/0x2a0 [ 713.979011][T27360] __pud_alloc+0x3a/0x460 [ 713.979036][T27360] handle_mm_fault+0x1f87/0x3080 [ 713.979067][T27360] ? __pfx_mt_find+0x10/0x10 [ 713.979089][T27360] ? handle_mm_fault+0xec/0x3080 [ 713.979127][T27360] ? __pfx_handle_mm_fault+0x10/0x10 [ 713.979162][T27360] ? __lock_acquire+0x683/0x2cd0 [ 713.979185][T27360] ? lock_mm_and_find_vma+0xa7/0x340 [ 713.979211][T27360] do_user_addr_fault+0x744/0x1340 [ 713.979246][T27360] exc_page_fault+0x6a/0xc0 [ 713.979268][T27360] asm_exc_page_fault+0x26/0x30 [ 713.979284][T27360] RIP: 0010:rep_movs_alternative+0xf/0x90 [ 713.979309][T27360] Code: c4 10 e9 54 5b 04 00 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e [ 713.979324][T27360] RSP: 0018:ffffc9000310fcb8 EFLAGS: 00050202 [ 713.979339][T27360] RAX: 00007ffffffff001 RBX: 0000000000000004 RCX: 0000000000000004 [ 713.979351][T27360] RDX: 0000000000000001 RSI: 0000200000000340 RDI: ffffc9000310fd40 [ 713.979363][T27360] RBP: ffffc9000310fe48 R08: 0000000000000003 R09: 0000000000000004 [ 713.979373][T27360] R10: dffffc0000000000 R11: fffff52000621fa8 R12: dffffc0000000000 [ 713.979386][T27360] R13: 1ffff11015de50c3 R14: ffffc9000310fd40 R15: 0000200000000340 [ 713.979416][T27360] _copy_from_user+0x7a/0xb0 [ 713.979437][T27360] rds_setsockopt+0x6e1/0xdf0 [ 713.979466][T27360] ? __pfx_rds_setsockopt+0x10/0x10 [ 713.979488][T27360] ? fd_install+0x94/0x3d0 [ 713.979510][T27360] ? __pfx_aa_sk_perm+0x10/0x10 [ 713.979538][T27360] ? aa_sock_opt_perm+0xff/0x1a0 [ 713.979565][T27360] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 713.979586][T27360] ? __pfx_rds_setsockopt+0x10/0x10 [ 713.979609][T27360] do_sock_setsockopt+0x17c/0x1b0 [ 713.979632][T27360] __x64_sys_setsockopt+0x13d/0x1b0 [ 713.979653][T27360] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.979671][T27360] do_syscall_64+0x174/0x580 [ 713.979690][T27360] ? trace_irq_disable+0x3b/0x140 [ 713.979714][T27360] ? clear_bhb_loop+0x40/0x90 [ 713.979735][T27360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.979751][T27360] RIP: 0033:0x7f168fb9ce59 [ 713.979766][T27360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 713.979780][T27360] RSP: 002b:00007f1690ab9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 713.979797][T27360] RAX: ffffffffffffffda RBX: 00007f168fe15fa0 RCX: 00007f168fb9ce59 [ 713.979809][T27360] RDX: 000000000000000a RSI: 0000000000000114 RDI: 0000000000000003 [ 713.979818][T27360] RBP: 00007f1690ab9090 R08: 0000000000000004 R09: 0000000000000000 [ 713.979827][T27360] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 713.979837][T27360] R13: 00007f168fe16038 R14: 00007f168fe15fa0 R15: 00007ffd7c0e1528 [ 713.979865][T27360] [ 714.403483][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.714564][T27390] __nla_validate_parse: 10 callbacks suppressed [ 714.714583][T27390] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5268'. [ 714.761008][T27390] ip6gretap0: entered promiscuous mode [ 714.905469][T27402] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5272'. [ 715.270454][T27433] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.5282'. [ 715.318951][T27433] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5282'. [ 715.319388][T27435] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5282'. [ 715.399384][T27440] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5284'. [ 715.442380][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.545669][T27447] tipc: Enabling of bearer rejected, already enabled [ 715.598642][T27456] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5288'. [ 715.635419][T27447] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5286'. [ 715.673951][T27460] bond8: (slave gretap1): making interface the new active one [ 715.683575][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.691917][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.705633][T27460] bond8: (slave gretap1): Enslaving as an active interface with an up link [ 715.726162][T27447] 8021q: VLANs not supported on ip6_vti0 [ 715.759721][T27448] macvlan2: entered promiscuous mode [ 715.768554][T27448] macvlan2: entered allmulticast mode [ 715.786972][T27448] bond8: entered promiscuous mode [ 715.797981][T27470] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5288'. [ 715.807246][T27448] gretap1: entered promiscuous mode [ 715.809954][T27448] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 715.830511][T27448] bond8: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 715.848061][T27448] bond8: left promiscuous mode [ 715.853006][T27448] gretap1: left promiscuous mode [ 715.891370][T27466] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5290'. [ 716.104016][T27486] validate_nla: 2 callbacks suppressed [ 716.104033][T27486] netlink: 'syz.3.5294': attribute type 9 has an invalid length. [ 716.341380][T27498] netlink: 'syz.1.5297': attribute type 1 has an invalid length. [ 716.365358][T27506] bond8: option lacp_rate: invalid value (128) [ 716.374666][T27506] bond8 (unregistering): Released all slaves [ 716.484493][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.507344][T27498] 8021q: adding VLAN 0 to HW filter on device bond9 [ 716.554372][T27510] bond9: (slave geneve4): making interface the new active one [ 716.565899][T27510] bond9: (slave geneve4): Enslaving as an active interface with an up link [ 717.522618][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.568360][T27543] mac80211_hwsim hwsim36 wlan0: entered allmulticast mode [ 717.753032][T27547] lo speed is unknown, defaulting to 1000 [ 718.260166][T27547] lo speed is unknown, defaulting to 1000 [ 718.562346][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.594119][T27577] netlink: 'syz.2.5322': attribute type 13 has an invalid length. [ 718.731563][T27572] rdma_rxe: rxe_newlink: failed to add bridge_slave_1 [ 718.883559][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.891866][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.972667][T27584] 8021q: adding VLAN 0 to HW filter on device bond16 [ 719.023269][T27585] 8021q: adding VLAN 0 to HW filter on device bond16 [ 719.031594][T27585] bond16: (slave vti1): The slave device specified does not support setting the MAC address [ 719.043941][T27585] bond16: (slave vti1): Error -95 calling set_mac_address [ 719.205693][T27585] bond16: (slave vti1): The slave device specified does not support setting the MAC address [ 719.229414][T27585] bond16: (slave vti1): Error -95 calling set_mac_address [ 719.287810][T27600] syzkaller0: entered promiscuous mode [ 719.295524][T27600] syzkaller0: entered allmulticast mode [ 719.343184][T27585] bond16: (slave vti1): The slave device specified does not support setting the MAC address [ 719.387540][T27585] bond16: (slave vti1): Error -95 calling set_mac_address [ 719.523699][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 719.531997][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 719.550375][T27585] bond16: (slave vti1): The slave device specified does not support setting the MAC address [ 719.567453][T27585] bond16: (slave vti1): Error -95 calling set_mac_address [ 719.602420][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 719.690014][T27585] bond16: (slave vti1): The slave device specified does not support setting the MAC address [ 719.722154][T27585] bond16: (slave vti1): Error -95 calling set_mac_address [ 719.746162][T27616] __nla_validate_parse: 46 callbacks suppressed [ 719.746180][T27616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5332'. [ 719.798634][T27616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5332'. [ 719.868564][T27620] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5333'. [ 719.951010][T27619] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5334'. [ 719.960284][T27625] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5335'. [ 719.960284][T27624] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5335'. [ 720.030204][T27625] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5335'. [ 720.051109][T27630] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5335'. [ 720.451546][T27643] lo speed is unknown, defaulting to 1000 [ 720.456631][T27646] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5341'. [ 720.562063][T27651] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5341'. [ 720.642636][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.804959][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.813376][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.833895][T27662] hmó3)ó: entered promiscuous mode [ 721.089079][T27671] xt_cgroup: invalid path, errno=-2 [ 721.100389][T24156] udevd[24156]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 721.276189][T27678] syzkaller0: Caught tx_queue_len zero misconfig [ 721.428486][T27687] FAULT_INJECTION: forcing a failure. [ 721.428486][T27687] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 721.461978][T27687] CPU: 0 UID: 0 PID: 27687 Comm: syz.0.5353 Not tainted syzkaller #0 PREEMPT(full) [ 721.462002][T27687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 721.462012][T27687] Call Trace: [ 721.462019][T27687] [ 721.462026][T27687] dump_stack_lvl+0xe8/0x150 [ 721.462052][T27687] should_fail_ex+0x40c/0x560 [ 721.462082][T27687] _copy_to_user+0x31/0xb0 [ 721.462104][T27687] simple_read_from_buffer+0xe1/0x170 [ 721.462130][T27687] proc_fail_nth_read+0x1bb/0x230 [ 721.462155][T27687] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 721.462179][T27687] ? rw_verify_area+0x24a/0x4c0 [ 721.462204][T27687] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 721.462225][T27687] vfs_read+0x213/0xa80 [ 721.462254][T27687] ? rds_setsockopt+0xac3/0xdf0 [ 721.462276][T27687] ? __pfx_vfs_read+0x10/0x10 [ 721.462299][T27687] ? __pfx_rds_setsockopt+0x10/0x10 [ 721.462320][T27687] ? fd_install+0x94/0x3d0 [ 721.462340][T27687] ? __pfx_aa_sk_perm+0x10/0x10 [ 721.462372][T27687] ksys_read+0x150/0x270 [ 721.462398][T27687] ? __pfx_ksys_read+0x10/0x10 [ 721.462428][T27687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.462447][T27687] do_syscall_64+0x174/0x580 [ 721.462466][T27687] ? trace_irq_disable+0x3b/0x140 [ 721.462489][T27687] ? clear_bhb_loop+0x40/0x90 [ 721.462510][T27687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.462526][T27687] RIP: 0033:0x7f11c155d68e [ 721.462543][T27687] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 721.462556][T27687] RSP: 002b:00007f11c23affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 721.462575][T27687] RAX: ffffffffffffffda RBX: 00007f11c23b06c0 RCX: 00007f11c155d68e [ 721.462587][T27687] RDX: 000000000000000f RSI: 00007f11c23b00a0 RDI: 0000000000000004 [ 721.462598][T27687] RBP: 00007f11c23b0090 R08: 0000000000000000 R09: 0000000000000000 [ 721.462608][T27687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 721.462619][T27687] R13: 00007f11c1816038 R14: 00007f11c1815fa0 R15: 00007ffdb25d6de8 [ 721.462649][T27687] [ 721.682365][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.160963][T27643] lo speed is unknown, defaulting to 1000 [ 722.384758][T27709] bond15: option mode: unable to set because the bond device has slaves [ 722.468287][T27711] netlink: 'syz.3.5358': attribute type 4 has an invalid length. [ 723.148865][T27731] lo speed is unknown, defaulting to 1000 [ 723.553349][T27731] lo speed is unknown, defaulting to 1000 [ 723.888410][T27753] bond0: Caught tx_queue_len zero misconfig [ 724.004870][ T7009] net_ratelimit: 2 callbacks suppressed [ 724.004887][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.018776][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.886265][T27778] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 725.159191][T27782] __nla_validate_parse: 13 callbacks suppressed [ 725.159209][T27782] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5376'. [ 725.257971][T27776] nbd: must specify a device to reconfigure [ 725.284620][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.292976][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.337665][T27791] netlink: 136 bytes leftover after parsing attributes in process `syz.1.5382'. [ 725.746715][T27800] 8021q: VLANs not supported on lo [ 725.751914][T27801] sctp: [Deprecated]: syz.4.5385 (pid 27801) Use of struct sctp_assoc_value in delayed_ack socket option. [ 725.751914][T27801] Use struct sctp_sack_info instead [ 725.928048][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.967066][T27802] netlink: 'syz.4.5385': attribute type 1 has an invalid length. [ 726.111713][T27802] bond8: (slave bridge13): making interface the new active one [ 726.126133][T27802] bond8: (slave bridge13): Enslaving as an active interface with an up link [ 726.374555][T27823] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5392'. [ 726.445944][T27828] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5395'. [ 726.474457][T27826] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 726.480557][T27824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5392'. [ 726.490196][T27829] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5392'. [ 726.520811][T27831] netlink: 'syz.1.5396': attribute type 10 has an invalid length. [ 726.528876][T27831] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5396'. [ 726.551971][T27824] bond0: entered promiscuous mode [ 726.559016][T27824] batadv_slave_0: entered promiscuous mode [ 726.565676][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.565874][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.593538][T27824] batadv_slave_0: left promiscuous mode [ 726.732967][T27824] bond0: left promiscuous mode [ 726.962389][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.114839][T27829] bond0: entered promiscuous mode [ 727.122042][T27829] batadv_slave_0: entered promiscuous mode [ 727.132816][T27829] batadv_slave_0: left promiscuous mode [ 727.139204][T27829] bond0: left promiscuous mode [ 727.440522][T27861] vlan0: entered promiscuous mode [ 727.716745][T27873] netlink: 'syz.4.5407': attribute type 11 has an invalid length. [ 727.749384][T27873] netlink: 'syz.4.5407': attribute type 4 has an invalid length. [ 727.779331][T27873] netlink: 'syz.4.5407': attribute type 6 has an invalid length. [ 727.804788][T27873] netlink: 199044 bytes leftover after parsing attributes in process `syz.4.5407'. [ 727.837985][T27885] pim6reg: entered allmulticast mode [ 727.959174][T27873] bond9: option miimon: invalid value (18446744073709551607) [ 727.973275][T27873] bond9: option miimon: allowed values 0 - 2147483647 [ 727.991713][T27873] bond9 (unregistering): Released all slaves [ 728.135072][ T5635] block nbd0: Receive control failed (result -32) [ 728.248363][T27901] netlink: 'syz.3.5416': attribute type 2 has an invalid length. [ 728.333526][T27904] block nbd6: server does not support multiple connections per device. [ 728.346330][T27904] block nbd6: shutting down sockets [ 728.451590][T27917] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5420'. [ 728.473238][T27917] netlink: 80 bytes leftover after parsing attributes in process `syz.0.5420'. [ 728.667629][T27937] lo speed is unknown, defaulting to 1000 [ 729.042535][ C1] net_ratelimit: 4 callbacks suppressed [ 729.042552][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.076949][T27937] lo speed is unknown, defaulting to 1000 [ 729.125277][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.133950][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.377762][T27957] lo speed is unknown, defaulting to 1000 [ 729.751283][T27972] netlink: 'syz.3.5432': attribute type 7 has an invalid length. [ 729.773862][T27957] lo speed is unknown, defaulting to 1000 [ 730.082886][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.044728][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.053224][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.122607][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.687863][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.696602][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.163852][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.682939][ T5733] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 733.094438][ T5733] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 733.152525][T28017] tipc: Resetting bearer [ 733.239956][T28019] __nla_validate_parse: 5 callbacks suppressed [ 733.239973][T28019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5442'. [ 733.579789][T28030] @0Ù: renamed from bond_slave_1 (while UP) [ 733.824265][T28035] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5447'. [ 734.111054][T28059] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 734.148608][T28054] bridge0: port 1(() entered disabled state [ 734.166964][T28061] netlink: 'syz.1.5451': attribute type 13 has an invalid length. [ 734.186846][T28061] netlink: 'syz.1.5451': attribute type 17 has an invalid length. [ 734.200670][T28063] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5454'. [ 734.233505][T28054] tipc: Resetting bearer [ 734.242473][ C1] net_ratelimit: 1 callbacks suppressed [ 734.242489][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.267296][T28067] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5455'. [ 734.297597][T28054] batman_adv: 60ªX¹¦À: Interface deactivated: batadv_slave_0 [ 734.307876][T28054] batman_adv: 60ªX¹¦À: Interface deactivated: batadv_slave_1 [ 734.347228][T28054] tipc: Resetting bearer [ 734.397455][T28061] 8021q: adding VLAN 0 to HW filter on device bond0 [ 734.410747][T28061] 8021q: adding VLAN 0 to HW filter on device 60ªX¹¦À [ 734.450173][T28061] bridge0: port 1(() entered blocking state [ 734.456270][T28061] bridge0: port 1(() entered forwarding state [ 734.479859][T28061] batman_adv: 60ªX¹¦À: Interface activated: batadv_slave_0 [ 734.490766][T28061] batman_adv: 60ªX¹¦À: Interface activated: batadv_slave_1 [ 734.511457][T28061] veth1_vlan: left promiscuous mode [ 734.526176][T28061] vlan0: left promiscuous mode [ 734.532068][T28061] veth1_vlan: entered promiscuous mode [ 734.550197][T28061] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 734.596447][ T7022] bridge0: port 2(bridge_slave_1) entered blocking state [ 734.603603][ T7022] bridge0: port 2(bridge_slave_1) entered forwarding state [ 734.627051][T28071] lo: entered allmulticast mode [ 734.640526][T28071] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 734.681142][T28074] netlink: 72 bytes leftover after parsing attributes in process `syz.3.5457'. [ 734.687929][T28086] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5459'. [ 734.838867][T28088] tipc: Resetting bearer [ 734.887436][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.895835][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 735.233823][T28114] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5469'. [ 735.347955][T28123] bond0: entered promiscuous mode [ 735.383641][T28123] batadv_slave_0: entered promiscuous mode [ 735.411484][T28123] debugfs: 'hsr1' already exists in 'hsr' [ 735.431314][T28123] Cannot create hsr debugfs directory [ 735.444175][T28130] netlink: 'syz.0.5474': attribute type 8 has an invalid length. [ 735.610584][T28144] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5476'. [ 735.647431][T28152] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5477'. [ 735.658078][ T7023] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.674869][ T7023] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.691470][ T7023] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.712060][T28152] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5477'. [ 735.732053][ T7023] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.819372][T28155] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 736.172766][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.181059][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.806491][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.814765][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.523134][ C1] net_ratelimit: 2 callbacks suppressed [ 739.523153][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.562552][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.644113][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.652395][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.602839][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.925102][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.933436][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.563336][ T7007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.571532][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.642508][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.722377][ C1] net_ratelimit: 1 callbacks suppressed [ 744.722398][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.764214][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.404776][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.413226][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.683545][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.691825][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.699952][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.708062][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.963036][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.002782][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.042466][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.083041][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.164411][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.172800][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.122474][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.443127][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.451353][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.162424][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.733491][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.202632][ C0] net_ratelimit: 1 callbacks suppressed [ 755.202651][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.252416][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.203510][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.211731][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.283198][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.202817][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.211105][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.817038][T28178] ip6tnl0: Caught tx_queue_len zero misconfig [ 759.836123][T28178] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.5486'. [ 759.846372][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.846541][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.890248][T28178] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.5486'. [ 759.930757][T28178] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5486'. [ 760.004943][T28196] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5491'. [ 760.486617][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.533458][T28230] netlink: 'syz.1.5498': attribute type 4 has an invalid length. [ 760.548288][T28230] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5498'. [ 760.749200][T28245] netlink: 312 bytes leftover after parsing attributes in process `syz.2.5502'. [ 760.796548][T28250] netlink: 'syz.4.5503': attribute type 21 has an invalid length. [ 760.817373][T28250] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5503'. [ 760.843230][T28250] netlink: 'syz.4.5503': attribute type 4 has an invalid length. [ 760.861686][T28250] netlink: 'syz.4.5503': attribute type 3 has an invalid length. [ 760.888883][T28250] netlink: 3 bytes leftover after parsing attributes in process `syz.4.5503'. [ 760.933217][T28254] team_slave_1: entered promiscuous mode [ 760.965939][T28254] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5505'. [ 760.994875][T28254] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5505'. [ 761.522379][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.163879][ T7007] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.200692][ T7007] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.236316][ T7007] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.266014][ T7007] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.285138][ T7007] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.307459][ T7007] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.342502][ T7007] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.361145][ T7007] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.381599][T28308] openvswitch: : Dropping previously announced user features [ 762.411052][ T7018] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.419635][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.562370][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.878679][ T7007] bond3 (unregistering): (slave erspan1): Releasing active interface [ 763.077952][ T7007] bond9 (unregistering): (slave geneve4): Releasing active interface [ 763.325549][ T7007] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 763.347704][ T7007] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 763.371175][ T7007] bond0 (unregistering): Released all slaves [ 763.413679][ T7007] bond1 (unregistering): Released all slaves [ 763.455335][ T7007] bond2 (unregistering): Released all slaves [ 763.497640][ T7007] bond3 (unregistering): Released all slaves [ 763.568303][ T7007] bond4 (unregistering): (slave veth1): Releasing active interface [ 763.586753][ T7007] bond4 (unregistering): Released all slaves [ 763.602652][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.631251][ T7007] bond5 (unregistering): Released all slaves [ 763.678519][ T7007] bond6 (unregistering): Released all slaves [ 763.723642][ T7007] bond7 (unregistering): Released all slaves [ 763.774450][ T7007] bond8 (unregistering): Released all slaves [ 763.811765][ T7007] bond9 (unregistering): Released all slaves [ 763.846601][ T7007] bond10 (unregistering): Released all slaves [ 763.866209][ T7007] bond11 (unregistering): Released all slaves [ 763.900803][T28315] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 764.125934][T28330] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 764.260260][ T7007] tipc: Disabling bearer [ 764.288616][ T7007] tipc: Left network mode [ 764.642412][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.693174][T28352] IPVS: set_ctl: invalid protocol: 44 172.20.20.53:20003 [ 764.713638][ T7007] IPVS: stopping backup sync thread 7832 ... [ 764.744162][T28352] IPVS: set_ctl: invalid protocol: 47 10.1.1.1:20001 [ 764.965146][ T7004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.973296][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.483270][T28373] geneve0: Caught tx_queue_len zero misconfig [ 765.682502][ C0] net_ratelimit: 2 callbacks suppressed [ 765.682521][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.013729][T28406] netlink: 'syz.4.5544': attribute type 2 has an invalid length. [ 766.048348][T28406] tipc: Started in network mode [ 766.056912][T28406] tipc: Node identity 1340008, cluster identity 4711 [ 766.071755][T28406] tipc: Node number set to 20185096 [ 766.330275][T28431] __nla_validate_parse: 4 callbacks suppressed [ 766.330291][T28431] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5550'. [ 766.458171][T28431] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5550'. [ 766.610797][T28437] tipc: Invalid UDP bearer configuration [ 766.610850][T28437] tipc: Enabling of bearer rejected, failed to enable media [ 766.722638][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.894762][ T7007] hsr_slave_0: left promiscuous mode [ 766.901222][ T7007] hsr_slave_1: left promiscuous mode [ 766.909185][ T7007] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 766.917517][ T7007] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 767.220111][ T7007] team0 (unregistering): Port device team_slave_1 removed [ 767.241082][ T7007] team0 (unregistering): Port device team_slave_0 removed [ 767.415040][T28410] lo speed is unknown, defaulting to 1000 [ 767.454762][T28460] bridge0: port 1(veth0_virt_wifi) entered blocking state [ 767.491968][T28460] bridge0: port 1(veth0_virt_wifi) entered disabled state [ 767.538060][T28460] veth0_virt_wifi: entered allmulticast mode [ 767.558776][T28464] netlink: 'syz.4.5563': attribute type 2 has an invalid length. [ 767.592934][T28460] veth0_virt_wifi: entered promiscuous mode [ 767.609911][T28460] bridge0: port 1(veth0_virt_wifi) entered blocking state [ 767.617169][T28460] bridge0: port 1(veth0_virt_wifi) entered forwarding state [ 767.762347][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.996465][T28490] netlink: 192 bytes leftover after parsing attributes in process `syz.4.5565'. [ 768.111048][T28486] lo speed is unknown, defaulting to 1000 [ 768.111219][T28410] lo speed is unknown, defaulting to 1000 [ 768.164337][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.172985][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.242715][T28498] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5570'. [ 768.552684][T28506] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5574'. [ 768.802417][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.964631][T28486] lo speed is unknown, defaulting to 1000 [ 768.975459][ T7007] IPVS: stop unused estimator thread 0... [ 768.977135][T28518] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5575'. [ 769.277595][T28530] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5577'. [ 769.409964][T28533] sctp: [Deprecated]: syz.0.5579 (pid 28533) Use of struct sctp_assoc_value in delayed_ack socket option. [ 769.409964][T28533] Use struct sctp_sack_info instead [ 769.469206][T28535] FAULT_INJECTION: forcing a failure. [ 769.469206][T28535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 769.513817][T28535] CPU: 1 UID: 0 PID: 28535 Comm: syz.3.5580 Not tainted syzkaller #0 PREEMPT(full) [ 769.513842][T28535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 769.513852][T28535] Call Trace: [ 769.513859][T28535] [ 769.513867][T28535] dump_stack_lvl+0xe8/0x150 [ 769.513893][T28535] should_fail_ex+0x40c/0x560 [ 769.513926][T28535] _copy_from_user+0x2d/0xb0 [ 769.513947][T28535] ___sys_sendmsg+0x1c6/0x360 [ 769.513966][T28535] ? __lock_acquire+0x683/0x2cd0 [ 769.513989][T28535] ? __pfx____sys_sendmsg+0x10/0x10 [ 769.514006][T28535] ? __lock_acquire+0x683/0x2cd0 [ 769.514029][T28535] ? kstrtouint+0x6e/0xe0 [ 769.514091][T28535] __sys_sendmmsg+0x27c/0x4e0 [ 769.514116][T28535] ? __pfx___sys_sendmmsg+0x10/0x10 [ 769.514133][T28535] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 769.514180][T28535] ? ksys_write+0x242/0x270 [ 769.514206][T28535] ? __pfx_ksys_write+0x10/0x10 [ 769.514237][T28535] __x64_sys_sendmmsg+0xa0/0xc0 [ 769.514256][T28535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.514275][T28535] do_syscall_64+0x174/0x580 [ 769.514294][T28535] ? trace_irq_disable+0x3b/0x140 [ 769.514319][T28535] ? clear_bhb_loop+0x40/0x90 [ 769.514341][T28535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.514358][T28535] RIP: 0033:0x7fa76459ce59 [ 769.514375][T28535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 769.514390][T28535] RSP: 002b:00007fa765458028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 769.514409][T28535] RAX: ffffffffffffffda RBX: 00007fa764815fa0 RCX: 00007fa76459ce59 [ 769.514422][T28535] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000004 [ 769.514433][T28535] RBP: 00007fa765458090 R08: 0000000000000000 R09: 0000000000000000 [ 769.514444][T28535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 769.514454][T28535] R13: 00007fa764816038 R14: 00007fa764815fa0 R15: 00007ffc838a5938 [ 769.514484][T28535] [ 770.407675][T28549] lo speed is unknown, defaulting to 1000 [ 770.581614][T28549] lo speed is unknown, defaulting to 1000 [ 770.680318][T28553] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5586'. [ 770.726316][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.735550][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.746883][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.755055][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.764160][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.991544][T28555] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 770.994585][T28562] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5590'. [ 771.089648][T28555] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 771.099439][T28555] dvmrp1: linktype set to 0 [ 771.241996][T28574] netlink: 'syz.0.5593': attribute type 1 has an invalid length. [ 771.273605][T28576] lo: Caught tx_queue_len zero misconfig [ 771.278648][T28574] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5593'. [ 771.612241][T28584] __nla_validate_parse: 1 callbacks suppressed [ 771.631780][T28584] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5597'. [ 771.643284][T28589] netlink: 13 bytes leftover after parsing attributes in process `syz.2.5598'. [ 771.764223][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.887277][T28603] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5603'. [ 771.952759][T28606] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5603'. [ 772.044559][T28610] FAULT_INJECTION: forcing a failure. [ 772.044559][T28610] name failslab, interval 1, probability 0, space 0, times 0 [ 772.063466][T28610] CPU: 1 UID: 0 PID: 28610 Comm: syz.3.5605 Not tainted syzkaller #0 PREEMPT(full) [ 772.063491][T28610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 772.063501][T28610] Call Trace: [ 772.063508][T28610] [ 772.063516][T28610] dump_stack_lvl+0xe8/0x150 [ 772.063541][T28610] should_fail_ex+0x40c/0x560 [ 772.063573][T28610] should_failslab+0xa8/0x100 [ 772.063593][T28610] __kmalloc_node_noprof+0xf0/0x7b0 [ 772.063618][T28610] ? alloc_slab_obj_exts+0xbf/0x250 [ 772.063646][T28610] alloc_slab_obj_exts+0xbf/0x250 [ 772.063671][T28610] __memcg_slab_post_alloc_hook+0x5b6/0xe60 [ 772.063713][T28610] kmem_cache_alloc_node_noprof+0x40a/0x680 [ 772.063738][T28610] ? __alloc_skb+0x1d7/0x7a0 [ 772.063761][T28610] ? kmem_cache_alloc_node_noprof+0x23a/0x680 [ 772.063789][T28610] __alloc_skb+0x1d7/0x7a0 [ 772.063821][T28610] alloc_skb_with_frags+0xc6/0x760 [ 772.063850][T28610] sock_alloc_send_pskb+0x878/0x990 [ 772.063890][T28610] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 772.063909][T28610] ? kasan_quarantine_put+0xbb/0x1f0 [ 772.063932][T28610] ? lockdep_hardirqs_on+0x7a/0x110 [ 772.063956][T28610] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 772.063975][T28610] ? kmem_cache_free+0x182/0x650 [ 772.064000][T28610] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 772.064029][T28610] unix_dgram_sendmsg+0x4da/0x17b0 [ 772.064071][T28610] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 772.064098][T28610] ? aa_sock_msg_perm+0xda/0x1b0 [ 772.064123][T28610] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 772.064142][T28610] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 772.064165][T28610] ____sys_sendmsg+0x9b9/0xa20 [ 772.064184][T28610] ? __might_fault+0xaf/0x130 [ 772.064213][T28610] ? __pfx_____sys_sendmsg+0x10/0x10 [ 772.064241][T28610] ? import_iovec+0x73/0xa0 [ 772.064271][T28610] ___sys_sendmsg+0x2a5/0x360 [ 772.064289][T28610] ? __lock_acquire+0x683/0x2cd0 [ 772.064313][T28610] ? __pfx____sys_sendmsg+0x10/0x10 [ 772.064329][T28610] ? __lock_acquire+0x683/0x2cd0 [ 772.064353][T28610] ? kstrtouint+0x6e/0xe0 [ 772.064417][T28610] __sys_sendmmsg+0x27c/0x4e0 [ 772.064442][T28610] ? __pfx___sys_sendmmsg+0x10/0x10 [ 772.064459][T28610] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 772.064506][T28610] ? ksys_write+0x242/0x270 [ 772.064533][T28610] ? __pfx_ksys_write+0x10/0x10 [ 772.064564][T28610] __x64_sys_sendmmsg+0xa0/0xc0 [ 772.064583][T28610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.064602][T28610] do_syscall_64+0x174/0x580 [ 772.064622][T28610] ? trace_irq_disable+0x3b/0x140 [ 772.064646][T28610] ? clear_bhb_loop+0x40/0x90 [ 772.064668][T28610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.064685][T28610] RIP: 0033:0x7fa76459ce59 [ 772.064702][T28610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 772.064717][T28610] RSP: 002b:00007fa765458028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 772.064737][T28610] RAX: ffffffffffffffda RBX: 00007fa764815fa0 RCX: 00007fa76459ce59 [ 772.064750][T28610] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000004 [ 772.064762][T28610] RBP: 00007fa765458090 R08: 0000000000000000 R09: 0000000000000000 [ 772.064773][T28610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 772.064784][T28610] R13: 00007fa764816038 R14: 00007fa764815fa0 R15: 00007ffc838a5938 [ 772.064815][T28610] [ 772.491121][T28612] netlink: 'syz.3.5606': attribute type 1 has an invalid length. [ 772.506423][T28612] netlink: 168 bytes leftover after parsing attributes in process `syz.3.5606'. [ 772.541554][T28613] netlink: 'syz.3.5606': attribute type 1 has an invalid length. [ 772.549691][T28613] netlink: 168 bytes leftover after parsing attributes in process `syz.3.5606'. [ 772.622050][T28613] netlink: 'syz.3.5606': attribute type 1 has an invalid length. [ 772.641123][T28612] netlink: 'syz.3.5606': attribute type 1 has an invalid length. [ 772.667711][T28615] bond6: Unable to set up delay as MII monitoring is disabled [ 772.680906][T28615] bond6 (unregistering): Released all slaves [ 772.711270][T28613] workqueue: Failed to create a rescuer kthread for wq "bond17": -EINTR [ 772.713219][T28612] workqueue: Failed to create a rescuer kthread for wq "bond17": -EINTR [ 772.802847][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.896531][T28629] mac80211_hwsim hwsim37 syzkaller1: entered promiscuous mode [ 772.912490][T28629] mac80211_hwsim hwsim37 syzkaller1: entered allmulticast mode [ 772.939935][T28629] lo: left allmulticast mode [ 773.075089][T28629] bridge0: port 1(veth0_virt_wifi) entered disabled state [ 773.082475][T28629] bridge0: port 2(bridge_slave_1) entered disabled state [ 773.167720][T28646] FAULT_INJECTION: forcing a failure. [ 773.167720][T28646] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 773.190468][T28646] CPU: 0 UID: 0 PID: 28646 Comm: syz.1.5616 Not tainted syzkaller #0 PREEMPT(full) [ 773.190492][T28646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 773.190502][T28646] Call Trace: [ 773.190510][T28646] [ 773.190517][T28646] dump_stack_lvl+0xe8/0x150 [ 773.190542][T28646] should_fail_ex+0x40c/0x560 [ 773.190573][T28646] _copy_from_user+0x2d/0xb0 [ 773.190594][T28646] ___sys_sendmsg+0x1c6/0x360 [ 773.190612][T28646] ? __lock_acquire+0x683/0x2cd0 [ 773.190634][T28646] ? __pfx____sys_sendmsg+0x10/0x10 [ 773.190651][T28646] ? __lock_acquire+0x683/0x2cd0 [ 773.190682][T28646] ? kstrtouint+0x6e/0xe0 [ 773.190740][T28646] __sys_sendmmsg+0x27c/0x4e0 [ 773.190763][T28646] ? __pfx___sys_sendmmsg+0x10/0x10 [ 773.190780][T28646] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 773.190826][T28646] ? ksys_write+0x242/0x270 [ 773.190853][T28646] ? __pfx_ksys_write+0x10/0x10 [ 773.190883][T28646] __x64_sys_sendmmsg+0xa0/0xc0 [ 773.190901][T28646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.190920][T28646] do_syscall_64+0x174/0x580 [ 773.190939][T28646] ? trace_irq_disable+0x3b/0x140 [ 773.190965][T28646] ? clear_bhb_loop+0x40/0x90 [ 773.190987][T28646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.191004][T28646] RIP: 0033:0x7fd40839ce59 [ 773.191021][T28646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 773.191036][T28646] RSP: 002b:00007fd4091cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 773.191055][T28646] RAX: ffffffffffffffda RBX: 00007fd408615fa0 RCX: 00007fd40839ce59 [ 773.191067][T28646] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000004 [ 773.191079][T28646] RBP: 00007fd4091cf090 R08: 0000000000000000 R09: 0000000000000000 [ 773.191090][T28646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 773.191101][T28646] R13: 00007fd408616038 R14: 00007fd408615fa0 R15: 00007ffe4f990a78 [ 773.191131][T28646] [ 773.457322][T28629] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 773.482100][T28629] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 773.547349][T28629] macvlan0: left promiscuous mode [ 773.568042][T28629] mac80211_hwsim hwsim36 wlan0: left promiscuous mode [ 773.575121][T28629] mac80211_hwsim hwsim36 wlan0: left allmulticast mode [ 773.601007][T28629] geneve2: left allmulticast mode [ 773.608610][T28629] ip6gre1: left promiscuous mode [ 773.613922][T28629] ip6gre1: left allmulticast mode [ 773.621966][T28629] syzkaller0: left promiscuous mode [ 773.628698][T28629] syzkaller0: left allmulticast mode [ 773.654810][T28629] bond5: left promiscuous mode [ 773.660108][T28629] bond6: left promiscuous mode [ 773.666591][T28629] bond7: left promiscuous mode [ 773.671367][T28629] veth0_to_bond: left promiscuous mode [ 773.677401][T28629] bond7: left allmulticast mode [ 773.685281][T28629] veth0_to_bond: left allmulticast mode [ 773.709504][T28629] bond9: left promiscuous mode [ 773.716089][T28629] bond11: left promiscuous mode [ 773.721641][T28629] ip6tnl3: left allmulticast mode [ 773.726963][T28629] mac80211_hwsim hwsim37 syzkaller1: left promiscuous mode [ 773.737321][T28629] mac80211_hwsim hwsim37 syzkaller1: left allmulticast mode [ 773.745370][T28629] bond12: left promiscuous mode [ 773.750221][T28629] vti0: left promiscuous mode [ 773.803343][T28636] sch_tbf: burst 0 is lower than device ip6gre0 mtu (32769) ! [ 773.813240][ T7013] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.832752][ T7013] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.842568][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.848473][ T7013] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.860414][ T7013] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.910342][ T7013] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.921348][ T7013] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.933384][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.941639][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.054762][ T7013] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.087766][ T7013] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.141742][T28662] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5622'. [ 774.165184][T28673] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5623'. [ 774.239236][T28678] netlink: 120 bytes leftover after parsing attributes in process `syz.0.5624'. [ 774.276035][T28678] tipc: Enabling of bearer rejected, media not registered [ 774.301051][T28678] netlink: 'syz.0.5624': attribute type 11 has an invalid length. [ 774.328063][T28678] netlink: 140 bytes leftover after parsing attributes in process `syz.0.5624'. [ 774.370217][T28686] FAULT_INJECTION: forcing a failure. [ 774.370217][T28686] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 774.400730][T28686] CPU: 0 UID: 0 PID: 28686 Comm: syz.2.5628 Not tainted syzkaller #0 PREEMPT(full) [ 774.400768][T28686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 774.400779][T28686] Call Trace: [ 774.400787][T28686] [ 774.400795][T28686] dump_stack_lvl+0xe8/0x150 [ 774.400820][T28686] should_fail_ex+0x40c/0x560 [ 774.400850][T28686] _copy_from_user+0x2d/0xb0 [ 774.400871][T28686] ___sys_sendmsg+0x1c6/0x360 [ 774.400891][T28686] ? __lock_acquire+0x683/0x2cd0 [ 774.400914][T28686] ? __pfx____sys_sendmsg+0x10/0x10 [ 774.400931][T28686] ? __lock_acquire+0x683/0x2cd0 [ 774.400954][T28686] ? kstrtouint+0x6e/0xe0 [ 774.401015][T28686] __sys_sendmmsg+0x27c/0x4e0 [ 774.401038][T28686] ? __pfx___sys_sendmmsg+0x10/0x10 [ 774.401055][T28686] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 774.401100][T28686] ? ksys_write+0x242/0x270 [ 774.401127][T28686] ? __pfx_ksys_write+0x10/0x10 [ 774.401157][T28686] __x64_sys_sendmmsg+0xa0/0xc0 [ 774.401177][T28686] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.401195][T28686] do_syscall_64+0x174/0x580 [ 774.401213][T28686] ? trace_irq_disable+0x3b/0x140 [ 774.401237][T28686] ? clear_bhb_loop+0x40/0x90 [ 774.401257][T28686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.401274][T28686] RIP: 0033:0x7fe9d9d9ce59 [ 774.401291][T28686] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 774.401305][T28686] RSP: 002b:00007fe9dac60028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 774.401323][T28686] RAX: ffffffffffffffda RBX: 00007fe9da015fa0 RCX: 00007fe9d9d9ce59 [ 774.401335][T28686] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000004 [ 774.401346][T28686] RBP: 00007fe9dac60090 R08: 0000000000000000 R09: 0000000000000000 [ 774.401356][T28686] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 774.401366][T28686] R13: 00007fe9da016038 R14: 00007fe9da015fa0 R15: 00007ffe7c3fb848 [ 774.401396][T28686] [ 774.677490][T28693] xt_TPROXY: Can be used only with -p tcp or -p udp [ 774.957541][T28716] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.964914][T28716] bridge0: port 1(() entered disabled state [ 775.030315][T28719] sctp: [Deprecated]: syz.3.5637 (pid 28719) Use of struct sctp_assoc_value in delayed_ack socket option. [ 775.030315][T28719] Use struct sctp_sack_info instead [ 775.123423][T28736] netlink: 'syz.1.5643': attribute type 32 has an invalid length. [ 775.190953][T28744] netlink: 'syz.4.5645': attribute type 1 has an invalid length. [ 775.308594][T28753] netlink: 'syz.2.5649': attribute type 3 has an invalid length. [ 775.328398][T28751] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 775.363082][T28751] tap0: tun_chr_ioctl cmd 2147767520 [ 775.378642][T28759] tap0: tun_chr_ioctl cmd 1074025673 [ 775.386512][T28757] sctp: [Deprecated]: syz.4.5651 (pid 28757) Use of int in max_burst socket option. [ 775.386512][T28757] Use struct sctp_assoc_value instead [ 775.436013][T28755] xt_cgroup: invalid path, errno=-2 [ 775.519185][T28765] block nbd0: reconnected socket [ 775.528530][ T5635] block nbd0: Receive control failed (result -32) [ 775.646462][T28770] netlink: 'syz.3.5654': attribute type 1 has an invalid length. [ 775.710407][T28770] bond17: entered promiscuous mode [ 775.716639][T28770] bond17: entered allmulticast mode [ 775.726496][T28770] 8021q: adding VLAN 0 to HW filter on device bond17 [ 775.746732][T28782] macvlan2: entered promiscuous mode [ 775.752059][T28782] macvlan2: entered allmulticast mode [ 775.759933][T28782] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 775.798507][ T29] audit: type=1107 audit(1781667112.486:20): pid=28769 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 775.843649][ T56] net_ratelimit: 2 callbacks suppressed [ 775.843679][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.857626][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.866271][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.874914][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.922364][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.068447][T28800] openvswitch: netlink: Message has 4 unknown bytes. [ 776.087615][T28800] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 776.516257][T28821] netlink: 'syz.0.5669': attribute type 11 has an invalid length. [ 776.518212][T28825] lo speed is unknown, defaulting to 1000 [ 776.550437][T28830] IPVS: Unknown mcast interface: vcan0 [ 776.736286][T28834] macsec3: entered promiscuous mode [ 776.961374][T21892] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 776.965530][T28840] syzkaller0: entered promiscuous mode [ 776.969312][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.990721][T21892] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 777.001897][T21892] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 777.002035][T28840] syzkaller0: entered allmulticast mode [ 777.027351][T21892] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 777.040982][T21892] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 777.059811][T28840] tipc: Resetting bearer [ 777.116004][ T5635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 777.140266][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 777.147828][ T5635] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 777.162065][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 777.174501][ T5635] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 777.345543][T28853] validate_nla: 1 callbacks suppressed [ 777.345561][T28853] netlink: 'syz.2.5678': attribute type 1 has an invalid length. [ 777.444225][T17417] bond0: (slave syz_tun): Releasing backup interface [ 777.477391][T28850] can: request_module (can-proto-0) failed. [ 777.487689][T17417] syz_tun (unregistering): left allmulticast mode [ 777.593778][T28853] bond7: entered promiscuous mode [ 777.600693][T28853] 8021q: adding VLAN 0 to HW filter on device bond7 [ 777.641994][T28864] bond7: (slave bridge8): making interface the new active one [ 777.651147][T28864] bridge8: entered promiscuous mode [ 777.661630][T28864] bridge8: left promiscuous mode [ 777.697039][T28831] lo speed is unknown, defaulting to 1000 [ 777.729736][T28825] lo speed is unknown, defaulting to 1000 [ 777.945677][T28884] __nla_validate_parse: 21 callbacks suppressed [ 777.945696][T28884] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5682'. [ 778.002353][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.064426][T28884] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5682'. [ 778.237555][T28897] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5686'. [ 778.372895][T28904] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5688'. [ 778.502851][T28841] lo speed is unknown, defaulting to 1000 [ 778.505414][T28831] lo speed is unknown, defaulting to 1000 [ 778.525705][T28907] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5689'. [ 778.562005][T28907] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5689'. [ 778.573846][T28907] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5689'. [ 778.710885][T28913] netlink: 'syz.0.5692': attribute type 4 has an invalid length. [ 778.860327][T28920] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5695'. [ 778.953207][T28918] netlink: 13 bytes leftover after parsing attributes in process `syz.0.5694'. [ 778.988356][T28918] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 779.016398][T28841] lo speed is unknown, defaulting to 1000 [ 779.043023][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.102104][T28925] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 779.133517][T28925] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5696'. [ 779.172699][T28925] unsupported nla_type 216 [ 779.282617][T21892] Bluetooth: hci2: command tx timeout [ 780.724094][ T5635] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 781.097308][T29002] netlink: 'syz.4.5712': attribute type 30 has an invalid length. [ 781.126774][ T7004] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.138849][ T7004] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.148205][T29002] netlink: 'syz.4.5712': attribute type 30 has an invalid length. [ 781.161254][ T7004] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.173417][ T7004] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.341407][T28841] bridge0: port 1(bridge_slave_0) entered blocking state [ 781.348988][T28841] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.357183][T28841] bridge_slave_0: entered allmulticast mode [ 781.370947][T28841] bridge_slave_0: entered promiscuous mode [ 781.372531][ T5635] Bluetooth: hci2: command tx timeout [ 781.379209][T28841] bridge0: port 2(bridge_slave_1) entered blocking state [ 781.391089][T28841] bridge0: port 2(bridge_slave_1) entered disabled state [ 781.401747][T28841] bridge_slave_1: entered allmulticast mode [ 781.428349][T28841] bridge_slave_1: entered promiscuous mode [ 781.592817][T29026] xt_hashlimit: size too large, truncated to 1048576 [ 781.610302][ T7013] net_ratelimit: 25 callbacks suppressed [ 781.610319][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.624645][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.634125][ T7009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.642476][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.665055][T29021] 8021q: adding VLAN 0 to HW filter on device bond0 [ 781.707461][T29034] netlink: 'syz.0.5717': attribute type 13 has an invalid length. [ 781.808190][T28841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 781.875921][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 781.883101][ T56] bridge0: port 2(bridge_slave_1) entered listening state [ 781.967060][T28841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 782.056326][T28841] team0: Port device team_slave_0 added [ 782.065821][T28841] team0: Port device team_slave_1 added [ 782.140749][T28841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 782.157116][T28841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 782.194785][T28841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 782.227413][T28841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 782.243530][T28841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 782.283833][T28841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 782.346995][T29055] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.373888][T29055] bond0: (slave bond_slave_0): Releasing backup interface [ 782.427862][T29055] bond0: (slave bond_slave_1): Releasing backup interface [ 782.477374][T29055] team0: Port device team_slave_0 removed [ 782.502545][T29055] team0: Port device team_slave_1 removed [ 782.526943][T29055] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 782.703658][T28841] hsr_slave_0: entered promiscuous mode [ 782.710422][T28841] hsr_slave_1: entered promiscuous mode [ 782.718446][T29065] lo speed is unknown, defaulting to 1000 [ 782.898062][T29082] netlink: 'syz.4.5730': attribute type 1 has an invalid length. [ 783.108551][T28841] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 783.266508][T28841] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 783.302119][T29065] lo speed is unknown, defaulting to 1000 [ 783.351091][T28841] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 783.430953][T28841] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 783.445618][ T5635] Bluetooth: hci2: command tx timeout [ 783.618073][T29092] __nla_validate_parse: 11 callbacks suppressed [ 783.618091][T29092] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5733'. [ 783.923469][T29100] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5736'. [ 784.058597][T29104] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5737'. [ 784.157051][T28841] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 784.181381][T28841] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 784.354146][T28841] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 784.374148][T28841] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 784.383200][T28841] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 784.398614][T28841] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 784.416629][T28841] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 784.455124][T28841] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 784.715553][T29119] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5740'. [ 784.749243][T29119] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5740'. [ 784.783171][T28841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 784.801947][T29119] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5740'. [ 784.811884][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.812046][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.845398][T29119] netlink: 'syz.0.5740': attribute type 5 has an invalid length. [ 784.851830][T28841] 8021q: adding VLAN 0 to HW filter on device team0 [ 784.906944][ T7023] bridge0: port 1(bridge_slave_0) entered blocking state [ 784.914123][ T7023] bridge0: port 1(bridge_slave_0) entered forwarding state [ 784.980409][ T7023] bridge0: port 2(bridge_slave_1) entered blocking state [ 784.987612][ T7023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 785.269665][T29132] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 785.523643][ T5635] Bluetooth: hci2: command tx timeout [ 785.710905][T29151] netlink: 'syz.2.5747': attribute type 10 has an invalid length. [ 785.760752][T29151] team0: Port device bridge0 added [ 786.222896][T28841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 786.355579][T28841] veth0_vlan: entered promiscuous mode [ 786.372623][T28841] veth1_vlan: entered promiscuous mode [ 786.417712][T28841] veth0_macvtap: entered promiscuous mode [ 786.441679][T28841] veth1_macvtap: entered promiscuous mode [ 786.485331][T28841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 786.526886][T28841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 786.581272][ T7023] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.611715][ T7023] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.645176][T29179] nbd2: detected capacity change from 0 to 63 [ 786.648714][ T7023] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.667867][T29185] block nbd2: NBD_DISCONNECT [ 786.688292][T29185] block nbd2: Disconnected due to user request. [ 786.690426][ T7023] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.724001][T28848] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 786.732581][T29185] block nbd2: shutting down sockets [ 786.749620][T28848] Buffer I/O error on dev nbd2, logical block 0, async page read [ 786.770986][T28848] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 786.785842][T28848] Buffer I/O error on dev nbd2, logical block 1, async page read [ 786.818125][ T4959] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 2 prio class 2 [ 786.828738][ T4959] Buffer I/O error on dev nbd2, logical block 2, async page read [ 786.838824][ T4959] Buffer I/O error on dev nbd2, logical block 3, async page read [ 786.849713][T28848] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 786.930566][T28848] Buffer I/O error on dev nbd2, logical block 0, async page read [ 786.971802][T28848] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 787.051022][T28848] Buffer I/O error on dev nbd2, logical block 1, async page read [ 787.101946][T28848] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 787.149013][T28848] Buffer I/O error on dev nbd2, logical block 2, async page read [ 787.184322][T29210] netlink: 'syz.2.5761': attribute type 1 has an invalid length. [ 787.217078][T28848] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 787.238291][T28848] Buffer I/O error on dev nbd2, logical block 3, async page read [ 787.267501][T28848] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 787.296437][T28848] Buffer I/O error on dev nbd2, logical block 0, async page read [ 787.307562][ T7013] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 787.319494][T28848] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 787.326276][ T7013] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 787.331911][T28848] Buffer I/O error on dev nbd2, logical block 1, async page read [ 787.345426][T28848] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 787.360068][T29210] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5761'. [ 787.360825][T28848] ldm_validate_partition_table(): Disk read failed. [ 787.375105][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.385235][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.393368][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.401449][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.414532][T28848] Dev nbd2: unable to read RDB block 0 [ 787.423693][T28848] nbd2: unable to read partition table [ 787.469733][T28848] ldm_validate_partition_table(): Disk read failed. [ 787.479937][T28848] Dev nbd2: unable to read RDB block 0 [ 787.494316][T28848] nbd2: unable to read partition table [ 787.498022][T29217] 8021q: adding VLAN 0 to HW filter on device bond9 [ 787.519283][T28848] [ 787.521631][T28848] ====================================================== [ 787.528644][T28848] WARNING: possible circular locking dependency detected [ 787.535670][T28848] syzkaller #0 Not tainted [ 787.540079][T28848] ------------------------------------------------------ [ 787.547090][T28848] udevd/28848 is trying to acquire lock: [ 787.552717][T28848] ffffffff8ea80d80 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x4a/0x680 [ 787.562559][T28848] [ 787.562559][T28848] but task is already holding lock: [ 787.569908][T28848] ffffffff90167140 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 [ 787.580430][T28848] [ 787.580430][T28848] which lock already depends on the new lock. [ 787.580430][T28848] [ 787.590816][T28848] [ 787.590816][T28848] the existing dependency chain (in reverse order) is: [ 787.599808][T28848] [ 787.599808][T28848] -> #8 (uevent_sock_mutex){+.+.}-{4:4}: [ 787.607610][T28848] __mutex_lock+0x19d/0x1590 [ 787.612711][T28848] kobject_uevent_net_broadcast+0x27e/0x560 [ 787.619116][T28848] kobject_uevent_env+0x566/0x9e0 [ 787.624649][T28848] device_add+0x544/0xb90 [ 787.629490][T28848] device_create+0x269/0x300 [ 787.634583][T28848] msr_device_create+0x33/0x50 [ 787.639867][T28848] cpuhp_invoke_callback+0x448/0x860 [ 787.645665][T28848] cpuhp_thread_fun+0x362/0x780 [ 787.651021][T28848] smpboot_thread_fn+0x57c/0xa80 [ 787.656464][T28848] kthread+0x389/0x470 [ 787.661067][T28848] ret_from_fork+0x514/0xb70 [ 787.666160][T28848] ret_from_fork_asm+0x1a/0x30 [ 787.671430][T28848] [ 787.671430][T28848] -> #7 (cpuhp_state-up){+.+.}-{0:0}: [ 787.678971][T28848] cpuhp_thread_fun+0x127/0x780 [ 787.684327][T28848] smpboot_thread_fn+0x57c/0xa80 [ 787.689779][T28848] kthread+0x389/0x470 [ 787.694368][T28848] ret_from_fork+0x514/0xb70 [ 787.699467][T28848] ret_from_fork_asm+0x1a/0x30 [ 787.704748][T28848] [ 787.704748][T28848] -> #6 (cpu_hotplug_lock){++++}-{0:0}: [ 787.712476][T28848] cpus_read_lock+0x42/0x160 [ 787.717585][T28848] static_key_slow_inc+0x12/0x30 [ 787.723031][T28848] nbd_genl_reconfigure+0x1301/0x1e80 [ 787.728921][T28848] genl_family_rcv_msg_doit+0x233/0x340 [ 787.734989][T28848] genl_rcv_msg+0x614/0x7a0 [ 787.740007][T28848] netlink_rcv_skb+0x226/0x4a0 [ 787.745283][T28848] genl_rcv+0x28/0x40 [ 787.749776][T28848] netlink_unicast+0x7bb/0x940 [ 787.755095][T28848] netlink_sendmsg+0x813/0xb40 [ 787.760367][T28848] ____sys_sendmsg+0x9b9/0xa20 [ 787.765634][T28848] ___sys_sendmsg+0x2a5/0x360 [ 787.770813][T28848] __x64_sys_sendmsg+0x1bd/0x2a0 [ 787.776268][T28848] do_syscall_64+0x174/0x580 [ 787.781364][T28848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.787760][T28848] [ 787.787760][T28848] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 787.795392][T28848] __mutex_lock+0x19d/0x1590 [ 787.800487][T28848] nbd_queue_rq+0x373/0x1150 [ 787.805585][T28848] blk_mq_dispatch_rq_list+0x499/0x1990 [ 787.811634][T28848] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 787.818468][T28848] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 787.824953][T28848] blk_mq_run_hw_queue+0x348/0x4f0 [ 787.830577][T28848] blk_mq_dispatch_list+0xd11/0xe10 [ 787.836279][T28848] blk_mq_flush_plug_list+0x45f/0x540 [ 787.842156][T28848] __blk_flush_plug+0x3ed/0x4d0 [ 787.847513][T28848] __submit_bio+0x465/0x560 [ 787.852521][T28848] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 787.858655][T28848] block_read_full_folio+0x599/0x830 [ 787.864446][T28848] filemap_read_folio+0x12c/0x3a0 [ 787.869977][T28848] do_read_cache_folio+0x354/0x590 [ 787.875599][T28848] read_part_sector+0xb6/0x2b0 [ 787.880872][T28848] adfspart_check_ICS+0xb1/0x960 [ 787.886313][T28848] bdev_disk_changed+0x82b/0x1780 [ 787.891842][T28848] blkdev_get_whole+0x372/0x510 [ 787.897198][T28848] bdev_open+0x324/0xd70 [ 787.901943][T28848] blkdev_open+0x461/0x600 [ 787.906863][T28848] do_dentry_open+0x816/0x1380 [ 787.912132][T28848] vfs_open+0x3b/0x340 [ 787.916705][T28848] path_openat+0x2e3b/0x3890 [ 787.921808][T28848] do_file_open+0x23e/0x4a0 [ 787.926818][T28848] do_sys_openat2+0x113/0x200 [ 787.932005][T28848] __x64_sys_openat+0x138/0x170 [ 787.937360][T28848] do_syscall_64+0x174/0x580 [ 787.942457][T28848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.948853][T28848] [ 787.948853][T28848] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 787.956046][T28848] __mutex_lock+0x19d/0x1590 [ 787.961141][T28848] nbd_queue_rq+0xc1/0x1150 [ 787.966153][T28848] blk_mq_dispatch_rq_list+0x499/0x1990 [ 787.972207][T28848] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 787.979039][T28848] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 787.985536][T28848] blk_mq_run_hw_queue+0x348/0x4f0 [ 787.991200][T28848] blk_mq_dispatch_list+0xd11/0xe10 [ 787.996911][T28848] blk_mq_flush_plug_list+0x45f/0x540 [ 788.002796][T28848] __blk_flush_plug+0x3ed/0x4d0 [ 788.008159][T28848] __submit_bio+0x465/0x560 [ 788.013176][T28848] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 788.019320][T28848] block_read_full_folio+0x599/0x830 [ 788.025117][T28848] filemap_read_folio+0x12c/0x3a0 [ 788.030661][T28848] do_read_cache_folio+0x354/0x590 [ 788.036286][T28848] read_part_sector+0xb6/0x2b0 [ 788.041558][T28848] adfspart_check_ICS+0xb1/0x960 [ 788.047003][T28848] bdev_disk_changed+0x82b/0x1780 [ 788.052535][T28848] blkdev_get_whole+0x372/0x510 [ 788.057899][T28848] bdev_open+0x324/0xd70 [ 788.062650][T28848] blkdev_open+0x461/0x600 [ 788.067577][T28848] do_dentry_open+0x816/0x1380 [ 788.072847][T28848] vfs_open+0x3b/0x340 [ 788.077424][T28848] path_openat+0x2e3b/0x3890 [ 788.082529][T28848] do_file_open+0x23e/0x4a0 [ 788.087543][T28848] do_sys_openat2+0x113/0x200 [ 788.092725][T28848] __x64_sys_openat+0x138/0x170 [ 788.098080][T28848] do_syscall_64+0x174/0x580 [ 788.103180][T28848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.109576][T28848] [ 788.109576][T28848] -> #3 (set->srcu){.+.+}-{0:0}: [ 788.116689][T28848] __synchronize_srcu+0xc9/0x2f0 [ 788.122151][T28848] elevator_switch+0x1e8/0x7b0 [ 788.127456][T28848] elevator_change+0x2fa/0x480 [ 788.132736][T28848] elevator_set_default+0x375/0x440 [ 788.138444][T28848] blk_register_queue+0x3f3/0x4e0 [ 788.143976][T28848] __add_disk+0x6cb/0xe30 [ 788.148816][T28848] add_disk_fwnode+0xfb/0x4b0 [ 788.154001][T28848] nbd_dev_add+0x733/0xb60 [ 788.158927][T28848] nbd_init+0x15f/0x1e0 [ 788.163589][T28848] do_one_initcall+0x250/0x870 [ 788.168863][T28848] do_initcall_level+0x10a/0x1a0 [ 788.174307][T28848] do_initcalls+0x59/0xa0 [ 788.179144][T28848] kernel_init_freeable+0x29d/0x3e0 [ 788.184846][T28848] kernel_init+0x1d/0x1d0 [ 788.189689][T28848] ret_from_fork+0x514/0xb70 [ 788.194786][T28848] ret_from_fork_asm+0x1a/0x30 [ 788.200054][T28848] [ 788.200054][T28848] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 788.207854][T28848] __mutex_lock+0x19d/0x1590 [ 788.212951][T28848] elevator_change+0x1af/0x480 [ 788.218220][T28848] elevator_set_none+0xb5/0x140 [ 788.223574][T28848] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 788.229890][T28848] nbd_start_device+0x189/0xb30 [ 788.235248][T28848] nbd_genl_connect+0x1597/0x1c10 [ 788.240781][T28848] genl_family_rcv_msg_doit+0x233/0x340 [ 788.246837][T28848] genl_rcv_msg+0x614/0x7a0 [ 788.251853][T28848] netlink_rcv_skb+0x226/0x4a0 [ 788.257121][T28848] genl_rcv+0x28/0x40 [ 788.261619][T28848] netlink_unicast+0x7bb/0x940 [ 788.266899][T28848] netlink_sendmsg+0x813/0xb40 [ 788.272168][T28848] ____sys_sendmsg+0x9b9/0xa20 [ 788.277436][T28848] ___sys_sendmsg+0x2a5/0x360 [ 788.282616][T28848] __x64_sys_sendmsg+0x1bd/0x2a0 [ 788.288060][T28848] do_syscall_64+0x174/0x580 [ 788.293155][T28848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.299553][T28848] [ 788.299553][T28848] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 788.308158][T28848] blk_alloc_queue+0x544/0x690 [ 788.313427][T28848] __blk_mq_alloc_disk+0x194/0x390 [ 788.319046][T28848] nbd_dev_add+0x494/0xb60 [ 788.323972][T28848] nbd_init+0x15f/0x1e0 [ 788.328637][T28848] do_one_initcall+0x250/0x870 [ 788.333904][T28848] do_initcall_level+0x10a/0x1a0 [ 788.339345][T28848] do_initcalls+0x59/0xa0 [ 788.344181][T28848] kernel_init_freeable+0x29d/0x3e0 [ 788.349885][T28848] kernel_init+0x1d/0x1d0 [ 788.354724][T28848] ret_from_fork+0x514/0xb70 [ 788.359816][T28848] ret_from_fork_asm+0x1a/0x30 [ 788.365120][T28848] [ 788.365120][T28848] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 788.372318][T28848] __lock_acquire+0x1520/0x2cd0 [ 788.377679][T28848] lock_acquire+0x106/0x350 [ 788.382689][T28848] fs_reclaim_acquire+0x71/0x100 [ 788.388144][T28848] kmem_cache_alloc_node_noprof+0x4a/0x680 [ 788.394457][T28848] __alloc_skb+0x1d7/0x7a0 [ 788.399384][T28848] alloc_uevent_skb+0x7d/0x230 [ 788.404657][T28848] kobject_uevent_net_broadcast+0x2fa/0x560 [ 788.411064][T28848] kobject_uevent_env+0x566/0x9e0 [ 788.416595][T28848] nbd_config_put+0x185/0x660 [ 788.421777][T28848] nbd_release+0xfe/0x140 [ 788.426618][T28848] bdev_release+0x571/0x690 [ 788.431629][T28848] blkdev_release+0x15/0x20 [ 788.436647][T28848] __fput+0x418/0xa50 [ 788.441177][T28848] fput_close_sync+0x11f/0x240 [ 788.446901][T28848] __x64_sys_close+0x7e/0x110 [ 788.452091][T28848] do_syscall_64+0x174/0x580 [ 788.457191][T28848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.463590][T28848] [ 788.463590][T28848] other info that might help us debug this: [ 788.463590][T28848] [ 788.473812][T28848] Chain exists of: [ 788.473812][T28848] fs_reclaim --> cpuhp_state-up --> uevent_sock_mutex [ 788.473812][T28848] [ 788.486485][T28848] Possible unsafe locking scenario: [ 788.486485][T28848] [ 788.493915][T28848] CPU0 CPU1 [ 788.499260][T28848] ---- ---- [ 788.504606][T28848] lock(uevent_sock_mutex); [ 788.509187][T28848] lock(cpuhp_state-up); [ 788.516018][T28848] lock(uevent_sock_mutex); [ 788.523113][T28848] lock(fs_reclaim); [ 788.527083][T28848] [ 788.527083][T28848] *** DEADLOCK *** [ 788.527083][T28848] [ 788.535207][T28848] 3 locks held by udevd/28848: [ 788.539950][T28848] #0: ffff88804d298350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1b8/0x690 [ 788.549510][T28848] #1: ffff88803b788a60 (&nbd->config_lock){+.+.}-{4:4}, at: refcount_dec_and_mutex_lock+0x30/0xa0 [ 788.560196][T28848] #2: ffffffff90167140 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 [ 788.571146][T28848] [ 788.571146][T28848] stack backtrace: [ 788.577020][T28848] CPU: 1 UID: 0 PID: 28848 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 788.577038][T28848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 788.577047][T28848] Call Trace: [ 788.577053][T28848] [ 788.577059][T28848] dump_stack_lvl+0xe8/0x150 [ 788.577077][T28848] print_circular_bug+0x2e1/0x300 [ 788.577097][T28848] check_noncircular+0x12e/0x150 [ 788.577117][T28848] __lock_acquire+0x1520/0x2cd0 [ 788.577132][T28848] ? lockdep_unlock+0x5d/0xd0 [ 788.577151][T28848] ? kmem_cache_alloc_node_noprof+0x4a/0x680 [ 788.577170][T28848] lock_acquire+0x106/0x350 [ 788.577183][T28848] ? kmem_cache_alloc_node_noprof+0x4a/0x680 [ 788.577202][T28848] ? lock_acquire+0x106/0x350 [ 788.577218][T28848] fs_reclaim_acquire+0x71/0x100 [ 788.577237][T28848] ? kmem_cache_alloc_node_noprof+0x4a/0x680 [ 788.577255][T28848] kmem_cache_alloc_node_noprof+0x4a/0x680 [ 788.577273][T28848] ? __alloc_skb+0x1d7/0x7a0 [ 788.577292][T28848] ? __local_bh_enable_ip+0xd0/0x130 [ 788.577308][T28848] __alloc_skb+0x1d7/0x7a0 [ 788.577328][T28848] alloc_uevent_skb+0x7d/0x230 [ 788.577350][T28848] kobject_uevent_net_broadcast+0x2fa/0x560 [ 788.577372][T28848] kobject_uevent_env+0x566/0x9e0 [ 788.577394][T28848] nbd_config_put+0x185/0x660 [ 788.577415][T28848] nbd_release+0xfe/0x140 [ 788.577434][T28848] ? __pfx_nbd_release+0x10/0x10 [ 788.577453][T28848] bdev_release+0x571/0x690 [ 788.577472][T28848] ? __pfx_blkdev_release+0x10/0x10 [ 788.577488][T28848] blkdev_release+0x15/0x20 [ 788.577505][T28848] __fput+0x418/0xa50 [ 788.577524][T28848] fput_close_sync+0x11f/0x240 [ 788.577540][T28848] ? __pfx_fput_close_sync+0x10/0x10 [ 788.577558][T28848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.577573][T28848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.577587][T28848] __x64_sys_close+0x7e/0x110 [ 788.577603][T28848] do_syscall_64+0x174/0x580 [ 788.577624][T28848] ? trace_irq_disable+0x3b/0x140 [ 788.577644][T28848] ? clear_bhb_loop+0x40/0x90 [ 788.577659][T28848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.577673][T28848] RIP: 0033:0x7f9a5d8a7407 [ 788.577686][T28848] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 788.577699][T28848] RSP: 002b:00007ffc1b351590 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 788.577714][T28848] RAX: ffffffffffffffda RBX: 00007f9a5dfe1880 RCX: 00007f9a5d8a7407 [ 788.577724][T28848] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 788.577733][T28848] RBP: 00007f9a5dfe16e8 R08: 0000000000000000 R09: 0000000000000000 [ 788.577742][T28848] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 [ 788.577751][T28848] R13: 00005640fc923190 R14: 0000000000000008 R15: 00005640fc932f10 [ 788.577767][T28848] [ 788.874651][T29217] bond8: (slave bond9): making interface the new active one [ 788.882760][T29217] bond8: (slave bond9): Enslaving as an active interface with an up link [ 788.950665][ T7013] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 788.970618][ T7013] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 789.014871][T29210] 8021q: adding VLAN 0 to HW filter on device bond8 [ 790.563135][ T7022] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.571346][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.483820][ T56] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.492018][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.123649][ T7004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.131839][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.693642][ T7013] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.323456][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.331649][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.722351][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog