last executing test programs: 2.494035106s ago: executing program 2 (id=6510): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000000)=0x28, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x2404ad05, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @mcast2, 0x7}, 0x1c) (async) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) getsockname$l2tp(r1, 0x0, &(0x7f0000000100)) r2 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000001ec0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)="b3ab706204ee39c9dae21a17170a351ebc92d2f4d482a863ae5c0b4d768ffe7405f2c53a083d9b761b", 0x29}], 0x1}}], 0x1, 0x0) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000180)=0x200005, 0x4) (async) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xa}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x5, [0x0, 0xfd, 0x0, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5, 0x8], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffd, 0xfffc, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff]}}]}}]}, 0x8c}}, 0x0) (async) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="2400000018000900000000000000000002000000ff0000010000000008000500ac1414"], 0x24}}, 0x0) mkdirat$cgroup(r3, &(0x7f00000000c0)='syz1\x00', 0x1ff) mkdirat$cgroup(r3, &(0x7f0000000100)='syz0\x00', 0x1ff) 2.372533373s ago: executing program 2 (id=6514): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1400000017000b63d25a80648c2594f917a3c92b", 0x14}], 0x1}, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000001c0)={r1, 0x1, 0x6, @local}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x2, @local}, 0x10) 2.214972216s ago: executing program 2 (id=6516): socket$netlink(0x10, 0x3, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) (async) syz_init_net_socket$llc(0x1a, 0x802, 0x0) (async) r0 = syz_init_net_socket$llc(0x1a, 0x802, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) (async) socket$inet_sctp(0x2, 0x5, 0x84) socket$can_bcm(0x1d, 0x2, 0x2) (async) r2 = socket$packet(0x11, 0x7, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) (async) r4 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r4, 0x110, 0x4, &(0x7f0000000380)=0x1, 0x4) ioctl$EXT4_IOC_GROUP_EXTEND(r4, 0x40086607, &(0x7f0000000180)=0x3) (async) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r2, &(0x7f00000000c0)={0x11, 0x18, r5, 0x1, 0x81}, 0x14) (async) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) (async) r6 = socket$netlink(0x10, 0x3, 0x8) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) (async) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r0, @ANYRES32=r9, @ANYBLOB="000052000600050001000000080008"], 0x2c}}, 0x4000000) (async) sendmsg$ETHTOOL_MSG_DEBUG_GET(r6, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000540)={0x158, r7, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x24008084}, 0x4048800) (async) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000000000005000000000000000108000f"], 0x74}}, 0x0) 2.03790199s ago: executing program 2 (id=6521): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x17, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20044084) r1 = socket$caif_stream(0x25, 0x1, 0x0) accept4(r1, 0x0, 0x0, 0x0) 1.875153671s ago: executing program 2 (id=6526): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000340)="bdb85bee1ad6c7eb20468aa2ddf4bd342e9ef3b72025bb6a00f525a010a7c0715f00c0a5334a7505d2dafe715dcc2a1b1c8e9ca897f5076a5b60ccc1e5a8998623bb46fb2b3c1736bee991fb6bf90b153d939a4a37eff62dcfa73add5e2d7d535129f67d8ab6df2fdf1feba7a9883c9d27dd831a2c8989a226112c9996e73d38e55047c1a195a4b4ba3b166a3f0419a93b421f68380d094af9da92a3c17d3bfec8d8abe02a0e9db9e95d85eae62a16d848b883644fae2819900a38f69060", 0xbe}, {0x0}, {&(0x7f0000000400)="69b7930daf69b91a6e664ba294a4cff4238f3acb0c55d537ce9cbb72ae8e59b45239be8b3c69bc8a848d2067baf87e101e01537c8e4c5a115ed8f8d002748938943573cb6344e236fa514053683155c66eed8dde637d7753d96999bbb6a9e2e5ad9fbb428ff0a41af3ab415724ae6e046a7c763a9d6b013172a214f66e5b0157da6507c00d54317b0b6e05b5fd39226f38c9248bf87e42855a4a5b3deb1cca7637df32e677ab74cfae0ec87565db24f005352b263577d2e70ddc7f64034d08be063019104c4bc37d1d94af5d4595c1fc37a5d4bb3717d979832532e276adec5801ec4f0cffc6f71448f140388b685cdce9cda8ab534c5b89c8023474dcf89d225253271f2a57bd15f6112e8118ab38a0fd5388d6a073fde066ce4d51f30776c170d83e4744b3fd089d075a9ae284712363c97b1d91", 0x135}, {&(0x7f00000005c0)}], 0x4, 0x7, 0x6) write$cgroup_int(r0, &(0x7f0000000200), 0xffffffc1) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'syztnl0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x10, 0x100, 0x3, 0x7, {{0x5, 0x4, 0x1, 0x27, 0x14, 0x64, 0x0, 0x4, 0x4, 0x0, @remote, @multicast1}}}}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f00000001c0)={0xfffffffffffffffd, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x38, r2, 0xa0d, 0x0, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x5}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048880}, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x70bd25, 0x25dfdbfe, {0x7, r7}, [@MDBA_SET_ENTRY={0x20, 0x1, {r7, 0x1, 0x0, 0x3, {@in6_addr=@mcast2}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4044010}, 0x4040880) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x100000c, 0x22051, r0, 0x0) 1.796875979s ago: executing program 0 (id=6527): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000061109a000000000020000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x0, 0x600}, 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) 1.688057262s ago: executing program 4 (id=6528): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d10002"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) writev(r0, &(0x7f0000000180), 0x100000000000003c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="149300000009010100"/20], 0x14}}, 0x88000) 1.532106754s ago: executing program 0 (id=6529): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) (async, rerun: 32) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x28, r3, 0x1, 0x0, 0xffffffff, {{0x11}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0xec0}, 0x0) (async, rerun: 64) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000001a40), 0xffffffffffffffff) (rerun: 64) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001a80)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010025bd7000fddbdf250300000008000100000000000c0003001001000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0xc000) (async) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r5, 0x0) (async) r6 = accept(r5, 0x0, 0x0) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="120000000400000004000000a4"], 0x48) shutdown(r6, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r7, &(0x7f0000000300)="36b08d2b0eee85df8c51b94337939c59b3f1861f17be550d8959dec8cd36ab4630b76204bf000000", &(0x7f00000002c0)=@tcp6=r6}, 0x20) recvmmsg(r6, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x10042, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async, rerun: 64) r9 = accept4(r8, 0x0, 0x0, 0x0) (rerun: 64) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r9) sendmsg$can_bcm(r9, 0x0, 0x4008000) (async) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, r4, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@NBD_ATTR_SOCKETS={0x19, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6a9}, @NBD_ATTR_SIZE_BYTES={0x0, 0x2, 0x66}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x48081}, 0x20000010) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x38}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) 1.472609845s ago: executing program 2 (id=6530): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000780)={@in6={{0xa, 0x4e22, 0x96, @dev={0xfe, 0x80, '\x00', 0xd}, 0x5}}, 0x0, 0x0, 0x20, 0x0, "9c0fe2154aa786d10084ecfbe8e86f7d312fcc8fde38d5823d22fbbb55a7837e5f2329f4d662f2185f18fabca309d661d1fd1cf2e06eef2e4733c2c29a3c3d16ef45c7c1c8ecfcc76b47d9ab9a573f11"}, 0xd8) listen(r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_newrule={0x2c, 0x20, 0x2d2c6d60ea1da725, 0x70bd26, 0x25dfdbfb, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000680)={@in6={{0xa, 0x4e21, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x81}}, 0x0, 0x0, 0x40, 0x0, "2b20a1a47cddc63b223be606d7303a4d4d11e10450d766feb63b382d54bab577021cad5de4fe7630a33b6deca160b1267ff02123bc27830000000000ffff40000000000000b5b29049cb65f00300"}, 0xd8) r3 = socket$netlink(0x10, 0x3, 0x8000000004) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={@fallback=r3, 0xffffffffffffffff, 0x36, 0x0, 0x0, @void, @value=r4}, 0x20) writev(r3, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) 1.467529661s ago: executing program 4 (id=6531): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r0, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000001880)={0x84, r1, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe, 0x8e}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}]}, 0x84}}, 0x40040) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syzkaller1\x00', 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000031011ff00000000000100070000000000000000ff0200000000000000000000000000014f194e20"], 0xfdef) 1.302069076s ago: executing program 0 (id=6532): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b702000008000000bfa300000000000007030000ffffffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000001404000001007d60b7030000000000006a0a00fe40000900850000001f000000b70000000000000095000000000000006623848adf1dc9a764ab51a064caff0c9b27a26293fddf0180000071ff31f1622271d5518193e09483c5a020c334f8c76334d8ce8303b81ddaa52e8756ad60a07d6f27c125e16d024098f755d8583da60f27c162dbba0700002ac9170f50f2568836077b7f711a18ebf608d87b885297b6b6981978d51514b00dcc4a2748b376358c33c9753beab62bdf27dc04e4cb4bc598affd989b1ca58949a54d5827df14feecea46408a05d572077f1252fbb72c3d099c501bc4ded6fca17a3447222c95edb47b770009524edd5fa5c53e9c37251709f1ff7f0000f07bf7f53ce129a9ecd3b4dd15100f2b450f98526a0d8cac7c97fc2f64015306a1bd88345710fb6379b4c53cf55eefb4c0974486a8d25a363adbd83b49e13fbd1757b27020bd9b8cff3f48c9411670c34f23ab8caf7851b290feb3045a1b622f20c4383a0280f040de7667f8b1d0842835e81c35af41e5b5b924275cb1749289b44e9728e7a73f148ac8206afe120c1437490d9900000011000003971b32fdffffffffffffffaf580278e1342aabd1b623f6c4f128858e4eb6b42f2173184c2b99b645f6ec0e14e5d7c95a0008000000f30f6c0000000000ff0000b8f5001a1d2a34dc0973ec302bc23211d3e3b6e6dad65a51e5497a3419cecec38126247b27113ad4c7915c8f82c333a7b350802f0311807010d1ed50c18411aa6900daccc02f4ba4b078f07e41f781eee222c7d071d5a94d82ca9a0846c1af59cee16639b4970f8f0a82c6a712fd5722d677d406160ffaffffffb4e0bde6749aa52c408b74251914c5d3255fd88a42e7ebb69ebcd8eee623e51dbb1f1b548c91a6825c0686fdc16be1cbb72c217fda18bd746253ca66093daf35923300b600000000ac376e0a4649a8a84e1d293a6b109c5e59b366bca5cc3d936c53d4a48c05099e6fc37e5aa23bff8cce0600000000000300a568a8532623d12b40b50ac26f2e8255470a04bfbe7acb581b90991d965a01d1f84cb6b973558e1e3f8118c77ccf0b3c6eb6443870004da10c75723b65f83769ad1f0e4ef6b9ef1cec23264fd8fdac6264af1cb467020bdc12b797b6c156c439105829d2ae1c45f7cfa40df68f536a03353a55a8a8e176e5d48887d31c8e0f77f2c1e68ec7c01bd5a2028a8fc107007f5f4c67600a6ade3deb1f200abe1f753754678dae8b4e3ba3d086d4b95dfc5817e3dafae2d38b522f942cc750399d9029f071fdb1e05882f8a4b8fbd219ccac3a895828b4f22b6527ce31ceb02b7b2b4492510134552f0b076b168394f8417f25cc82ae04007193cbe69de8bf35e4bebd15412426b2020ab1f05fc44ae9ae094c1b81d3ef947692b44d2afb09c7498dedf0f87c38bbcab7357836f03e8a7c392e535694a3ead2de11e6b1781e2a017ac341fda2e563ee95085742f5fee9f95f4741b226e428d20b00bc140000e4b2f5efd0a0b1ceba000830ba8634b5aa26bdbe91614e92fae3c7349531df9bf4c01ebf5d8eb7d53e5f30647661623fbdb3f6c3652c423ce6ecc1be5d4e8133fc32f68ea86a2df1e7df98a0ae216c405d0ae9eed114ff2d6fe27dfdff1cf9194849c4cc0da9533e5983863e526a7dc0d8728f3b573ca4427bdb44df9341e9b8420e896598a156c935c800436a312e7ae3c011e46851ac599f0427729ab9c55ae0ab4c0000000000000000000000000000c87bcc2ac5aed9467b51d92e0993af4beaf1f3d47dcdfab9165f98155d93e383d6b85158b54675c1585037508c1e9461a1c3d1a6e2402045cae150a7016f716eebbdf6afc4414d900be0bdf19f4a273f44f4357380b4387f1c8b104f0e406b2f04e5ed88631be6411f9927fe9f83412b7c5a676ceec8b454ebf6481c98e86b6933a02daea0b4ec0be5b3d916bd70208b4588626c27c318475802e2c62681bd1a331422a6e47bbd40857d52c4894944fae5c5000000000000000000000000e0c47613e950b6aefeae054fc723f62ac7d13941de11b018f1f48ac50335df91c771729f81929128135b2803562c1171ee00a3f4a31281aa363e087d53d86dd85e3ff979a7e72d16fdd7e1a0f07a1c8e6085d280d760f74975ceb3a5be6cfb4da8e0aeb769b8b75f4aad803ed77d34872eed2711aa40a3b38099dc2752e8ec9b520faf39e416752aa0830206736570f5d41a4df848c9052551cf8dcb1be000000000eb2577188e8e96bd825d462350905d3eb916b397d2a46a64081e85661d7a5a2716cc87cb1976d15d9b6418e94f165911803e43830432226c660f4da67bb7c8ceb3755c07197d8b80b8d16b12c2ec63bebe107aa2350a7ae564bf69a6c52a2da1496016dd66a1c1b112"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000880), 0xfffffffffffffddd}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x27, 0x0, &(0x7f0000000140)="3d6ee2e04b91ab10143d9abe86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x4, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="850000008a0000006a0a00ff000000003500000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="100000000000002505000020000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0xa, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)={0x114, 0x27, 0x1, 0x0, 0x0, "", [@nested={0x101, 0x35, 0x0, 0x1, [@generic="1c656e78d5e39beda6b6b59e88fd3b8cc30c584bd6a4f8c482adf628a73140ab4c3c1c9b09978cdb3f4dc35b04eb34cb88c37dcd1bb18230d16da9a9bb724d57844e7d24fc78b6d59f2cc26a71ab5229ccd11879b03781fd88a82ea273c1376b767ab5c44b81b166fba28e38aa7dd465418efbf784db1969a13134389bf850e963c0e257091a6a157fecd7dc6e88d5b957a5738be1f78623c35d6b11f10e474bcb4560225c346219fe093da71425fb2f2cf0fc049906056379d1d50ce4b92ba89892eb353684643ea3ea549753effd4861da1c2137dba9df1ca692ce0599ec59b6e7435dca9b8fa089206136aa63be49c9656f88163462f8d033ed929e"]}]}, 0x114}], 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="d40000001b000301000000000000000000000000000000000000000000000000e000000100"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0010008a"], 0xd4}}, 0x20004010) 1.265950411s ago: executing program 3 (id=6533): r0 = socket$l2tp(0x2, 0x2, 0x73) socket(0x2d, 0x2, 0x0) (async) r1 = socket(0x2d, 0x2, 0x0) bind$xdp(r1, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) connect$qrtr(r1, &(0x7f0000000300)={0x2d, 0x1, 0x4001}, 0xc) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000b80)={0x0}, 0x1, 0x0, 0x0, 0x8051}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711221000000000095", @ANYRESHEX, @ANYRES64], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711221000000000095", @ANYRESHEX, @ANYRES64], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000400)={'batadv_slave_0\x00', 0x0}) syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, r4, 0x1, 0x70bd27, 0x25dfd3fb, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendto$packet(r1, &(0x7f0000000c00)="468fcbfdf9ae500da95d5d65c2c8643dd61d49c9617385d92b5d2f654f34003f862710b558ce4164659cc5d162257e13987bc003a51fea516b800e60eae9bac8455f4b276b22014ebd0e680316d207fd9981c9393aa3f0aed1d359f8eccceff3bd56ef210c8c1b12dd72cea1ca8dc3669a7c4bd74ea9ad5a6d295de6283631eabe8795b9c1269f9e95d670502c67a24c0bd4c751d3f9430f76aaa4416cc00149312c597b03be7b6d893805f06dcfc8d33aa19f97a9b705fdd261de759c4ecf036221926255baf737a33717190aaac70bc1116c464c34eaa9ad630e1301d779c2f71dfea3eb7da39e8e587a72bdc763e3fe57a318ca608b7debe22faf1e0426000148adc738786fc6d32866c0072d00a4bbae422e0095eace486fbcb8f4bf9f5e4e0e7f67311e4a10c17eba939a68df79287e32234b55ef97c40c325b881103e86eea4f8b9d4838188b91349315dc7d9c3c9e33519eac9580eea762ab1b4869e2fbf13b7bbb4f0e62e30629eb6b86d10a3b22ba94330a1090bd944e3f8231e0a661cd93c70e850ea89f3d3b71bc5249eef5fc26e8139c24907a824db886c4e5fffd2a07126d09d1598e444c72e10f3950d527c36227455bd9b4141c09265420a9c5f690c147947623f0e0ecf2161478bfc417e93ee26fb3b05131f4a968459c04771f2879b0126524a99003a2be56259060a5b4455a233ccc17eb26c634ba33f7a8428d1e5dc684309405808015091abeec436fe280c694c15aa2fed27ba413b2c61701e38e1a975c1723281d5b81035b3291c3c3e321d0c215884af8c1612af73cd3281f55afa4e5c51e4df63de7731139729f0b399151cb40da801bccb441c32b079b2cffefba3fdd4c0c2473808540ff44ba9cef412839bf126b781f6cc657314cd71362756e752c8365b1640044792122d038e6f9d67a29ad9d255a761a8e4d4024910a14eae29ee385648a8ec17f80c76342b55db7a22ce83d383ed103f7a7c548cfef4258394b83b5e797eababb2510cede6af5efe44c4dc7142847ff374759d1ab65820d4986c18221100b91a7d83e71fc73f322dbcf4dd26f62bf9f56bcb921b703d691c5041cdb9395fd8d6e9948da36d563c35791737a1dcfe50d7ddf7fa5c59d78fe37f972bb087d43afd5c4325d4e1879c445bf253729f5d543fa793035af4187bf5e1a90fb07c02445294fdfebf380e12c8fc8f5cd6bfb63e77459e739d783a95725f4a79b8748cd58fc726e359cc1e9bd03ae9a0401e412ded34f7eacecbb3a52eab87aa606e1ffe5eed664702268520c32825fdeeec368e8b36471ae6e811e12620c5d41b202d813562c8091c23ea095d989018ea1acf370bc71bc421f91c4c09ba956d3a8bf0fdb3f1962597bd9ffd315ce9ac2381878901c88b9d8dc64799e8e2187be83667135f4346d41e447891288cbd47909e5f60b8fd1e051df05444db0201cbfb37f9c0f757d7f1c48fd5fb046da212601e7b6a75364290921cb4c87b3387e65903248a4d294c9be883450284f69ed1b244e194727f5edac0d617d9e6dd6c2c7f5801a65a4a02e7690d37d54d64a405630c2f31cee6bdcfe49b90512c0944976e3751522d4b7c9c9ba9e176bb2c7f279172b5c801e137451c4b75946d427d6b86082e76e11651342900e8cfc6772037267680bf721c2ff84c6d10c37d251d0551bd5367a2225037de7ffd3ea523d8c780d67439c3e5ec8ad91b1f8df72259626012132346f012b593260bafe80ae14cef21586670d8bf175bcf04875ff98344b27385df1b23e59f1bed63bf3c73cbead19fa8100833458ff4cf8326cb16b51380498a7768b573522063dbde779985d54fe848294b73ac64f0b8b5598fcc99008beeca271cd6333087316ba30d300ff928dd8317fec2b6674230b429aae11ec0e2c30dfc0206567e91f0183586dbba83229b41f71215ec1e57966644358f325d4ec2d5061b5364612d4ad7c5ca4330f6645c8839201535d8f67329d4f642483fbf65bdb31445171c2693d7b9f05f95e00ad35c6e2e7429bc28317cdea16f86e0a328cae344601adf204a7fe9c00c71f3b517fbdaad3095fda009157f8def9d913c1dbc03f0eac94656f7b6ffc8d0d2a970a14000683eead18156cb2a4b6fa551baff2fb743d72fb14dd0efd7bf85e77220e9021105624ecc873dde89dff257d71aff10dd72d03c61b3dec8e0cf5b3faf2e5f80864e7489954b3cafd5991cf6c06140e60c1ae199442290b5e6b66968cc820367cbefa863b106cedb448525abf83f9ff0d25b4596d4abbac1eca65828af6f4233b6f9200b646ef644f34798a7b5cb2c6c495efa17b09e2d816ab1e7a1a27bba2d4a3c6de3f68de203430952298a0998d6d5527ca11e5c4b75aecb95240a84910a3022631fe7f24e7dbe975c8c05380c89a6b8216b82b96016ba435574f9ecd26a99ca02300f7ab0ab9be314a3e02b066a191629dd3197818fc09c0d173f13f1d5bde5382fe581cc8c1432364c58a1af282116b96303e26a1681a17b96cbd83bbe91d373cf6c1e6ea46d0cdc8b493f7440a433559a1d4c746c83ada8b9e8bd8f38d4b35f5b158cd36cc01318bd9fc13182c776513a1ccb46ec97d08a69e5f1b9a756d4d9f8e513372815d049ae2b3017d282efc5477fae6a7e17c851108d87d7a00905a0c59ba43ee19d036b6bb8e8e9b99c7c6c723bd84ad4cc9cdd6df79e1345b7bd0b6f0869538711374ae82d8135d14a106fae6b37e9851073195b42678ca0d59818d3f34f1065108fea5616cd829d0c3688d1b1e81a74049a41efaea08a03abcca43fb3191fb44c4985a2b3ccb1d885ed2e636d4a428665df140b183cb34f9a3e5bf2c3a4b1567612e44cc694c1b4fa030c44568959868c73d816572bfe1d46a530659b355f48c7f1385c49f4932ef301ee42ffa69e4874698ec040512b5efde4c9534a1661e3fa634b39f606798329cf8ca5a20d33d325a0e5b23e310141eaf66132cb73867127f785dc14e51160fb2df48b46c5f31ed7abc7bbdf044228e7e52e91cebd8ce44e0a20282b7ca8a522d94202896a7d1fa0e8331a9a18796008010601cd6888106dd9939dcf38741f6099564f81a92f3a3d8a90177a20f8f1c0f27420a52a033e1a362f018ae2686efc1b3eed8fbe10fd1b78b889c558f149963c41fd40b82d0dcb9d31f7aacb1cd35295d454dde0aa8a6623eb381e7dea0c04f3d124e14f5d958fc7f8ae04a113889206ef7a5f0f2a50221b36eec1679ef1e76d12e44694f7181dd8ffed5e53b5a4d57800b32efb4c199c1d6622391c5f2ce90531edcdb0523a2b891d6efb56bb447517b1faeacba62280078a7a4df7dc277861ff62277e9958156bed4e63ed593258a4596515358a1812a39e41a450a3b3346efd60a9a57a501ba43700eb5354e65c4d8f4bee332a0091f6c408e5aab58d688234578f6cd73d22c9a5c2dbdbab30e6694b12cd14451ff0f833798f88efcaf44a923b62b8c1351a7738bb4782038be19639f3cf0fa81b066b46ac9952826164ace0ca91ce9fadf086e47172af129db5f2be7dc58b8cf99a98fb2995ce10c4906df4ecce2177bbb1a11c18c9545f341c74924c5cdac46e0899134b159141e920aaead2b96f744ae00c614dac43f4ab38704ed4cc5118fba26fb89e9de867516179b7c3dc3eaf986321b019eefaf4e51a17689f381036b8094f84259bae965572d11a75af9c222c356444411f1fbcd63a84b645fb80f515cbed72447a51faafe79919e49a747e42094affe846477f96b522b1ed1737edeec9aa74775216a252cb2590c95240272473ed20ca0f5f3def4ce527e664c33ffcde188be3f3ed1d8627479c069653857d1776c4586ea0e9daf8f8d5d90155d7a8d0d23307cf99bafb711027f8b15bf3e625369372294207b54ab6af7a350eee409623917e99ec1f1a9ebc047be65dabfad32e26ca6209dd816de6bd8695ed6ba54651b89649b2461026909537766018dea437aa9e2d7df04e046f986a80da5c9fb3a89626a6ad9d9ae78a6d9f9cf95ee488e4676369aabbb9f745de95b476c905cc4e59de97d8f6f9d8eb3c59de85a5c68001fd98c6bf37386c624b6984c9fc54377c4305a8be1194435d78fceae29912febbcad0982ff6c027f84c38efe68e1a5f7f7d3904a56458abe7108f9d69721967d7096fce1d6b276a7d207b950862b72bfe577ec1eb86b6413c475f550e2b4558cb56efc15d1f663a80bcb13c106ba810b5c868a902542e49f6597f7e7bb5f34d07d32e5b24700738f05c162bdb6c85dcf94f792cdecf60377f1e3ed70c4c011a4bf66d4a351cf573e9ded1803b6dace316a7b64341d4d1dbf022104f5722762c7f1d00184d4e37a6508464471e8b2f39fae443f0bfef64eaf52a2a3920885d26981a18d5c93b439d95f8331b29f2f97d840dfd218a7f4c27ec229cb72c328ab6d8571322e70d137e7b37892492e3be6f935d032a18a867d3473504c90904dc60a8c9ff59ad594a048222454e03ee4b82b75a68b8ff716849dfcc18779f8ef13c0f995c33f98a8e600486489fd4217b68fc0ca51e6462ddf874f2c017b724a81b704f769e7ec1b13af78232d05a23f722db1fc141cc0d06ff44754735ba5274f3109e1ea018a90940fbe360b76c5a7f9db18f3534fd774b3cc9b9be5652ffd0730db34ed85abe0c456f65830207092a29962fea4a57cb444d1fe0652515b88523b76f06572d2cdddaa1c9236616f003485f76dc99d338bf47de4935b04af4a055dd6d1d85f8652a1b9a6f6f3917611e80b806b3f4e4d3da0f9211ee80c724c627a44e6ff70f1bdd22d572b87a22d188dc7f7e90d578f733a403b2adf94d7197e60a218a812a56bcc76bb1c5df25a8b874f6df60ace73840c47211bf3eace8772fea2ac40374b978ae1865709f40a54b3f95ee21352ae36379ac6e64ce459aa18d5684d354459cdf3033ee878a041b5c146e85f824a003050ea3e47d25797d12a2fdbba7f1489c24ff4b7d653dc3d4b1e4605992b4146144f0517b80da2975c256a7215d529014e1c85d355eb6c90a2bdeca8c753a6f110f489cbeca813d4c51e58085f14769cdf5d4f9d12c7590bdd93aec100818ab5b66c43421479f1c0a4d1b2b8dc20119da71bf93e475111cd0d1a9955699ec4558ac9939d9367b75288b6a772540e911ea57b3de63a229fe6417dccf5a91b1dbe0e7cd54e5b21fac990df7f98f86ee13a0ad943877f9bc746cab92da4e123a608f41a1f195eae65782cf509f1fa529d83ac5d6cca53cd931a665fb3dd74c4e82b0e164d0a52cacd1cb5c2396a90108423e51dea13592f7b1f40a34ea59beec0cbd70167538b7908ee07bf4ee6def958dfa178730e9328103b4ffda0d5664a772a0d5f4cb63f4f4bcb500c17dcc8d8c4e92d15986aa1b54fba4debe534c3fb1b57e0d66cb1d4d05db61259c2e311ae3fc104bf6dadf8f24a5246f3cf541d7bd4470cd3a4a4106d6d805a0f9d8fac010b1a49c62a794e8a3f99ba80e9a60b2cf8855173b79423ad800fd43df5ce42ee4aa519e0c0ebceb3d749f42118a617fa8a4662777a44398b7d28387cf3bd5a1bedea9bb8996785bd90fafe16d6ed6295a26d2e88bed6e3844b124c288ffe7c41aaf8aaaec1160cef2577603775743149a0da23a67f8bb36040df7ce0a49adde5b5a5fe3b6d7892f4f7e5aa7db92377e7a0f75d265915f2ed07959ea146664ead942b974dbc83b17ed39476572c45f0ad6ddcece89a8f027df797ae4d9f4c169d960eb5efe6a3c03359a07f496af9f01a87fa21c7db7e", 0x1000, 0x2000c000, &(0x7f0000000440)={0x11, 0x15, r3, 0x1, 0x0, 0x6, @local}, 0x14) sendmsg$NFT_MSG_GETSET(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x3c, 0xa, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x18}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10b}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x182}]}, 0x3c}, 0x1, 0x0, 0x0, 0x801}, 0x1) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000004c0), 0xffffffffffffffff) (async) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r6, &(0x7f0000000640)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2000401}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, r7, 0x10, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x9}, 0x884) (async) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r6, &(0x7f0000000640)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2000401}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, r7, 0x10, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x9}, 0x884) r10 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x74, r10, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_MS_ADDR6={0x14, 0xc, @rand_addr=' \x01\x00'}, @GTPA_MS_ADDR6={0x14, 0xc, @private2={0xfc, 0x2, '\x00', 0x1}}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010100}, @GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_FLOW={0x6}, @GTPA_FAMILY={0x5, 0xd, 0xa}, @GTPA_VERSION={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x74}}, 0x0) (async) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x74, r10, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_MS_ADDR6={0x14, 0xc, @rand_addr=' \x01\x00'}, @GTPA_MS_ADDR6={0x14, 0xc, @private2={0xfc, 0x2, '\x00', 0x1}}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010100}, @GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_FLOW={0x6}, @GTPA_FAMILY={0x5, 0xd, 0xa}, @GTPA_VERSION={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x74}}, 0x0) 1.199361168s ago: executing program 0 (id=6534): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="640000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000000000008001240000000000500050002000000050004000000000016000300686173683a6e65742c706f72742c6e6574"], 0x64}}, 0xa00000000000000) 1.134812675s ago: executing program 3 (id=6536): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800004000000000000000000000000000000800"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback=0x32}, 0x94) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000001200)={0x2, 0x7e, "435afb7a10273937035f7a18913ca3a9ab2c6cafc0eb1ddb7eee12cd3743ca41b0f4dabedf3e0601f82ab013eeda10a21ba736e501f8fdd75958464fc18dcfa4716a7cfb3ad25825b717a2fbf6c588d930308689851a93ddeb3381ff897918b27284ba75c0d1b001eaa0205a46c07e7ff890a38ee688a796e1265f43c57a"}) (async) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) (async, rerun: 32) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x6000, 0x0) (rerun: 32) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)=0x3) (async) ioctl$PPPIOCDISCONN(r1, 0x7439) (async) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)) (async) pwritev(r1, &(0x7f0000000540)=[{&(0x7f0000000300)='\x00!G', 0x3}], 0x1, 0x7fffffff, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001540)=@deltaction={0xd0, 0x31, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TCA_ACT_TAB={0x60, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x14, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x4}, @TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x3c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x41}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1000}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x14, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x44045}, 0x10) (async, rerun: 64) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="5000000010000104"], 0x50}}, 0x4000084) (async) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x9, 0xf}, &(0x7f0000001440)=0x8) (async, rerun: 64) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) (async, rerun: 64) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), 0xffffffffffffffff) (async) socket$kcm(0x10, 0x2, 0x10) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x71, 0xffffffffffffffff, 0x46e4c000) (async) r2 = socket$netlink(0x10, 0x3, 0x8000000004) unshare(0x6020400) (async, rerun: 64) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async, rerun: 64) unshare(0x2020000) (async, rerun: 32) close(0x3) (async, rerun: 32) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000008fcff", 0x58}], 0x1) (async) r3 = accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000001300), &(0x7f0000001340)=0x10, 0x80000) getsockopt$PNPIPE_IFINDEX(r3, 0x113, 0x2, &(0x7f0000001380), &(0x7f00000013c0)=0x4) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000440)=@ethtool_perm_addr={0x20, 0x6, "fbb020b1c236"}}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 32) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (rerun: 32) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) (async) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'wlan0\x00', 0x0}) 1.064340622s ago: executing program 0 (id=6537): r0 = socket(0x11, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r1, 0x400448e7, &(0x7f0000000400)="4996") r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f00003ec000/0x2000)=nil, 0x2000, 0x0, 0x8031, 0xffffffffffffffff, 0x215eb000) r3 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}}, 0x8040) r4 = socket$inet6(0x10, 0x4, 0x0) write(r4, &(0x7f0000000040)="2400000021002551241c0165ff00fc020200000000100f000ee1000c08000b0000000000", 0x24) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r5, 0x1, 0x1f, 0x0, &(0x7f0000001040)=0xa00) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) write(r2, &(0x7f0000008c80)="18f48333609cfa7c23c6c43d193dbd94f1ef002b74969288e4dcb653cb1773fa64f1b9036896a72454fa45ccb00601c2de645767107f1d010ef8430f24eda9b6231ae6de4f32d21ade1031523f45492bc162a869523be208dc0f3d1947f0bfed25089bcce780e8772ee4b79253149e043f4f3bb4baa720fca653c1500aba85b8dcd2ae894163f500342cd1c10b386ce8b8826c40c7ce74", 0x97) recvmmsg(r6, &(0x7f0000008b00)=[{{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000001780)=""/159, 0x9f}, {&(0x7f0000001900)=""/221, 0xdd}, {&(0x7f0000001840)}, {&(0x7f0000001880)=""/43, 0x2b}, {&(0x7f0000001a00)=""/148, 0x94}, {&(0x7f0000001ac0)=""/184, 0xb8}], 0x6}, 0x4}, {{&(0x7f0000001c00)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private0}}, 0x80, &(0x7f0000006140)=[{&(0x7f0000001c80)=""/173, 0xad}, {&(0x7f0000001d40)=""/179, 0xb3}, {&(0x7f0000004e00)=""/213, 0xd5}, {&(0x7f0000004f00)=""/242, 0xf2}, {&(0x7f0000005000)=""/4096, 0x1000}, {&(0x7f0000006000)=""/200, 0xc8}, {&(0x7f0000006100)=""/37, 0x25}], 0x7, &(0x7f00000061c0)=""/4096, 0x1000}, 0x7f}, {{&(0x7f00000071c0)=@ethernet={0x0, @local}, 0x80, &(0x7f0000008540)=[{&(0x7f0000007240)=""/254, 0xfe}, {&(0x7f0000007340)=""/181, 0xb5}, {&(0x7f0000007400)=""/4096, 0x1000}, {&(0x7f0000008400)=""/37, 0x25}, {&(0x7f0000008440)=""/207, 0xcf}], 0x5, &(0x7f00000085c0)=""/85, 0x55}}, {{&(0x7f0000008640)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f00000087c0)=[{&(0x7f00000086c0)=""/218, 0xda}], 0x1, &(0x7f0000008800)=""/34, 0x22}, 0x78c}, {{&(0x7f0000008840)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000008900)=[{&(0x7f00000088c0)=""/31, 0x1f}], 0x1}}, {{&(0x7f0000008940)=@nfc_llcp, 0x80, &(0x7f0000008a80)=[{&(0x7f00000089c0)=""/164, 0xa4}], 0x1, &(0x7f0000008ac0)=""/30, 0x1e}, 0x1000}], 0x6, 0x2040, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="280000001e00010000000000fcdbdf2507000000", @ANYRES32, @ANYBLOB="000000000a000200aaaaaaaaaa0c00"], 0x28}, 0x1, 0x0, 0x0, 0x4880}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x1ffffffffffffd03, &(0x7f0000000000)=ANY=[@ANYRES32=r4], &(0x7f0000000100)='GPL\x00', 0x9, 0xff6, &(0x7f0000001e00)=""/4086, 0x41100}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@mcast2, @in6=@private1, 0x4e24, 0x0, 0x4e24, 0x6, 0xa, 0x20, 0x130, 0x33, 0x0, 0xee01}, {0x7, 0xfffffffffffffffc, 0x100, 0xfffffffffffffffa, 0x0, 0x7fff, 0xfc, 0x6}, {0x5, 0x6, 0x5, 0xb5}, 0x3, 0x0, 0x0, 0x1, 0x2, 0x3}, {{@in6=@mcast2, 0x4d2, 0x6c}, 0xa, @in=@broadcast, 0x3505, 0x4, 0x0, 0x9d, 0x2, 0x9, 0xc}}, 0xe8) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x1d}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x180, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x3}}}, 0xb8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b4000000000000006b113a00fdffffff8510000002000000850000000800000085200006020000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x200004, 0xc3, &(0x7f000000cf3d)=""/181, 0x0, 0x58, '\x00', r8, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffffd2}, 0x70) recvmmsg(r4, &(0x7f00000015c0)=[{{&(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000200)=""/7, 0x7}, {&(0x7f0000000300)=""/180, 0xb4}], 0x2, &(0x7f0000002e00)=""/4096, 0x1000}, 0x7}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)=""/247, 0xf7}, {&(0x7f0000000600)=""/234, 0xea}], 0x2, &(0x7f0000000740)=""/17, 0x11}, 0x7}, {{&(0x7f0000000780)=@vsock={0x28, 0x0, 0x0, @local}, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000800)=""/11, 0xb}, {&(0x7f0000000840)=""/42, 0x2a}, {&(0x7f0000000880)=""/58, 0x3a}, {&(0x7f00000008c0)=""/74, 0x4a}, {&(0x7f0000000940)=""/183, 0xb7}, {&(0x7f0000000a00)=""/181, 0xb5}, {&(0x7f0000000ac0)=""/169, 0xa9}, {&(0x7f0000000b80)=""/146, 0x92}], 0x8}}, {{&(0x7f0000000cc0)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000d40)=""/142, 0x8e}, {&(0x7f0000000e00)=""/57, 0x39}], 0x2, &(0x7f0000000e80)=""/136, 0x88}, 0x2}, {{&(0x7f0000000f40)=@nfc, 0x80, &(0x7f0000001000)=[{&(0x7f0000000fc0)=""/7, 0x7}, {&(0x7f0000003e00)=""/4096, 0x1000}, {&(0x7f0000001080)=""/148, 0x94}, {&(0x7f0000001140)=""/148, 0x94}], 0x4, &(0x7f0000001200)=""/197, 0xc5}, 0x1}, {{&(0x7f0000001300)=@ieee802154={0x24, @long}, 0x80, &(0x7f00000014c0)=[{&(0x7f0000001380)=""/80, 0x50}, {&(0x7f0000001400)=""/167, 0xa7}], 0x2, &(0x7f0000001500)=""/176, 0xb0}}], 0x6, 0x0, &(0x7f0000001740)={0x0, 0x989680}) 915.413337ms ago: executing program 4 (id=6538): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) socketpair(0x1f, 0xa, 0x8, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010426bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100628cf49b623380a993ad983dc76c43c56f6e64800000000c00028008001c0002000000"], 0x3c}}, 0x4008000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="480000002e00090025bd70000000000004000000320016"], 0x48}, 0x1, 0x0, 0x0, 0x42804}, 0x84) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), r1) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_pressure(r5, &(0x7f0000000440)='io.pressure\x00', 0x2, 0x0) sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x6c, r4, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'syz_tun\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8e540000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x47}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4ab}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9bd}]}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) (async) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f0000000140)={&(0x7f00000001c0)=""/114, 0x72, 0x1}) 820.940116ms ago: executing program 3 (id=6539): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000061109a000000000020000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x0, 0x700}, 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) 778.665305ms ago: executing program 1 (id=6540): r0 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0xffffffff, @empty, 0x5}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000680)) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000440)={'ip_vti0\x00', 0x0, 0x7800, 0x80, 0x10, 0x1, {{0x2a, 0x4, 0x1, 0x8, 0xa8, 0x65, 0x0, 0x4, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x41}, {[@noop, @end, @ra={0x94, 0x4}, @end, @cipso={0x86, 0x6e, 0x0, [{0x2, 0x5, "c187c1"}, {0x6, 0x7, "5b3c099cb5"}, {0x7, 0xe, "4098f951e34b896da0f3d87d"}, {0x2, 0x3, '<'}, {0x2, 0xd, "7b8c78e0baf8edf6f468a3"}, {0x2, 0xc, "dec4568b102a7dfca4d2"}, {0x6, 0x12, "d463b4e093921f3515a05e7d822767c5"}, {0x2, 0x8, "f9f14a5369c5"}, {0x2, 0x11, "784a3d4d0576bca03a12be74730149"}, {0x6, 0x7, "77fd3ab3fc"}]}, @timestamp={0x44, 0x1c, 0x61, 0x0, 0x1, [0x8, 0x2, 0x0, 0x0, 0xffffffff, 0x6d92]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0x16, &(0x7f0000000240)=ANY=[@ANYRES32=r2], &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x44, '\x00', r4, @fallback=0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r2], 0x100}, 0x1, 0x0, 0x0, 0x8001}, 0x24000000) socket$inet_smc(0x2b, 0x1, 0x0) r6 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x14, 0x601, 0x0, 0x0, {0x2b, 0xfa}}, 0x14}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000180)=ANY=[@ANYRES8=r1, @ANYRES16=r2, @ANYBLOB="0500000000000000ffff0200000008000300", @ANYRES32=r3, @ANYBLOB="080002002e"], 0x24}, 0x1, 0x6c00, 0x0, 0x4d080}, 0x0) 691.235602ms ago: executing program 4 (id=6541): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x0, 0x2, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000000, 0x0, 0x2, 0x2, 0x0, 0x2}, 0x20) r2 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000240)={0x0, {0x2, 0x4e24, @remote}, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x3d}}, {0x2, 0x4e21, @broadcast}, 0xd1, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffffffffffe, 0x9, 0x6}) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="3800000055002f03000000000000000007000000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) r5 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r7}, 0x90) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', r7}, 0x50) pwritev(r5, &(0x7f0000000600)=[{&(0x7f0000000340)="bdb85bee1ad6c7eb20468aa2ddf4bd342e9ef3b72025bb6a00f525a010a7c0715f00c0a5334a7505d2dafe715dcc2a1b1c8e9ca897f5076a5b60ccc1e5a8998623bb46fb2b3c1736bee991fb6bf90b153d939a4a37eff62dcfa73add5e2d7d535129f67d8ab6df2fdf1feba7a9883c9d27dd831a2c8989a226112c9996e73d38e55047c1a195a4b4ba3b166a3f0419a93b421f68380d094af9da92a3c17d3bfec8d8abe02a0e9db9e95d85eae62a16d848b883644fae2819900a38f69060", 0xbe}, {0x0}, {&(0x7f0000000540)="69b7930daf69b91a6e664ba294a4cff4238f3acb0c55d537ce9cbb72ae8e59b45239be8b3c69bc8a848d2067baf87e101e01537c8e4c5a115ed8f8d0027489389435", 0x42}, {&(0x7f00000005c0)}], 0x4, 0x7, 0x6) write$cgroup_int(r5, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x100000c, 0x22051, r5, 0x0) 588.363641ms ago: executing program 3 (id=6542): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0xd, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000000000006301040000000000950000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0xd, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000000000006301040000000000950000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x0, 0x0, 0x13}]}}, 0x0, 0x26}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x0, 0x0, 0x13}]}}, 0x0, 0x26}, 0x28) openat$cgroup_procs(r2, &(0x7f0000000080)='cgroup.threads\x00', 0x2, 0x0) sendmsg$NL80211_CMD_SET_REG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000004001b0000000c00228059fe00800400008006002100", @ANYBLOB="7989"], 0x28}, 0x1, 0x0, 0x0, 0x20000810}, 0x24000000) 569.487381ms ago: executing program 1 (id=6543): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x1}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$netlink(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000007c5e0000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffa}, 0x94) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000480)={'ip6_vti0\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x0, 0xfffffffe, 0x0, @mcast1, @mcast1, 0x0, 0x0, 0x0, 0x1006}}) socket$nl_route(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x48, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\r\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa08004800003400000000000690780a210104ac1414aa440c0a027f0000010000000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="0000000090780000"], 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001280)=@mangle={'mangle\x00', 0x2, 0x6, 0x750, 0x450, 0x450, 0x0, 0x290, 0x360, 0x680, 0x680, 0x680, 0x680, 0x680, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @local, @mcast2, @private2}}, @common=@inet=@multiport={{0x50}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev, [], [], 'veth1_macvtap\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {}, 0x300}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private1, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7b0) listen(r0, 0x7) 499.0085ms ago: executing program 4 (id=6544): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32=r2, @ANYBLOB="00000016010000001800120008000100736974000c0002000800030036"], 0x38}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000b40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004081}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r11, {0x7, 0xfff1}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x400dc}, 0x4020080) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r13, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="68000000100039042cbd7000eaffffff000003e4", @ANYRES32=r2, @ANYBLOB="83000400000000004800128008000100736974003c0002800500090029000000190010"], 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) 424.156191ms ago: executing program 0 (id=6545): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="310300000000000000000900000008000300", @ANYBLOB='\b'], 0x24}}, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000040)="3900000013001118680907071200000f0000ff3f21000000170a001700000000040014001000030001302564aa25b9a64411f6bbf44dc48f57", 0x39}], 0x1) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) unshare(0x2040400) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000000)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x2000400) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) pread64(r5, &(0x7f0000000480)=""/61, 0x3d, 0x7fffffffffffffff) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a206eb7a1bf8bfbdab7ecf22f0b5b12000000000a0108000000000000000001000000b1539e01671a0d0900010073797a300000000000000000010000000900020073797a30000000000000000009797a3000"/116], 0x74}}, 0x0) ioctl$FICLONERANGE(r3, 0x4020940d, &(0x7f0000000040)={{r3}, 0x8, 0xc01, 0x401}) unshare(0x30500) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="19e2c44273f2ef5a2900e5b33cc9fa646800000400000004000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000008000009000000000000000000000000000071c7446a9f7de69d000000000000f169e71110e4f4f2db35cb753c2cdf6b306fb4282e8536f19c6223c5a35aafb41eb07d20ea4f267d249e5a7d4f5bd1896e"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r6, &(0x7f0000000380)="3418", &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r6, 0x0, &(0x7f00000002c0)=""/26}, 0x20) readv(0xffffffffffffffff, 0x0, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @loopback, 0x52}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r7, 0x84, 0x0, &(0x7f0000000100)={r9, 0xfffffffd}, 0x10) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) setsockopt(r7, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) ioctl$PPPIOCSNPMODE(r3, 0x4008744b, &(0x7f00000000c0)) 390.093797ms ago: executing program 3 (id=6546): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001880)={0x18, 0x2f, 0x1, 0x70bd2b, 0x25dfdbff, "", [@typed={0x8, 0xe9, 0x0, 0x0, @uid}]}, 0x18}], 0x1, 0x0, 0x0, 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x1, 0x800, 0x5) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r1) (async) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x38, r2, 0x1, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x5, 0x4, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_team\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x5, 0x5, @multicast1}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) ioctl$sock_ax25_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) (async) ioctl$sock_ax25_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, r5) (async) syz_genetlink_get_family_id$nl802154(0x0, r5) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7", 0x3}], 0x1, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000100)=0x3, 0x12) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={0xc0, r6, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8}, @handle=@pci={{0x8}, {0x11}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_NODE_NAME={0x4f, 0xa8, @random="36d661befe063d729e2e4769941035f5a4b3bda5402d4f556bedbb7558470dd42eb94fa50281da0d76e5a26b393e06d164bb4a7082f5c80bcbd3414ff49fe90896f4bed7043f28de01b959"}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0xc0}, 0x1, 0x0, 0x0, 0x80}, 0x48000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001c40)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$cgroup_pid(r8, &(0x7f0000002380), 0x12) (async) write$cgroup_pid(r8, &(0x7f0000002380), 0x12) syz_init_net_socket$ax25(0x3, 0x5, 0x0) (async) r9 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl0\x00', &(0x7f0000000640)={'ip6gre0\x00', 0x0, 0x4, 0x1, 0x36, 0x9, 0x41, @mcast1, @private0, 0x8000, 0x8, 0xfffffffb, 0x7}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl0\x00', &(0x7f0000000640)={'ip6gre0\x00', 0x0, 0x4, 0x1, 0x36, 0x9, 0x41, @mcast1, @private0, 0x8000, 0x8, 0xfffffffb, 0x7}}) bind$ax25(r9, 0x0, 0x0) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000038c0), r7) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000bc0), r11) sendmsg$TIPC_NL_BEARER_DISABLE(r11, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000002070bdb57bbe4e2daab5d09e968731fdabaf2ee8d23f02f5e8a4c6bdfdf5f16fec113a79e9d549b8f8e5d86dc9b466d6dc97e74cdec62dd421a4bc59535933d511bb6296020000008f4ee0819688a22943895e643d32ae1254641537882201c9d698d1a26c6e52b73ed3e2c0ad9aedc1d200e40b99fc656941", @ANYRES16=r12, @ANYBLOB="010027bd7000fedbdf2502000000140001800d0001007564703a73797a3200000000"], 0x28}}, 0x44010) sendmsg$IEEE802154_LIST_IFACE(r5, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r10, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000800}, 0x4004800) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r4, 0x80, 0xbb}, [@NDA_LLADDR={0xa, 0x2, @dev}]}, 0x28}}, 0x1) 334.072345ms ago: executing program 1 (id=6547): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x1}, 0x38) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x60, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @mcast1}}, {0x14, 0x2, @in={0xa, 0x0, @empty}}}}]}]}, 0x60}}, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x4040) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x14, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d65b"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x68}, 0x1, 0x0, 0x0, 0x24000840}, 0x40) socket$key(0xf, 0x3, 0x2) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000100001000000000000f5ff000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 271.99004ms ago: executing program 3 (id=6548): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000140)={@broadcast, @random="17043a73dbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa010102, 0x10000}, {@private}, {@local}, {@remote}, {@private}, {@remote}, {@private}]}]}}}}}}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newtfilter={0x84, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0xfff3, 0xffe0}, {}, {0x8, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x58, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}, @TCA_BPF_POLICE={0x40, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0x10000000, 0x16, 0x5, 0x800, {0xf, 0x0, 0x9, 0x0, 0x0, 0x8}, {0x8, 0x0, 0x1, 0x3, 0x7, 0x2}, 0x100, 0x6, 0xbd4}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@ipmr_getroute={0x1c, 0x1a, 0x1, 0x70bd2a, 0x25dfdbfd, {0x80, 0x20, 0x14, 0xd8, 0xff, 0x0, 0xc8, 0xa, 0x2200}}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$sock_proto_private(r4, 0x89eb, &(0x7f0000000000)="59f9c78ad0c2decccb711efa867927d702eaab3c6d7fa180a9ee6c254fe79678aea33d822e6102ccf89d665336492f14d421c7ae8974edc7e217a86e9dc9daa4f1d614c189b11da5d7fc7724c20c1c4dd1f2b3774c252c3444fed7e3d966e872e279f2d281182d93f7ac5066c8bae19bbbe2918758c7282860c0c64a0915bbd6401a589188f304ee928618a00ee48c8cfb6231") r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x4}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8011) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_CSUM={0x5, 0x8, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}}, 0x4000000) r8 = socket$l2tp6(0xa, 0x2, 0x73) getpeername$l2tp6(r8, 0x0, 0x0) sendmsg$NL80211_CMD_DEL_PMK(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="20e6d75548d30225bd7000fddbdf257c0000", @ANYRES32=r6, @ANYBLOB="0c00990007000000350000000a00060008021100000000000a00060008021100000100000a0006000802110000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000080}, 0x44080) 227.488288ms ago: executing program 1 (id=6549): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}, 0x4}}, 0x10) bind$tipc(r1, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r2, &(0x7f0000001b40)={&(0x7f0000000200)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10, 0x0}, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x28, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'vlan0\x00'}}]}]}, 0x28}}, 0x0) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="20040000f403040025bd7000fddbdf250300000000000000000000000a000000ff0700000d000000ffffffffff0300000200000008000000000000000700000004cf0000fdffffff01f8ffff00800100fefffffff35aab1d5c1c00002800000004000000c10c000001000000000000000900000008000000070000003400000000000100090000000d000000070000000800000098f500000300000003000000ff07000006000000000800000800000001000000030000000600000000000100090000000f000000c74e0000010000004000000075060000ff00000000100000040000000008000009000000b50900000a000000c09fffff030000000000000009000000ff0300000800000000000100ff03000002000000ffffffffb70000000400000004000000040000000180000040000000070000000300000000020000358500001000000000100000601b0000ffffffff05664d330400000000020000faffffff0100000007000000ef000000d004000004000000100000000300000001000000ff7fffff010000009bc0000004000000080000000900000000000000ff7f000005000000080000000000000019000000030000000600000001040000b20d00000900000003000000010000007f0000000900000000080000ff7f000000020019f6ffffff37e60000d20800000700000005000000410000000f00000000080000c3bb0000040000006d00000006000000000100000080000001800000010000000d010000000000004b0a0000ec00000003000000ffffff7f000800003100000009000000240000000900000001000000feffffff020000008d320000ff00000007000000080000000000000008000000c0000000090000000800000063a9000008000000010000007700000005000000ff03000008000000fcffffffe638ffff0c000000070000005a0700000100000006000000030000003ee500000000807f0000010003000000030000000c4e2779080000002fe6000004000000001000000000000003000000ff0f00000000008004000000020000007f00000009000000f8ffffff02000000800000000900000002bd0000287f00000b2800000600000057e00000001000000b0000000700000008000000010000000100000081000000260700000500000007000000060000000800000000010000f2ffffff040000000008000007000000080000080300000000000000090000000e00000000000000040000000100000008000000060000000020000006000000040000000300000005000000050000000800000000000100000001000002000000100000010000000700000000000000210c0000001000000200000006000000050000000800000080000000030000000000010009000000040000000008000080000000070000000b000000af28cefffe0f000000100000010100000300000000000000"], 0x420}, 0x1, 0x0, 0x0, 0x1}, 0x20000800) 163.060298ms ago: executing program 4 (id=6550): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) syz_emit_ethernet(0x32, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x9c, 0x0, @val=0x80}}}}}}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x200001, 0x0, 0x0, 0x0, 0x7}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r1, &(0x7f0000000440), &(0x7f0000000040)=@udp=r0}, 0x20) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getsockopt$ax25_int(r4, 0x101, 0xa, &(0x7f0000000240), &(0x7f0000000280)=0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r0, &(0x7f00000047c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000780)=""/232, 0xe8}], 0x1}, 0x1ff}], 0x1, 0x2, 0x0) 11.983166ms ago: executing program 1 (id=6551): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000046000701fcffffff02000000017c0000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback, 0x8000}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303, 0x3a}, "c4d65ab71f5ef2fe", "9e8ecc7bb5352776725e1047577b100800", "dc5db43f", '\x00@\x00'}, 0x38) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={0x2, 0x13, 0xe, 0x5, 0x38, 0x0, 0x70bd2c, 0x25dfdbfd, [@sadb_key={0x1c, 0x9, 0x690, 0x0, "3b40e491adf1db666d4805ed88478fa204f3befdd5d04eb1648daac0882d1072ff01c7626763d5c481e071ecd62430f2ed23741c4a0d34b22a5645c799fa66a3a0beb9fb8c7c51b081e4fa7f5e0aa5414c2831afe399f5858e38ef8931dab9a9ae9d643fdc7ca3c3130f3d3a700be762b9b79ff883611b8b662ee3a2efa9077e9793daf0eccbd89c5769eb42b32a2e2d48d35255e7577c9b2c6a751b668f7f968060b135a85df44a2793969caff606808ee65175c9d5ee76935aab32011c61471530d7999b14445e4ab782c13474d7f43758"}, @sadb_x_sec_ctx={0x16, 0x18, 0x1, 0x2f, 0xa4, "34e64cbfb843a977906194b52fd13336c2b347f5414fb041f90f388f75f9f2a3be4388ae83ed889dae26bf3c9881efeaad89a9977774c39fca41b17549f1b483c1459918bd64805f7dc261de64f67d153cb975e13076fb0a6c89b783b0ddea8627dd23dd136015c78ac59072d0bacee29e4a8adf43bdcfe44fc1a1c57b1095fef31c1ca937eddac06473056fa0a8f9a8389d86e37b47ec3dd44de0ff60614f95eb9ae310"}, @sadb_lifetime={0x4, 0x2, 0x1000, 0x7, 0x2, 0xfffffffffffffffa}]}, 0x1c0}}, 0x1) 0s ago: executing program 1 (id=6552): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000005ee34558a000000000000"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000940)=@base={0x7, 0x4, 0x8000, 0x9}, 0x48) bpf$MAP_GET_NEXT_KEY(0x3, &(0x7f00000001c0)={r0, &(0x7f0000000240), 0x0}, 0x20) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, &(0x7f0000000040)) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0xf, 0x0, 0x0, 0x0, 0x0, 0xf}}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xffffffff, 0xffffffff, 0xfffffffe}, 0x1b) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r3, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x40000100, 0x0, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x80000001, 0x0, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x5}, 0x50) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000180)=@generic={&(0x7f0000000140)='./file0\x00', r4}, 0x18) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FS_IOC_GETFSMAP(r5, 0xc0c0583b, &(0x7f0000000300)={0x0, 0x0, 0x6, 0x0, '\x00', [{0x8, 0x8, 0xfa7, 0x8fc, 0x8000, 0x1}, {0x7, 0x87d, 0x80000001, 0xa, 0xfffffffffffffffc, 0x100000001}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x10403}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004800}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000700)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000540)=@newqdisc={0x17c, 0x24, 0x100, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0xfffd, 0x4}, {0xfff3, 0x2}, {0xc, 0x9}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x7f, 0x6, 0x10001, 0x0, 0x9, 0x6b6}}, {0x4}}]}, @TCA_RATE={0x6, 0x5, {0xff}}, @TCA_STAB={0x124, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xf8, 0x8, 0x3, 0x5, 0x1, 0x8001, 0x45, 0x1}}, {0x6, 0x2, [0x7]}}, {{0x1c, 0x1, {0xb, 0x7, 0x0, 0x2, 0x1, 0x210, 0x4, 0x6}}, {0x10, 0x2, [0xff, 0x100, 0x8, 0xe, 0x7, 0x7]}}, {{0x1c, 0x1, {0x7, 0x9, 0xffff, 0xfffffff7, 0x1, 0xfffffffe, 0xd7, 0x6}}, {0x10, 0x2, [0x1, 0x7fff, 0x1, 0xffff, 0x400, 0x9]}}, {{0x1c, 0x1, {0x7, 0xf3, 0x1, 0x5, 0x2, 0x8, 0x9, 0x3}}, {0xa, 0x2, [0xb, 0xfff9, 0x8000]}}, {{0x1c, 0x1, {0x6, 0x12, 0x9, 0x4, 0x0, 0xfffffff7, 0xc, 0x2}}, {0x8, 0x2, [0x1, 0x3]}}, {{0x1c, 0x1, {0x39, 0xf, 0x7e4e, 0x7, 0x0, 0x0, 0x3, 0x3}}, {0xa, 0x2, [0x81, 0x100, 0x8000]}}, {{0x1c, 0x1, {0x1, 0x6, 0x5, 0x3, 0x0, 0x7, 0x1, 0x7}}, {0x12, 0x2, [0x3, 0x4, 0x7ff, 0x2, 0x7, 0x4, 0x8]}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x6b}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000044}, 0x8090) kernel console output (not intermixed with test programs): h:syzkaller0> rejected, already enabled [ 388.634818][T21122] netlink: 'syz.4.4888': attribute type 2 has an invalid length. [ 388.676848][T21122] netlink: 'syz.4.4888': attribute type 2 has an invalid length. [ 388.738521][T21127] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 389.072027][T21158] Unsupported ieee802154 address type: 0 [ 389.080903][T21158] openvswitch: netlink: IPv6 tunnel dst address is zero [ 389.199665][ T50] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 389.214343][T21171] __nla_validate_parse: 15 callbacks suppressed [ 389.214362][T21171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4900'. [ 389.235096][T21172] netlink: 300 bytes leftover after parsing attributes in process `syz.2.4903'. [ 389.319007][T21182] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4907'. [ 389.347525][T21182] bond9: entered promiscuous mode [ 389.352564][T21182] bond9: entered allmulticast mode [ 389.358522][T21182] 8021q: adding VLAN 0 to HW filter on device bond9 [ 389.368709][T21182] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4907'. [ 389.371495][T21184] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 389.401995][T21182] bond9: (slave macvlan2): Opening slave failed [ 390.054904][T21198] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4913'. [ 390.064886][T21198] openvswitch: netlink: Key 4 has unexpected len 2 expected 12 [ 390.071070][T21201] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4912'. [ 390.108204][T21201] netlink: 'syz.0.4912': attribute type 7 has an invalid length. [ 390.119478][T21201] netlink: 'syz.0.4912': attribute type 8 has an invalid length. [ 390.128719][T21201] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4912'. [ 390.147342][T21206] netlink: 'syz.3.4915': attribute type 83 has an invalid length. [ 390.148104][T21201] erspan0: entered promiscuous mode [ 390.164507][T21201] erspan0: left promiscuous mode [ 390.389191][T21224] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4920'. [ 390.441852][T21229] x_tables: unsorted underflow at hook 4 [ 390.462556][T21224] bond4 (unregistering): Released all slaves [ 390.483644][T21233] netlink: 'syz.2.4923': attribute type 1 has an invalid length. [ 390.501825][T21229] ip6gre1: entered allmulticast mode [ 390.508920][T21233] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 390.596392][T21239] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 390.802472][T21251] syzkaller0: entered promiscuous mode [ 390.813785][T21251] syzkaller0: entered allmulticast mode [ 391.161748][T21286] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4937'. [ 391.216232][T21287] netlink: 'syz.0.4937': attribute type 1 has an invalid length. [ 391.216930][T21286] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4937'. [ 391.325884][T21287] bond10: entered promiscuous mode [ 391.331529][T21287] 8021q: adding VLAN 0 to HW filter on device bond10 [ 391.355214][T21290] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 391.463412][T21303] : entered promiscuous mode [ 391.609979][ T30] audit: type=1107 audit(1767130039.926:5): pid=21314 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='J}g>Ž' [ 391.790542][T21328] batadv3: entered allmulticast mode [ 391.867817][T21330] bond11: entered promiscuous mode [ 391.873488][T21330] bond11: entered allmulticast mode [ 391.879137][T21330] 8021q: adding VLAN 0 to HW filter on device bond11 [ 391.922315][T21338] bond11: (slave macvlan2): Opening slave failed [ 392.068690][T21346] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 392.248788][T21361] tipc: Enabled bearer , priority 10 [ 392.638905][T21386] pim6reg: entered allmulticast mode [ 392.771126][T21399] tipc: Enabling of bearer rejected, already enabled [ 393.305556][T21439] FAULT_INJECTION: forcing a failure. [ 393.305556][T21439] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 393.319947][T21439] CPU: 1 UID: 0 PID: 21439 Comm: syz.2.4985 Not tainted syzkaller #0 PREEMPT(full) [ 393.319970][T21439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 393.319980][T21439] Call Trace: [ 393.319988][T21439] [ 393.319995][T21439] dump_stack_lvl+0x189/0x250 [ 393.320021][T21439] ? __pfx____ratelimit+0x10/0x10 [ 393.320038][T21439] ? __pfx_dump_stack_lvl+0x10/0x10 [ 393.320059][T21439] ? __pfx__printk+0x10/0x10 [ 393.320094][T21439] should_fail_ex+0x414/0x560 [ 393.320125][T21439] _copy_to_user+0x31/0xb0 [ 393.320148][T21439] simple_read_from_buffer+0xe1/0x170 [ 393.320174][T21439] proc_fail_nth_read+0x1b3/0x220 [ 393.320197][T21439] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 393.320218][T21439] ? rw_verify_area+0x2a6/0x4d0 [ 393.320236][T21439] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 393.320256][T21439] vfs_read+0x200/0xa30 [ 393.320271][T21439] ? fdget_pos+0x247/0x320 [ 393.320296][T21439] ? __pfx___mutex_lock+0x10/0x10 [ 393.320315][T21439] ? __pfx_vfs_read+0x10/0x10 [ 393.320332][T21439] ? __fget_files+0x2a/0x420 [ 393.320357][T21439] ? __fget_files+0x3a0/0x420 [ 393.320375][T21439] ? __fget_files+0x2a/0x420 [ 393.320404][T21439] ksys_read+0x145/0x250 [ 393.320421][T21439] ? __pfx_ksys_read+0x10/0x10 [ 393.320441][T21439] ? do_syscall_64+0xbe/0xf80 [ 393.320463][T21439] do_syscall_64+0xfa/0xf80 [ 393.320483][T21439] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.320499][T21439] ? clear_bhb_loop+0x60/0xb0 [ 393.320521][T21439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.320539][T21439] RIP: 0033:0x7f185758e15c [ 393.320554][T21439] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 393.320568][T21439] RSP: 002b:00007f18557f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 393.320588][T21439] RAX: ffffffffffffffda RBX: 00007f18577e5fa0 RCX: 00007f185758e15c [ 393.320602][T21439] RDX: 000000000000000f RSI: 00007f18557f60a0 RDI: 0000000000000004 [ 393.320614][T21439] RBP: 00007f18557f6090 R08: 0000000000000000 R09: 0000000000000000 [ 393.320625][T21439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.320635][T21439] R13: 00007f18577e6038 R14: 00007f18577e5fa0 R15: 00007ffc41c0c848 [ 393.320668][T21439] [ 393.547901][ T6540] tipc: Node number set to 3314207903 [ 393.878209][T21460] team0: Device ip6gre2 is up. Set it down before adding it as a team port [ 394.291031][T21487] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 394.352213][T21494] __nla_validate_parse: 19 callbacks suppressed [ 394.352231][T21494] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5001'. [ 394.383726][ T5846] Bluetooth: hci4: command 0x0405 tx timeout [ 394.388711][T21494] block nbd0: Unsupported socket: should be TCP or UNIX. [ 394.412228][T21497] netlink: 'syz.0.5003': attribute type 39 has an invalid length. [ 394.496525][T21494] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5001'. [ 394.524478][T21505] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5005'. [ 394.595443][T21508] batadv_slave_0: entered promiscuous mode [ 394.639585][T21513] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 394.660149][T21510] batadv_slave_0: left promiscuous mode [ 394.682466][T21515] netlink: 80 bytes leftover after parsing attributes in process `syz.0.5008'. [ 394.897865][T21526] netlink: 'syz.2.5013': attribute type 4 has an invalid length. [ 395.151014][T21539] tipc: Enabled bearer , priority 0 [ 395.163966][T21544] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5016'. [ 395.173882][T21544] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5016'. [ 395.185549][T21539] syzkaller0: entered promiscuous mode [ 395.191533][T21539] syzkaller0: entered allmulticast mode [ 395.260335][T21539] syzkaller0: mtu less than device minimum [ 395.269184][T21538] tipc: Resetting bearer [ 395.301487][T21538] tipc: Disabling bearer [ 395.708068][T21579] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5031'. [ 395.815817][T21587] veth0: entered promiscuous mode [ 395.846570][T21586] veth0: left promiscuous mode [ 395.903389][ T5846] Bluetooth: hci5: command 0x0406 tx timeout [ 396.366151][T21610] vlan3: entered promiscuous mode [ 396.371326][T21610] vlan3: entered allmulticast mode [ 396.391534][T21610] hsr_slave_1: entered allmulticast mode [ 396.761583][T21637] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5048'. [ 396.881154][T21594] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 396.974132][T21654] netlink: 10 bytes leftover after parsing attributes in process `syz.3.5054'. [ 397.042266][T21662] netlink: 'syz.0.5056': attribute type 21 has an invalid length. [ 397.073810][T21662] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5056'. [ 397.126959][T21667] netlink: 'syz.3.5057': attribute type 1 has an invalid length. [ 397.171505][T21672] syzkaller0: entered promiscuous mode [ 397.177929][T21672] syzkaller0: entered allmulticast mode [ 397.475712][T21689] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 397.534416][T21689] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 397.546682][T21689] gretap1: entered promiscuous mode [ 397.552263][T21689] gretap1: entered allmulticast mode [ 397.736221][T21711] openvswitch: netlink: Unexpected mask (mask=200440, allowed=10048) [ 397.784520][T21713] vxcan2: entered allmulticast mode [ 397.827519][T21711] 0: reclassify loop, rule prio 0, protocol 800 [ 397.827737][T21717] tipc: Enabling of bearer rejected, already enabled [ 398.150195][T21732] syzkaller0: entered promiscuous mode [ 398.157108][T21732] syzkaller0: entered allmulticast mode [ 398.220023][T21746] netlink: 'syz.1.5084': attribute type 7 has an invalid length. [ 398.235189][T21746] netlink: 'syz.1.5084': attribute type 8 has an invalid length. [ 400.145186][T21784] netlink: 'syz.0.5093': attribute type 32 has an invalid length. [ 400.154023][T21784] __nla_validate_parse: 6 callbacks suppressed [ 400.154037][T21784] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5093'. [ 400.251354][T21788] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5096'. [ 400.299455][T21784] bond12: option coupled_control: invalid value (2) [ 400.327972][T21784] bond12 (unregistering): Released all slaves [ 400.406703][T21780] 8021q: adding VLAN 0 to HW filter on device bond12 [ 400.414221][T21785] tipc: Enabling of bearer rejected, already enabled [ 400.766092][T21822] netlink: 'syz.2.5108': attribute type 2 has an invalid length. [ 400.966511][T21826] batman_adv: batadv0: Removing interface: dummy0 [ 401.027689][ T5834] Bluetooth: hci2: command 0x0406 tx timeout [ 401.033844][ T5849] Bluetooth: hci3: command 0x0406 tx timeout [ 401.147508][T21852] netlink: 'syz.3.5119': attribute type 2 has an invalid length. [ 401.183050][T21852] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5119'. [ 401.202955][T21852] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 401.219237][T21844] netlink: 536 bytes leftover after parsing attributes in process `syz.4.5115'. [ 401.370467][T21867] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5121'. [ 401.383615][T21867] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5121'. [ 401.574275][T21881] sctp: [Deprecated]: syz.3.5126 (pid 21881) Use of int in max_burst socket option. [ 401.574275][T21881] Use struct sctp_assoc_value instead [ 401.767346][T21891] vxcan1: tx drop: invalid da for name 0x0000000000000003 [ 401.801776][T21894] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.5129'. [ 401.814356][T21890] bond13: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 401.830675][T21890] bond13 (unregistering): Released all slaves [ 401.927581][T21901] lo: left promiscuous mode [ 401.934030][T21901] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 402.000452][T21907] netlink: 'syz.2.5134': attribute type 11 has an invalid length. [ 402.020122][T21907] netlink: 'syz.2.5134': attribute type 11 has an invalid length. [ 402.043536][T21907] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5134'. [ 402.101020][T21911] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5134'. [ 402.214649][T21923] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5139'. [ 402.288386][T21923] bond14: entered promiscuous mode [ 402.294969][T21923] bond14: entered allmulticast mode [ 402.300666][T21923] 8021q: adding VLAN 0 to HW filter on device bond14 [ 402.358743][T21927] bond14: (slave macvlan5): Opening slave failed [ 402.763123][T21964] nbd: must specify a device to reconfigure [ 403.121138][T21988] bond13 (unregistering): Released all slaves [ 403.168231][T21995] netlink: 'syz.3.5155': attribute type 1 has an invalid length. [ 403.203891][T21995] netlink: 'syz.3.5155': attribute type 2 has an invalid length. [ 403.227185][T21997] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 403.506784][T22016] netlink: 'syz.4.5161': attribute type 1 has an invalid length. [ 403.999647][T22043] bridge0: port 1(veth0_to_bridge) entered blocking state [ 404.026448][T22043] bridge0: port 1(veth0_to_bridge) entered disabled state [ 404.067072][T22043] veth0_to_bridge: entered allmulticast mode [ 404.092153][T22043] veth0_to_bridge: entered promiscuous mode [ 404.144355][T22050] macsec1: entered promiscuous mode [ 404.679958][T22087] netlink: 'syz.3.5181': attribute type 1 has an invalid length. [ 404.715788][T22088] netlink: 'syz.3.5181': attribute type 1 has an invalid length. [ 405.200660][T22114] __nla_validate_parse: 9 callbacks suppressed [ 405.200678][T22114] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5187'. [ 405.245430][T22111] syzkaller1: entered promiscuous mode [ 405.251132][T22111] syzkaller1: entered allmulticast mode [ 405.395673][T22121] netlink: 'syz.2.5191': attribute type 4 has an invalid length. [ 405.524762][T22129] netlink: 'syz.4.5195': attribute type 63 has an invalid length. [ 405.546413][T22131] netlink: 'syz.2.5194': attribute type 2 has an invalid length. [ 405.555314][T22129] netlink: 'syz.4.5195': attribute type 63 has an invalid length. [ 405.570229][T22131] 9: entered promiscuous mode [ 405.952225][T22152] syzkaller0: refused to change device tx_queue_len [ 406.127411][T22158] netlink: 'syz.2.5202': attribute type 15 has an invalid length. [ 406.242324][T22161] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5204'. [ 406.439732][T22171] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5208'. [ 406.476382][T22171] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5208'. [ 406.892589][T22187] sctp: [Deprecated]: syz.0.5213 (pid 22187) Use of int in max_burst socket option deprecated. [ 406.892589][T22187] Use struct sctp_assoc_value instead [ 406.952283][T22187] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5213'. [ 407.200720][T22200] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5218'. [ 407.300387][T22204] netlink: 'syz.4.5219': attribute type 1 has an invalid length. [ 407.339344][T22204] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 407.582297][T22223] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5225'. [ 407.764434][T22231] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5227'. [ 407.769826][T22237] IPVS: set_ctl: invalid protocol: 43 172.20.20.170:20001 [ 408.021285][T22266] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5237'. [ 408.158400][T22272] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 408.165615][T22272] syzkaller1: linktype set to 823 [ 408.171281][T22272] syzkaller1: tun_chr_ioctl cmd 1074025672 [ 408.178317][T22272] syzkaller1: ignored: set checksum disabled [ 408.225008][T22276] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5242'. [ 408.601556][T22303] netlink: 'syz.4.5253': attribute type 2 has an invalid length. [ 408.604457][T22305] netlink: 'syz.3.5254': attribute type 10 has an invalid length. [ 409.155926][T22354] netlink: 'syz.0.5266': attribute type 3 has an invalid length. [ 409.169594][T22354] ieee802154 phy0 wpan0: encryption failed: -22 [ 409.480557][T22376] netlink: 'syz.2.5269': attribute type 9 has an invalid length. [ 409.566054][T22381] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 409.648149][T22382] bond6: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 409.696512][T22382] bond6 (unregistering): Released all slaves [ 409.815453][T22388] syzkaller1: entered promiscuous mode [ 409.848295][T22388] syzkaller1: entered allmulticast mode [ 409.872793][T22394] sctp: [Deprecated]: syz.2.5275 (pid 22394) Use of struct sctp_assoc_value in delayed_ack socket option. [ 409.872793][T22394] Use struct sctp_sack_info instead [ 410.038985][T22411] 8021q: adding VLAN 0 to HW filter on device bond6 [ 410.131656][T22412] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.275960][T22430] __nla_validate_parse: 9 callbacks suppressed [ 410.275977][T22430] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5284'. [ 410.345372][T22430] macvtap0: left allmulticast mode [ 410.357272][T22430] bridge2: left promiscuous mode [ 410.374169][T22430] bridge2: left allmulticast mode [ 410.379535][T22430] gretap1: left promiscuous mode [ 410.388758][T22430] gretap1: left allmulticast mode [ 410.406468][T22430] vlan3: left promiscuous mode [ 410.410142][T22435] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5286'. [ 410.411406][T22430] vlan3: left allmulticast mode [ 410.432231][T22430] hsr_slave_1: left allmulticast mode [ 410.444331][T22440] veth0_to_bridge: left allmulticast mode [ 410.456195][T22440] veth0_to_bridge: left promiscuous mode [ 410.472726][T22440] bridge0: port 1(veth0_to_bridge) entered disabled state [ 410.499377][T22443] IPVS: set_ctl: invalid protocol: 59 0.0.0.0:20004 [ 410.511816][T22440] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 410.744579][T22454] xt_CT: No such helper "pptp" [ 410.766240][T22455] netlink: 14544 bytes leftover after parsing attributes in process `syz.4.5292'. [ 410.796515][T22455] sch_tbf: burst 0 is lower than device lo mtu (11337746) ! [ 410.867719][T22463] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5294'. [ 410.881587][T22465] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5295'. [ 410.892334][T22465] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5295'. [ 411.089306][T22479] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 411.177945][T22485] nbd: nbd0 already in use [ 411.179218][T22484] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5301'. [ 411.347335][T22484] macvtap1: entered promiscuous mode [ 411.353853][T22484] vlan0: entered promiscuous mode [ 411.359509][T22484] macvtap1: entered allmulticast mode [ 411.371413][T22484] vlan0: entered allmulticast mode [ 411.382258][T22484] veth0_vlan: entered allmulticast mode [ 411.429684][T22503] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5306'. [ 411.546926][T22507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5309'. [ 411.647551][T22511] IPVS: set_ctl: invalid protocol: 33 172.20.20.187:20004 [ 411.678349][T22515] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5312'. [ 411.738953][T22515] bond11: entered promiscuous mode [ 411.748131][T22515] bond11: entered allmulticast mode [ 411.756295][T22515] 8021q: adding VLAN 0 to HW filter on device bond11 [ 411.804254][T22515] bond11: (slave macvlan2): Opening slave failed [ 411.859181][T22531] validate_nla: 4 callbacks suppressed [ 411.859193][T22531] netlink: 'syz.0.5315': attribute type 2 has an invalid length. [ 412.381322][T22564] netlink: 'syz.2.5323': attribute type 1 has an invalid length. [ 412.504108][T22564] bond12 (unregistering): Released all slaves [ 412.998848][T22600] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 413.097146][T22606] netlink: 'syz.2.5335': attribute type 5 has an invalid length. [ 413.269987][T22614] netlink: 'syz.3.5339': attribute type 21 has an invalid length. [ 413.294128][T22614] netlink: 'syz.3.5339': attribute type 1 has an invalid length. [ 413.328318][T22615] !€ÿ—: renamed from bond_slave_0 [ 413.891511][T22648] netlink: 'syz.3.5350': attribute type 21 has an invalid length. [ 414.090371][T22665] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20003 [ 414.410179][T22682] openvswitch: netlink: Message has 4 unknown bytes. [ 414.621466][T22698] ip6gre2: entered allmulticast mode [ 414.654284][T22700] netlink: 'syz.4.5371': attribute type 3 has an invalid length. [ 414.716972][T22706] netlink: 'syz.0.5372': attribute type 21 has an invalid length. [ 414.725609][T22706] IPv6: NLM_F_CREATE should be specified when creating new route [ 414.735288][T22706] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 414.742560][T22706] IPv6: NLM_F_CREATE should be set when creating new route [ 414.749863][T22706] IPv6: NLM_F_CREATE should be set when creating new route [ 414.757135][T22706] IPv6: NLM_F_CREATE should be set when creating new route [ 415.056708][T22718] batadv_slave_1: entered promiscuous mode [ 415.231648][T22730] netlink: 'syz.1.5382': attribute type 1 has an invalid length. [ 415.246712][T22729] syzkaller0: entered promiscuous mode [ 415.252496][T22729] syzkaller0: entered allmulticast mode [ 415.294491][T22730] 8021q: adding VLAN 0 to HW filter on device bond15 [ 415.451542][T22741] __nla_validate_parse: 13 callbacks suppressed [ 415.451593][T22741] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5384'. [ 415.675210][T22755] netlink: 'syz.4.5388': attribute type 21 has an invalid length. [ 415.692383][T22755] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5388'. [ 415.733389][T22764] bridge0: port 1(veth0_to_bridge) entered blocking state [ 415.740647][T22764] bridge0: port 1(veth0_to_bridge) entered disabled state [ 415.750859][T22764] veth0_to_bridge: entered allmulticast mode [ 415.762865][T22764] veth0_to_bridge: entered promiscuous mode [ 415.826539][T22717] batadv_slave_1: left promiscuous mode [ 416.151323][T22795] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5399'. [ 416.268832][T22803] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5402'. [ 416.291637][T22805] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5403'. [ 416.422247][T22816] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 416.501458][T22819] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5407'. [ 416.555658][T22819] netlink: 112 bytes leftover after parsing attributes in process `syz.4.5407'. [ 416.595844][T22819] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5407'. [ 416.990634][T22850] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5418'. [ 417.040971][T22856] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5418'. [ 417.067417][T22854] validate_nla: 2 callbacks suppressed [ 417.067492][T22854] netlink: 'syz.4.5420': attribute type 178 has an invalid length. [ 417.099515][T22850] bond12: entered promiscuous mode [ 417.107157][T22850] bond12: entered allmulticast mode [ 417.114348][T22850] 8021q: adding VLAN 0 to HW filter on device bond12 [ 417.149710][T22856] bond12: (slave macvlan2): Opening slave failed [ 417.371162][ T36] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 418.097800][T22902] xt_l2tp: unknown flags: 10 [ 418.189520][T22909] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 418.503375][T22924] tipc: Enabled bearer , priority 0 [ 418.552044][T22924] syzkaller0: entered promiscuous mode [ 418.583740][T22924] syzkaller0: entered allmulticast mode [ 418.614784][T22924] tipc: Resetting bearer [ 418.655106][T22923] tipc: Resetting bearer [ 418.774250][T22923] tipc: Disabling bearer [ 418.819165][T22945] gre0: entered promiscuous mode [ 418.826903][T22945] gre0: entered allmulticast mode [ 418.857671][T22943] netlink: 'syz.0.5443': attribute type 5 has an invalid length. [ 418.887335][T22912] gretap0 speed is unknown, defaulting to 1000 [ 419.311980][T22969] x_tables: duplicate underflow at hook 1 [ 419.559753][T22986] netlink: 'syz.1.5454': attribute type 29 has an invalid length. [ 419.593968][T22986] netlink: 'syz.1.5454': attribute type 24 has an invalid length. [ 419.625329][T22989] netlink: 'syz.1.5454': attribute type 29 has an invalid length. [ 419.766380][T23005] netlink: 'syz.1.5459': attribute type 1 has an invalid length. [ 419.897428][T23009] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 419.904722][T23009] IPv6: NLM_F_CREATE should be set when creating new route [ 419.911966][T23009] IPv6: NLM_F_CREATE should be set when creating new route [ 420.251278][T23038] netlink: 'syz.0.5468': attribute type 2 has an invalid length. [ 420.687189][T23076] netlink: 'syz.2.5477': attribute type 39 has an invalid length. [ 421.046458][T23095] netlink: 'syz.3.5485': attribute type 10 has an invalid length. [ 421.046932][T23099] netlink: 'syz.3.5485': attribute type 10 has an invalid length. [ 421.091608][T23095] __nla_validate_parse: 13 callbacks suppressed [ 421.091626][T23095] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5485'. [ 421.092699][T23099] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5485'. [ 421.126458][T23098] nbd: must specify an index to disconnect [ 421.284226][T23095] team0: Port device geneve0 added [ 421.425102][T23096] gretap0 speed is unknown, defaulting to 1000 [ 421.805781][T23137] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5497'. [ 439.906182][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 447.027797][T23162] tap0: tun_chr_ioctl cmd 1074025680 [ 447.034929][T23162] tap0: tun_chr_ioctl cmd 2148553947 [ 447.139143][T23172] veth0: entered promiscuous mode [ 447.580455][T23173] gretap0 speed is unknown, defaulting to 1000 [ 447.662109][T23195] validate_nla: 1 callbacks suppressed [ 447.662125][T23195] netlink: 'syz.4.5519': attribute type 21 has an invalid length. [ 447.679221][T23195] netlink: 'syz.4.5519': attribute type 6 has an invalid length. [ 447.688551][T23195] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5519'. [ 447.726627][T23195] tipc: Enabling of bearer rejected, already enabled [ 447.735695][T23171] veth0: left promiscuous mode [ 447.742013][T23195] netlink: 'syz.4.5519': attribute type 10 has an invalid length. [ 447.778095][T23195] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 447.869044][T23202] netlink: 'syz.3.5523': attribute type 2 has an invalid length. [ 447.909432][T23205] rdma_rxe: rxe_newlink: failed to add wlan0 [ 447.918789][T23201] IPv6: sit1: Disabled Multicast RS [ 447.933447][T23202] netlink: 'syz.3.5523': attribute type 7 has an invalid length. [ 447.941281][T23202] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5523'. [ 447.952039][T23206] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 448.120446][T23212] netlink: 'syz.4.5526': attribute type 1 has an invalid length. [ 448.305127][T23222] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5529'. [ 448.390488][T23226] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 448.421555][T23226] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 448.445598][T23222] tipc: Enabled bearer , priority 0 [ 448.578050][T23222] syzkaller0: entered promiscuous mode [ 448.604263][T23222] syzkaller0: entered allmulticast mode [ 448.610427][T23222] tipc: Resetting bearer [ 448.628442][T23230] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 448.645624][T23240] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5537'. [ 448.657897][T23243] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5538'. [ 448.674425][T23243] block nbd0: reconnected socket [ 448.679908][T23221] tipc: Resetting bearer [ 448.694747][ T5846] block nbd0: Receive control failed (result -32) [ 450.074684][T23221] tipc: Disabling bearer [ 450.106884][T23268] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5543'. [ 450.126220][ T6540] tipc: Node number set to 3462490535 [ 450.371732][T23288] netlink: 128 bytes leftover after parsing attributes in process `syz.1.5549'. [ 450.429061][T23288] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5549'. [ 450.582603][T23300] netlink: 'syz.1.5553': attribute type 2 has an invalid length. [ 450.594474][T23300] netlink: 244 bytes leftover after parsing attributes in process `syz.1.5553'. [ 450.639723][T15634] tipc: Disabling bearer [ 450.671084][T15634] bond8 (unregistering): (slave gretap1): Releasing active interface [ 451.135950][T15634] bond0 (unregistering): Released all slaves [ 451.225766][T15634] bond1 (unregistering): Released all slaves [ 451.239071][T15634] bond2 (unregistering): Released all slaves [ 451.328195][T15634] bond3 (unregistering): Released all slaves [ 451.437615][T15634] bond4 (unregistering): Released all slaves [ 451.458976][T15634] bond5 (unregistering): Released all slaves [ 451.568080][T15634] bond6 (unregistering): Released all slaves [ 451.659387][T15634] bond7 (unregistering): Released all slaves [ 451.678268][T15634] bond8 (unregistering): Released all slaves [ 451.814935][T23313] netlink: 10 bytes leftover after parsing attributes in process `syz.3.5554'. [ 451.838750][T15634] bond9 (unregistering): Released all slaves [ 451.929130][T15634] bond10 (unregistering): Released all slaves [ 451.970477][T23310] syzkaller0: entered promiscuous mode [ 451.997200][T23310] syzkaller0: entered allmulticast mode [ 452.097221][T15634] : left promiscuous mode [ 452.206780][T23324] delete_channel: no stack [ 452.277918][T15634] tipc: Disabling bearer [ 452.292959][T15634] tipc: Left network mode [ 452.732095][T23360] tipc: Enabling of bearer rejected, already enabled [ 452.771826][T23353] tipc: Enabling of bearer rejected, already enabled [ 452.796416][T23362] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 452.924685][T23360] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 452.980785][T23353] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 453.026030][T23377] FAULT_INJECTION: forcing a failure. [ 453.026030][T23377] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.057350][T23377] CPU: 0 UID: 0 PID: 23377 Comm: syz.0.5572 Not tainted syzkaller #0 PREEMPT(full) [ 453.057376][T23377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 453.057386][T23377] Call Trace: [ 453.057393][T23377] [ 453.057402][T23377] dump_stack_lvl+0x189/0x250 [ 453.057427][T23377] ? __pfx____ratelimit+0x10/0x10 [ 453.057444][T23377] ? __pfx_dump_stack_lvl+0x10/0x10 [ 453.057463][T23377] ? __pfx__printk+0x10/0x10 [ 453.057486][T23377] ? __might_fault+0xb0/0x130 [ 453.057522][T23377] should_fail_ex+0x414/0x560 [ 453.057553][T23377] _copy_from_user+0x2d/0xb0 [ 453.057575][T23377] kstrtouint_from_user+0xc4/0x170 [ 453.057597][T23377] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 453.057633][T23377] proc_fail_nth_write+0x88/0x200 [ 453.057653][T23377] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 453.057679][T23377] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 453.057700][T23377] vfs_write+0x27e/0xb30 [ 453.057728][T23377] ? __pfx_vfs_write+0x10/0x10 [ 453.057748][T23377] ? __fget_files+0x2a/0x420 [ 453.057774][T23377] ? __fget_files+0x3a0/0x420 [ 453.057794][T23377] ? __fget_files+0x2a/0x420 [ 453.057825][T23377] ksys_write+0x145/0x250 [ 453.057846][T23377] ? __pfx_ksys_write+0x10/0x10 [ 453.057868][T23377] ? do_syscall_64+0xbe/0xf80 [ 453.057891][T23377] do_syscall_64+0xfa/0xf80 [ 453.057911][T23377] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.057929][T23377] ? clear_bhb_loop+0x60/0xb0 [ 453.057951][T23377] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.057968][T23377] RIP: 0033:0x7fbcbcd8e1ff [ 453.057986][T23377] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 453.058001][T23377] RSP: 002b:00007fbcbdc55030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 453.058021][T23377] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbcbcd8e1ff [ 453.058035][T23377] RDX: 0000000000000001 RSI: 00007fbcbdc550a0 RDI: 0000000000000005 [ 453.058047][T23377] RBP: 00007fbcbdc55090 R08: 0000000000000000 R09: 0000000000000000 [ 453.058059][T23377] R10: 000000000000004e R11: 0000000000000293 R12: 0000000000000001 [ 453.058070][T23377] R13: 00007fbcbcfe6038 R14: 00007fbcbcfe5fa0 R15: 00007ffc13719a28 [ 453.058104][T23377] [ 453.310008][T15634] hsr_slave_0: left promiscuous mode [ 453.326453][T15634] hsr_slave_1: left promiscuous mode [ 453.760755][T23409] __nla_validate_parse: 2 callbacks suppressed [ 453.760772][T23409] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5582'. [ 453.969219][ T12] smc: removing ib device !yz! [ 454.352965][T23387] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 454.468706][T23433] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.5587'. [ 454.629913][T23439] netlink: 'syz.3.5589': attribute type 1 has an invalid length. [ 454.685385][T23442] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5588'. [ 454.713805][T23442] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5588'. [ 455.130229][T23465] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5599'. [ 455.164675][T23461] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 455.476414][T23483] tipc: Enabling of bearer rejected, failed to enable media [ 455.706172][T23501] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5613'. [ 455.769399][T23504] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5613'. [ 456.000429][T23516] x_tables: duplicate underflow at hook 2 [ 456.034691][T23501] bond4: entered promiscuous mode [ 456.039791][T23517] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 456.044160][T23512] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5616'. [ 456.059373][T23501] bond4: entered allmulticast mode [ 456.070165][T23501] 8021q: adding VLAN 0 to HW filter on device bond4 [ 456.151840][T23504] bond4: (slave macvlan2): Opening slave failed [ 456.339863][T23521] netlink: 'syz.0.5618': attribute type 1 has an invalid length. [ 456.388574][T15634] IPVS: stop unused estimator thread 0... [ 456.406029][T23521] netlink: 'syz.0.5618': attribute type 2 has an invalid length. [ 456.436175][T23521] netlink: 'syz.0.5618': attribute type 1 has an invalid length. [ 456.448769][T23521] netlink: 'syz.0.5618': attribute type 3 has an invalid length. [ 456.497085][T23521] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5618'. [ 456.654056][T23541] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5624'. [ 456.666508][T23541] block nbd0: reconnected socket [ 456.687615][T23547] tipc: Failed to remove unknown binding: 66,0,0/1120002835:3242501533/3242501534 [ 456.713783][ T5846] block nbd0: Receive control failed (result -32) [ 457.183290][T23574] bond0 (unregistering): Released all slaves [ 457.494071][T23599] netlink: 'syz.1.5642': attribute type 11 has an invalid length. [ 457.515718][T23602] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 457.954800][T23632] openvswitch: netlink: VXLAN extension 0 has unexpected len 2 expected 0 [ 458.226368][T23629] vlan0 (unregistering): left allmulticast mode [ 458.234824][T23629] veth0_vlan (unregistering): left allmulticast mode [ 458.241502][T23629] vlan0 (unregistering): left promiscuous mode [ 459.631160][T23717] lo: left promiscuous mode [ 459.645427][T23717] lo: entered allmulticast mode [ 459.661346][T23717] tunl0: entered allmulticast mode [ 459.675226][T23717] gre0: left promiscuous mode [ 459.707683][T23719] __nla_validate_parse: 9 callbacks suppressed [ 459.707701][T23719] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5676'. [ 459.728387][T23717] gretap0: entered allmulticast mode [ 459.731786][T23719] block nbd0: reconnected socket [ 459.741973][T23723] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5677'. [ 459.758898][T23717] erspan0: entered allmulticast mode [ 459.799802][T23717] ip_vti0: entered allmulticast mode [ 459.811672][T23717] ip6_vti0: entered allmulticast mode [ 459.837470][T23717] sit0: entered allmulticast mode [ 459.855460][T23717] ip6tnl0: entered allmulticast mode [ 459.868138][T23717] ip6gre0: entered allmulticast mode [ 459.878941][T23717] syz_tun: entered allmulticast mode [ 459.898001][T23717] ip6gretap0: entered allmulticast mode [ 459.915210][T23717] vcan0: entered allmulticast mode [ 459.937242][T23739] tipc: Trying to set illegal importance in message [ 459.944948][T23717] bond0: entered allmulticast mode [ 459.955082][T23717] team0: entered allmulticast mode [ 459.961657][T23741] tipc: Trying to set illegal importance in message [ 459.964667][T23717] v: entered allmulticast mode [ 459.975343][T23717] nlmon0: entered allmulticast mode [ 459.988690][T23717] veth1: entered allmulticast mode [ 460.001066][T23717] wg1: entered allmulticast mode [ 460.008720][T23717] wg2: entered allmulticast mode [ 460.015156][T23717] veth0_to_bridge: entered allmulticast mode [ 460.024236][T23717] bridge_slave_0: entered allmulticast mode [ 460.032042][T23717] veth1_to_bridge: entered allmulticast mode [ 460.042063][T23717] bridge_slave_1: entered allmulticast mode [ 460.049548][T23717] veth0_to_bond: entered allmulticast mode [ 460.058715][T23717] bond_slave_0: entered allmulticast mode [ 460.065213][T23717] veth1_to_bond: entered allmulticast mode [ 460.074463][T23717] bond_slave_1: entered allmulticast mode [ 460.080634][T23717] veth0_to_team: entered allmulticast mode [ 460.089814][T23717] team_slave_0: entered allmulticast mode [ 460.096264][T23717] veth1_to_team: entered allmulticast mode [ 460.105485][T23717] team_slave_1: entered allmulticast mode [ 460.111987][T23717] veth0_to_batadv: entered allmulticast mode [ 460.121104][T23717] batadv_slave_0: entered allmulticast mode [ 460.130124][T23717] veth1_to_batadv: entered allmulticast mode [ 460.138870][T23717] batadv_slave_1: entered allmulticast mode [ 460.148945][T23717] xfrm0: entered allmulticast mode [ 460.154912][T23717] veth0_to_hsr: entered allmulticast mode [ 460.163699][T23717] hsr_slave_0: entered allmulticast mode [ 460.171112][T23717] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 460.248754][ T5846] block nbd0: Receive control failed (result -32) [ 460.404620][T23753] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5686'. [ 460.437328][T23753] netlink: 212360 bytes leftover after parsing attributes in process `syz.4.5686'. [ 460.508247][T23757] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5689'. [ 460.534005][T23757] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5689'. [ 460.554513][T23760] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.5691'. [ 460.570087][T23761] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5690'. [ 460.580861][T23761] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5690'. [ 460.705424][T23780] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5695'. [ 461.788143][T23821] ipt_REJECT: TCP_RESET invalid for non-tcp [ 461.952029][T23831] syzkaller0: entered promiscuous mode [ 461.957743][T23831] syzkaller0: entered allmulticast mode [ 462.430586][T23873] netlink: 'syz.2.5726': attribute type 3 has an invalid length. [ 462.440661][T23873] netlink: 'syz.2.5726': attribute type 1 has an invalid length. [ 462.470849][T23876] lo: left allmulticast mode [ 462.480776][T23876] tunl0: left allmulticast mode [ 462.490539][T23876] gre0: left allmulticast mode [ 462.513725][T23876] gretap0: left allmulticast mode [ 462.524783][T23876] erspan0: left allmulticast mode [ 462.540236][T23876] ip_vti0: left allmulticast mode [ 462.568852][T23876] ip6_vti0: left allmulticast mode [ 462.575214][T23876] sit0: left allmulticast mode [ 462.580225][T23876] ip6tnl0: left allmulticast mode [ 462.587449][T23876] ip6gre0: left allmulticast mode [ 462.592550][T23876] syz_tun: left allmulticast mode [ 462.598279][T23876] ip6gretap0: left allmulticast mode [ 462.604865][T23876] vcan0: left allmulticast mode [ 462.609926][T23876] bond0: left allmulticast mode [ 462.615265][T23876] team0: left allmulticast mode [ 462.620419][T23876] v: left allmulticast mode [ 462.625365][T23876] nlmon0: left allmulticast mode [ 462.630464][T23876] veth1: left allmulticast mode [ 462.635960][T23876] wg1: left allmulticast mode [ 462.640883][T23876] wg2: left allmulticast mode [ 462.647200][T23876] veth0_to_bridge: left allmulticast mode [ 462.654133][T23876] bridge_slave_0: left allmulticast mode [ 462.659891][T23876] veth1_to_bridge: left allmulticast mode [ 462.666817][T23876] bridge_slave_1: left allmulticast mode [ 462.672556][T23876] veth0_to_bond: left allmulticast mode [ 462.679140][T23876] bond_slave_0: left allmulticast mode [ 462.685895][T23876] veth1_to_bond: left allmulticast mode [ 462.691544][T23876] bond_slave_1: left allmulticast mode [ 462.697811][T23876] veth0_to_team: left allmulticast mode [ 462.707644][T23876] team_slave_0: left allmulticast mode [ 462.714148][T23876] veth1_to_team: left allmulticast mode [ 462.719791][T23876] team_slave_1: left allmulticast mode [ 462.726205][T23876] veth0_to_batadv: left allmulticast mode [ 462.732009][T23876] batadv_slave_0: left allmulticast mode [ 462.738540][T23876] veth1_to_batadv: left allmulticast mode [ 462.745215][T23876] batadv_slave_1: left allmulticast mode [ 462.750931][T23876] xfrm0: left allmulticast mode [ 462.756550][T23876] veth0_to_hsr: left allmulticast mode [ 462.762125][T23876] hsr_slave_0: left allmulticast mode [ 462.768692][T23876] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 462.787090][T23885] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 463.005236][T23901] netlink: 'syz.1.5736': attribute type 1 has an invalid length. [ 463.014494][T23901] netlink: 'syz.1.5736': attribute type 2 has an invalid length. [ 463.155160][T23909] netlink: 'syz.2.5738': attribute type 9 has an invalid length. [ 463.425830][T23931] tunl0: left allmulticast mode [ 463.430913][T23931] gre0: left allmulticast mode [ 463.436507][T23931] gretap0: left allmulticast mode [ 463.441698][T23931] erspan0: left allmulticast mode [ 463.458251][T23931] ip_vti0: left allmulticast mode [ 463.480683][T23931] ip6_vti0: left allmulticast mode [ 463.508408][T23931] sit0: left allmulticast mode [ 463.524015][T23931] ip6tnl0: left allmulticast mode [ 463.545726][T23931] ip6gre0: left allmulticast mode [ 463.560364][T23931] ip6gretap0: left allmulticast mode [ 463.576612][T23931] team0: left allmulticast mode [ 463.591868][T23931] dummy0: left allmulticast mode [ 463.602233][T23931] nlmon0: left allmulticast mode [ 463.620337][T23931] caif0: left allmulticast mode [ 463.630058][T23931] batadv0: left allmulticast mode [ 463.635991][T23931] vxcan0: left allmulticast mode [ 463.644073][T23931] veth0: left allmulticast mode [ 463.649320][T23931] veth1: left allmulticast mode [ 463.655498][T23931] wg0: left allmulticast mode [ 463.663143][T23931] wg1: left allmulticast mode [ 463.668546][T23931] wg2: left allmulticast mode [ 463.677330][T23931] veth0_to_bridge: left allmulticast mode [ 463.684342][T23931] bridge_slave_0: left allmulticast mode [ 463.690332][T23931] veth1_to_bridge: left allmulticast mode [ 463.697028][T23931] bridge_slave_1: left allmulticast mode [ 463.703310][T23931] veth0_to_bond: left allmulticast mode [ 463.709131][T23931] bond_slave_0: left allmulticast mode [ 463.721626][T23931] veth1_to_bond: left allmulticast mode [ 463.728607][T23931] bond_slave_1: left allmulticast mode [ 463.736300][T23931] veth0_to_team: left allmulticast mode [ 463.742606][T23931] team_slave_0: left allmulticast mode [ 463.756185][T23931] veth1_to_team: left allmulticast mode [ 463.761956][T23931] team_slave_1: left allmulticast mode [ 463.768425][T23931] veth0_to_batadv: left allmulticast mode [ 463.775872][T23931] batadv_slave_0: left allmulticast mode [ 463.781834][T23931] veth1_to_batadv: left allmulticast mode [ 463.789039][T23931] xfrm0: left allmulticast mode [ 463.795114][T23931] veth0_to_hsr: left allmulticast mode [ 463.800735][T23931] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 463.877710][T23956] netlink: 'syz.1.5750': attribute type 33 has an invalid length. [ 463.951196][T23964] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 463.980872][T23965] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 464.775512][T24017] __nla_validate_parse: 58 callbacks suppressed [ 464.775531][T24017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5769'. [ 464.829722][T24021] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5771'. [ 464.838347][T24025] netlink: 'syz.1.5773': attribute type 1 has an invalid length. [ 464.838931][T24017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5769'. [ 464.872238][T24021] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5771'. [ 464.877989][T24025] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5773'. [ 465.022977][ T52] Bluetooth: hci4: command 0x0405 tx timeout [ 465.091662][T24036] openvswitch: netlink: Unexpected mask (mask=200440, allowed=10048) [ 465.110890][T24036] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5780'. [ 465.180023][T24046] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5781'. [ 465.200569][T24049] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5778'. [ 465.510938][T24063] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5786'. [ 465.614913][T24070] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 465.694222][T24078] ip6t_srh: unknown srh invflags 4000 [ 465.752131][T24082] bridge0: entered allmulticast mode [ 465.796468][T24079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5789'. [ 466.162862][T24112] tipc: Enabled bearer , priority 0 [ 466.205115][T24106] syzkaller0: MTU too low for tipc bearer [ 466.210871][T24106] tipc: Disabling bearer [ 466.230561][T24116] netlink: 'syz.3.5802': attribute type 1 has an invalid length. [ 466.624511][T24147] wlan0 speed is unknown, defaulting to 1000 [ 466.641094][T24149] netlink: 'syz.2.5812': attribute type 12 has an invalid length. [ 466.649365][T24147] wlan0 speed is unknown, defaulting to 1000 [ 466.708588][T24149] bond0: option primary_reselect: invalid value (255) [ 466.720757][T24149] bond0 (unregistering): Released all slaves [ 466.767769][T24147] wlan0 speed is unknown, defaulting to 1000 [ 466.810201][T24147] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 466.889189][T24147] wlan0 speed is unknown, defaulting to 1000 [ 466.899418][T24147] wlan0 speed is unknown, defaulting to 1000 [ 466.915431][T24147] wlan0 speed is unknown, defaulting to 1000 [ 466.932470][T24147] wlan0 speed is unknown, defaulting to 1000 [ 466.989868][T24147] wlan0 speed is unknown, defaulting to 1000 [ 467.543645][T24210] openvswitch: netlink: Flow actions attr not present in new flow. [ 467.554373][T24210] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 467.596280][T24212] netlink: 'syz.4.5837': attribute type 1 has an invalid length. [ 467.760429][T24220] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.885901][T24234] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 467.939188][T24242] syzkaller1: entered promiscuous mode [ 467.944749][T24242] syzkaller1: entered allmulticast mode [ 467.976883][T24243] netlink: 'syz.0.5849': attribute type 11 has an invalid length. [ 468.152441][T24252] gre0: left promiscuous mode [ 468.159668][T24252] gre0: left allmulticast mode [ 468.169352][T24252] veth0_to_bridge: left allmulticast mode [ 468.186381][T24252] veth0_to_bridge: left promiscuous mode [ 468.192259][T24252] bridge0: port 1(veth0_to_bridge) entered disabled state [ 468.215716][T24252] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 468.675952][T24288] bridge0: left allmulticast mode [ 468.898137][T24288] bond0: (slave syz_tun): Releasing backup interface [ 469.117635][T24288] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 469.926976][T24348] sit1: entered promiscuous mode [ 469.937969][T24348] sit1: entered allmulticast mode [ 470.055582][T24367] __nla_validate_parse: 29 callbacks suppressed [ 470.055599][T24367] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5893'. [ 470.267146][T24376] netlink: 'syz.1.5897': attribute type 5 has an invalid length. [ 470.282289][T24376] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5897'. [ 470.358091][T24382] netlink: 'syz.0.5900': attribute type 1 has an invalid length. [ 470.374805][T24383] netlink: 'syz.0.5900': attribute type 1 has an invalid length. [ 470.464988][T24388] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5902'. [ 470.516569][T24388] 8021q: adding VLAN 0 to HW filter on device bond13 [ 470.868563][T24415] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 470.914005][T24416] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5907'. [ 470.919293][T24410] bond0: invalid ARP target 0.0.0.0 specified for addition [ 470.931102][T24410] bond0: option arp_ip_target: invalid value (0) [ 470.931285][T24417] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5908'. [ 470.966955][T24418] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5907'. [ 470.984926][T24410] bond0 (unregistering): Released all slaves [ 471.010347][T24424] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 471.027672][T24416] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5907'. [ 471.048621][T24416] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5907'. [ 471.288433][T24440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5913'. [ 471.298564][T24440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5913'. [ 471.321486][T24444] lo: entered promiscuous mode [ 471.326859][T24444] lo: entered allmulticast mode [ 471.335817][T24444] tunl0: entered promiscuous mode [ 471.341042][T24444] tunl0: entered allmulticast mode [ 471.357920][T24447] netlink: 'syz.1.5918': attribute type 83 has an invalid length. [ 471.361439][T24444] gre0: entered promiscuous mode [ 471.379885][T24444] gre0: entered allmulticast mode [ 471.402517][T24444] gretap0: entered promiscuous mode [ 471.409696][T24444] gretap0: entered allmulticast mode [ 471.418125][T24444] erspan0: entered promiscuous mode [ 471.426795][T24444] erspan0: entered allmulticast mode [ 471.435253][T24444] ip_vti0: entered promiscuous mode [ 471.440565][T24444] ip_vti0: entered allmulticast mode [ 471.449287][T24444] ip6_vti0: entered promiscuous mode [ 471.455810][T24444] ip6_vti0: entered allmulticast mode [ 471.464266][T24444] sit0: entered promiscuous mode [ 471.469368][T24444] sit0: entered allmulticast mode [ 471.488493][T24444] ip6tnl0: entered promiscuous mode [ 471.495031][T24444] ip6tnl0: entered allmulticast mode [ 471.502367][T24444] ip6gre0: entered promiscuous mode [ 471.509036][T24444] ip6gre0: entered allmulticast mode [ 471.517612][T24444] syz_tun: entered promiscuous mode [ 471.525392][T24444] syz_tun: entered allmulticast mode [ 471.536612][T24444] ip6gretap0: entered promiscuous mode [ 471.542182][T24444] ip6gretap0: entered allmulticast mode [ 471.551273][T24444] bridge0: entered promiscuous mode [ 471.558113][T24444] bridge0: entered allmulticast mode [ 471.566006][T24444] vcan0: entered promiscuous mode [ 471.571106][T24444] vcan0: entered allmulticast mode [ 471.573238][T24456] IPVS: length: 146 != 8 [ 471.579034][T24444] bond0: entered promiscuous mode [ 471.586843][T24444] bond0: entered allmulticast mode [ 471.593925][T24444] 8021q: adding VLAN 0 to HW filter on device bond0 [ 471.601295][T24444] team0: entered promiscuous mode [ 471.606945][T24444] team0: entered allmulticast mode [ 471.614706][T24444] 8021q: adding VLAN 0 to HW filter on device team0 [ 471.622331][T24444] dummy0: entered promiscuous mode [ 471.628769][T24444] dummy0: entered allmulticast mode [ 471.637967][T24444] nlmon0: entered promiscuous mode [ 471.643948][T24444] nlmon0: entered allmulticast mode [ 471.650916][T24444] caif0: entered promiscuous mode [ 471.656694][T24444] caif0: entered allmulticast mode [ 471.661878][T24444] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 472.011346][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 472.021713][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 472.032405][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 472.040447][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 472.049261][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 472.425334][T24470] gretap0 speed is unknown, defaulting to 1000 [ 472.445454][T24470] wlan0 speed is unknown, defaulting to 1000 [ 472.580866][T24499] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 472.761262][T24513] macvlan0: entered promiscuous mode [ 472.994701][T24530] mac80211_hwsim hwsim32 syzkaller0: left promiscuous mode [ 473.001946][T24530] mac80211_hwsim hwsim32 syzkaller0: left allmulticast mode [ 473.050953][T24537] sctp: [Deprecated]: syz.2.5946 (pid 24537) Use of int in max_burst socket option deprecated. [ 473.050953][T24537] Use struct sctp_assoc_value instead [ 473.066017][T24470] chnl_net:caif_netlink_parms(): no params data found [ 473.580074][T24470] bridge0: port 1(bridge_slave_0) entered blocking state [ 473.613483][T24470] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.647488][T24470] bridge_slave_0: entered allmulticast mode [ 473.667394][T24470] bridge_slave_0: entered promiscuous mode [ 473.718619][T24470] bridge0: port 2(bridge_slave_1) entered blocking state [ 473.742022][T24470] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.761763][T24470] bridge_slave_1: entered allmulticast mode [ 473.787742][T24470] bridge_slave_1: entered promiscuous mode [ 473.890221][T24470] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 473.900350][T24584] x_tables: duplicate entry at hook 3 [ 473.925484][T24470] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 474.071659][ T5846] Bluetooth: hci1: command tx timeout [ 474.089040][T24596] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.123218][T24470] team0: Port device team_slave_0 added [ 474.202123][T24596] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.247245][T24470] team0: Port device team_slave_1 added [ 474.271818][T24608] veth0: entered promiscuous mode [ 474.316716][T24596] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.343618][T24608] veth0: left promiscuous mode [ 474.350970][T24470] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 474.366216][T24470] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.394595][T24470] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 474.424823][T24596] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.466982][T24470] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 474.480683][T24470] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.511610][T24470] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 474.592342][ T1132] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 474.617731][ T1132] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 474.645070][T24470] hsr_slave_0: entered promiscuous mode [ 474.654779][T24470] hsr_slave_1: entered promiscuous mode [ 474.679070][ T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.727712][ T13] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.786589][ T6298] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.857695][T24639] block nbd0: reconnected socket [ 474.878015][ T6298] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.979967][ T5846] block nbd0: Receive control failed (result -32) [ 475.180106][T24470] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.198260][T24470] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.226199][T24654] syzkaller0: entered promiscuous mode [ 475.231697][T24654] syzkaller0: entered allmulticast mode [ 475.241672][T24654] netlink: 'syz.2.5983': attribute type 39 has an invalid length. [ 475.286231][T24470] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.298157][T24659] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 475.316291][T24661] __nla_validate_parse: 24 callbacks suppressed [ 475.316308][T24661] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5984'. [ 475.349147][T24470] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.359780][T24661] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5984'. [ 475.359848][T24661] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5984'. [ 475.465998][T24666] macvtap1: entered promiscuous mode [ 475.471497][T24666] macvtap1: entered allmulticast mode [ 475.480017][T24666] veth1_vlan: entered allmulticast mode [ 475.488968][T24670] batadv_slave_1: entered promiscuous mode [ 475.508108][T24672] macvtap2: entered promiscuous mode [ 475.514000][T24672] macvtap2: entered allmulticast mode [ 475.541187][T24470] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.558121][T24470] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.576065][T24669] batadv_slave_1: left promiscuous mode [ 475.655309][T24470] netdevsim netdevsim0 netdevsim0 (unregistering): left allmulticast mode [ 475.665690][T24470] bond0: (slave netdevsim0): Releasing backup interface [ 475.677079][T24470] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.688201][T24470] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.703529][T24681] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 475.725180][T24680] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 475.835147][T24685] netlink: 1 bytes leftover after parsing attributes in process `syz.3.5993'. [ 475.936528][T24687] netlink: 'syz.1.5994': attribute type 11 has an invalid length. [ 475.945817][T24687] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5994'. [ 475.994144][T24470] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 476.007739][T24470] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 476.033421][T24470] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 476.076265][T24470] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 476.144159][ T5846] Bluetooth: hci1: command tx timeout [ 476.177344][T24695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5996'. [ 476.219200][T24695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5996'. [ 476.253551][T24695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5996'. [ 476.333944][T24470] 8021q: adding VLAN 0 to HW filter on device bond0 [ 476.393484][T24470] 8021q: adding VLAN 0 to HW filter on device team0 [ 476.416100][T15634] bridge0: port 1(bridge_slave_0) entered blocking state [ 476.423282][T15634] bridge0: port 1(bridge_slave_0) entered forwarding state [ 476.452489][T15634] bridge0: port 2(bridge_slave_1) entered blocking state [ 476.459700][T15634] bridge0: port 2(bridge_slave_1) entered forwarding state [ 476.749361][T24470] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 476.889817][T24470] veth0_vlan: entered promiscuous mode [ 476.924822][T24470] veth1_vlan: entered promiscuous mode [ 476.946637][T24722] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6001'. [ 476.975770][T24723] netlink: 'syz.4.6000': attribute type 1 has an invalid length. [ 476.999315][T24725] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6001'. [ 477.013713][T24722] bond7: entered promiscuous mode [ 477.018926][T24722] bond7: entered allmulticast mode [ 477.025136][T24722] 8021q: adding VLAN 0 to HW filter on device bond7 [ 477.054004][T24725] bond7: (slave macvlan5): Opening slave failed [ 478.223237][ T5846] Bluetooth: hci1: command tx timeout [ 479.246069][T24726] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 479.292226][T24723] ip6tnl2: entered promiscuous mode [ 479.307163][T24723] ip6tnl2: entered allmulticast mode [ 479.358073][T24470] veth0_macvtap: entered promiscuous mode [ 479.405946][T24470] veth1_macvtap: entered promiscuous mode [ 479.445664][T24470] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 479.470495][T24735] batman_adv: batadv0: Interface deactivated: dummy0 [ 479.478070][T24735] batman_adv: batadv0: Removing interface: dummy0 [ 479.500593][T24735] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 479.581600][T24470] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 479.606742][ T6252] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.637368][ T6252] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.658368][ T6252] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.707784][ T6252] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.937178][T24762] pim6reg1: entered promiscuous mode [ 479.942506][T24762] pim6reg1: entered allmulticast mode [ 479.968421][T24769] netlink: 'syz.4.6010': attribute type 1 has an invalid length. [ 480.097305][T24762] netlink: 'syz.1.6011': attribute type 1 has an invalid length. [ 480.105768][T24773] netlink: 'syz.1.6011': attribute type 1 has an invalid length. [ 480.128531][T24772] bond5: (slave gretap4): making interface the new active one [ 480.141166][T24772] bond5: (slave gretap4): Enslaving as an active interface with an up link [ 480.210176][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.228417][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 480.272229][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.284530][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 480.304238][ T5846] Bluetooth: hci1: command tx timeout [ 480.387093][T24789] __nla_validate_parse: 5 callbacks suppressed [ 480.387116][T24789] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6015'. [ 480.414644][T24794] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6012'. [ 480.421457][T24789] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6015'. [ 480.434070][T24794] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6012'. [ 480.536992][T24799] netlink: 'syz.0.6017': attribute type 1 has an invalid length. [ 480.641601][T24804] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6017'. [ 480.659870][T24799] bond1 (unregistering): Released all slaves [ 480.705843][T24806] tipc: Enabled bearer , priority 0 [ 480.814465][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 480.826668][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 480.827200][T24806] syzkaller0: entered promiscuous mode [ 480.834493][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 480.849449][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 480.858922][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 480.903719][T24806] syzkaller0: entered allmulticast mode [ 480.913896][T24806] tipc: Resetting bearer [ 480.976977][T24805] tipc: Resetting bearer [ 481.144681][T24819] sctp: [Deprecated]: syz.2.6022 (pid 24819) Use of int in max_burst socket option. [ 481.144681][T24819] Use struct sctp_assoc_value instead [ 481.171698][T15634] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x41 [ 481.175088][T24821] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6024'. [ 481.185342][T24819] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6022'. [ 481.207812][T24813] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6022'. [ 481.233990][T24822] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6024'. [ 482.475362][T24805] tipc: Disabling bearer [ 482.494518][T24831] bridge0: left allmulticast mode [ 482.517179][T24832] bridge0: entered allmulticast mode [ 482.538298][T24832] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 482.599996][T24808] gretap0 speed is unknown, defaulting to 1000 [ 482.647312][T24808] wlan0 speed is unknown, defaulting to 1000 [ 482.711178][T24837] netlink: 'syz.2.6029': attribute type 1 has an invalid length. [ 482.769393][T24837] bond0: (slave gretap1): making interface the new active one [ 482.778391][T24837] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 482.902372][T24852] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6035'. [ 482.914247][T24848] FAULT_INJECTION: forcing a failure. [ 482.914247][T24848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 482.929217][T24848] CPU: 1 UID: 0 PID: 24848 Comm: syz.2.6034 Not tainted syzkaller #0 PREEMPT(full) [ 482.929263][T24848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 482.929282][T24848] Call Trace: [ 482.929290][T24848] [ 482.929299][T24848] dump_stack_lvl+0x189/0x250 [ 482.929326][T24848] ? __pfx____ratelimit+0x10/0x10 [ 482.929344][T24848] ? __pfx_dump_stack_lvl+0x10/0x10 [ 482.929365][T24848] ? __pfx__printk+0x10/0x10 [ 482.929389][T24848] ? __might_fault+0xb0/0x130 [ 482.929422][T24848] should_fail_ex+0x414/0x560 [ 482.929449][T24848] _copy_to_iter+0x1de/0x1790 [ 482.929479][T24848] ? anon_pipe_read+0xd14/0x1040 [ 482.929500][T24848] ? __pfx__copy_to_iter+0x10/0x10 [ 482.929517][T24848] ? __pfx___mutex_lock+0x10/0x10 [ 482.929544][T24848] ? page_copy_sane+0x4e/0x280 [ 482.929564][T24848] copy_page_to_iter+0x10c/0x1c0 [ 482.929588][T24848] anon_pipe_read+0x4d1/0x1040 [ 482.929633][T24848] ? __pfx_anon_pipe_read+0x10/0x10 [ 482.929657][T24848] ? __pfx_autoremove_wake_function+0x10/0x10 [ 482.929695][T24848] do_iter_readv_writev+0x623/0x8c0 [ 482.929722][T24848] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 482.929739][T24848] ? common_file_perm+0x1b5/0x220 [ 482.929765][T24848] ? bpf_lsm_file_permission+0x9/0x20 [ 482.929784][T24848] ? security_file_permission+0x75/0x290 [ 482.929803][T24848] ? rw_verify_area+0x2a6/0x4d0 [ 482.929823][T24848] vfs_readv+0x253/0x850 [ 482.929846][T24848] ? __pfx_vfs_readv+0x10/0x10 [ 482.929882][T24848] ? __fget_files+0x2a/0x420 [ 482.929908][T24848] ? __fget_files+0x3a0/0x420 [ 482.929927][T24848] ? __fget_files+0x2a/0x420 [ 482.929957][T24848] do_readv+0x14d/0x2d0 [ 482.929980][T24848] ? __pfx_do_readv+0x10/0x10 [ 482.930004][T24848] ? do_syscall_64+0xbe/0xf80 [ 482.930026][T24848] do_syscall_64+0xfa/0xf80 [ 482.930045][T24848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.930062][T24848] ? clear_bhb_loop+0x60/0xb0 [ 482.930084][T24848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.930099][T24848] RIP: 0033:0x7f185758f749 [ 482.930115][T24848] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 482.930130][T24848] RSP: 002b:00007f18557f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 482.930149][T24848] RAX: ffffffffffffffda RBX: 00007f18577e5fa0 RCX: 00007f185758f749 [ 482.930169][T24848] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000003 [ 482.930180][T24848] RBP: 00007f18557f6090 R08: 0000000000000000 R09: 0000000000000000 [ 482.930191][T24848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 482.930202][T24848] R13: 00007f18577e6038 R14: 00007f18577e5fa0 R15: 00007ffc41c0c848 [ 482.930233][T24848] [ 483.202304][ T5846] Bluetooth: hci5: command tx timeout [ 483.448002][T24808] chnl_net:caif_netlink_parms(): no params data found [ 483.547198][T24872] netlink: Unknown conntrack attr (type=2304, max=9) [ 483.603552][T24874] tipc: Enabled bearer , priority 0 [ 483.636490][T24808] bridge0: port 1(bridge_slave_0) entered blocking state [ 483.646625][T24808] bridge0: port 1(bridge_slave_0) entered disabled state [ 483.653980][T24808] bridge_slave_0: entered allmulticast mode [ 483.661089][T24808] bridge_slave_0: entered promiscuous mode [ 483.671946][T24873] tipc: Disabling bearer [ 483.688075][T24808] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.695249][T24808] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.702511][T24808] bridge_slave_1: entered allmulticast mode [ 483.710210][T24808] bridge_slave_1: entered promiscuous mode [ 483.737013][T24879] syzkaller0: entered promiscuous mode [ 483.756767][T24879] syzkaller0: entered allmulticast mode [ 483.876303][T24808] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 483.895979][T24808] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 483.971955][T24808] team0: Port device team_slave_0 added [ 483.993467][T24808] team0: Port device team_slave_1 added [ 484.099115][T24808] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 484.107855][T24808] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 484.111695][T24898] netlink: 'syz.3.6048': attribute type 10 has an invalid length. [ 484.134232][T24808] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 484.136245][T24808] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 484.163413][T24808] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 484.190007][T24808] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 484.230722][T24898] team0: Device veth0_macvtap failed to register rx_handler [ 484.328495][T24900] gretap0 speed is unknown, defaulting to 1000 [ 484.338336][T24900] wlan0 speed is unknown, defaulting to 1000 [ 484.421994][T24904] netlink: 'syz.3.6051': attribute type 1 has an invalid length. [ 484.478885][T24808] hsr_slave_0: entered promiscuous mode [ 484.486008][T24808] hsr_slave_1: entered promiscuous mode [ 484.493904][T24808] debugfs: 'hsr0' already exists in 'hsr' [ 484.499710][T24808] Cannot create hsr debugfs directory [ 484.525670][T24911] tipc: Enabled bearer , priority 0 [ 484.580347][T24905] tipc: Disabling bearer [ 484.695003][T24926] netlink: 'syz.4.6055': attribute type 15 has an invalid length. [ 485.022385][T24936] netlink: 'syz.0.6057': attribute type 1 has an invalid length. [ 485.032675][T24936] netlink: 'syz.0.6057': attribute type 3 has an invalid length. [ 485.267855][ T5846] Bluetooth: hci5: command tx timeout [ 485.351045][T24808] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.366009][T24808] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.425052][T24962] tipc: Enabling of bearer rejected, already enabled [ 485.579827][T24969] __nla_validate_parse: 22 callbacks suppressed [ 485.579856][T24969] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6069'. [ 485.635080][T24808] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.652681][T24808] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.785644][T24808] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.800584][T24808] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.820475][T24979] veth1_macvtap: left promiscuous mode [ 485.853375][T24982] sock: sock_set_timeout: `syz.0.6071' (pid 24982) tries to set negative timeout [ 485.888582][T24808] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.936229][T24808] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.994027][T24991] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6074'. [ 486.178970][T25002] sctp: [Deprecated]: syz.4.6077 (pid 25002) Use of int in max_burst socket option. [ 486.178970][T25002] Use struct sctp_assoc_value instead [ 486.211757][T25002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6077'. [ 486.235059][T24808] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 486.267569][T24808] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 486.307856][T24808] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 486.316511][T25011] netlink: 168 bytes leftover after parsing attributes in process `syz.2.6080'. [ 486.348977][T24808] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 486.395802][T25013] tipc: Enabling of bearer rejected, already enabled [ 486.439316][T25013] mac80211_hwsim hwsim32 syzkaller0: entered promiscuous mode [ 486.473836][T25013] mac80211_hwsim hwsim32 syzkaller0: entered allmulticast mode [ 486.520555][T25026] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6083'. [ 486.586769][T25026] hsr_slave_0 (unregistering): left promiscuous mode [ 486.705726][T25036] netlink: 'syz.3.6087': attribute type 3 has an invalid length. [ 486.716281][T25036] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6087'. [ 486.829064][T24808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 486.945640][T24808] 8021q: adding VLAN 0 to HW filter on device team0 [ 486.958679][T25051] nft_compat: unsupported protocol 0 [ 486.971275][T15634] bridge0: port 1(bridge_slave_0) entered blocking state [ 486.978469][T15634] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.025481][T15634] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.032713][T15634] bridge0: port 2(bridge_slave_1) entered forwarding state [ 487.047956][T25054] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6091'. [ 487.077911][T25054] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6091'. [ 487.103853][T25054] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6091'. [ 487.111492][T24808] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 487.195281][T16742] IPVS: starting estimator thread 0... [ 487.196215][T25057] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 487.296189][T25060] IPVS: using max 29 ests per chain, 69600 per kthread [ 487.343328][ T5846] Bluetooth: hci5: command tx timeout [ 487.473966][T24808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 487.549214][T24808] veth0_vlan: entered promiscuous mode [ 487.585789][T24808] veth1_vlan: entered promiscuous mode [ 487.627284][T25082] tipc: Enabling of bearer rejected, failed to enable media [ 487.647778][T24808] veth0_macvtap: entered promiscuous mode [ 487.670534][T24808] veth1_macvtap: entered promiscuous mode [ 487.692604][T25085] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6104'. [ 487.697565][T24808] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 487.753865][T24808] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 487.887898][ T755] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.920452][ T755] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.975271][ T755] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.014527][ T755] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.166107][ T6298] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 488.195356][ T6298] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 488.284057][T25110] netlink: 'syz.0.6111': attribute type 1 has an invalid length. [ 488.297860][ T991] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 488.319069][ T991] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 488.647394][T25124] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 488.717564][T25124] bond1 (unregistering): Released all slaves [ 488.832414][T25139] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 488.849781][T25139] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.882586][T25140] netlink: 'syz.0.6120': attribute type 7 has an invalid length. [ 488.948158][T25139] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 488.983382][T25139] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.016301][T25142] mac80211_hwsim hwsim32 syzkaller0: left promiscuous mode [ 489.025967][T25142] mac80211_hwsim hwsim32 syzkaller0: left allmulticast mode [ 489.081239][T25137] netlink: 'syz.4.6119': attribute type 3 has an invalid length. [ 489.102937][T25139] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.128705][T25139] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.189379][T25139] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.199724][T25139] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.397579][ T751] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 489.412200][ T751] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.425144][ T5846] Bluetooth: hci5: command tx timeout [ 489.468401][ T50] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 489.477314][ T50] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.494977][T25170] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 489.654020][T25177] team0 (unregistering): Port device team_slave_0 removed [ 489.671008][T25177] team0 (unregistering): Port device team_slave_1 removed [ 489.699131][T25176] lo: entered promiscuous mode [ 489.704324][T25176] lo: entered allmulticast mode [ 489.709427][T25176] tunl0: entered promiscuous mode [ 489.715449][T25176] tunl0: entered allmulticast mode [ 489.720901][T25176] gre0: entered promiscuous mode [ 489.730477][T25176] gre0: entered allmulticast mode [ 489.737485][T25176] gretap0: entered promiscuous mode [ 489.748221][T25176] gretap0: entered allmulticast mode [ 489.754857][T25176] erspan0: entered promiscuous mode [ 489.769432][T25176] erspan0: entered allmulticast mode [ 489.784483][T25176] ip_vti0: entered promiscuous mode [ 489.800202][T25176] ip_vti0: entered allmulticast mode [ 489.810303][T25176] ip6_vti0: entered promiscuous mode [ 489.824402][T25176] ip6_vti0: entered allmulticast mode [ 489.829925][T25176] sit0: entered promiscuous mode [ 489.838383][T25176] sit0: entered allmulticast mode [ 489.854155][T25176] ip6tnl0: entered promiscuous mode [ 489.869602][T25176] ip6tnl0: entered allmulticast mode [ 489.882982][T25176] ip6gre0: entered promiscuous mode [ 489.898543][T25176] ip6gre0: entered allmulticast mode [ 489.910283][T25176] ip6gretap0: entered promiscuous mode [ 489.924477][T25176] ip6gretap0: entered allmulticast mode [ 489.934772][T25176] bridge0: entered promiscuous mode [ 489.939997][T25176] bridge0: entered allmulticast mode [ 489.961029][T25176] team0: entered promiscuous mode [ 489.969404][T25176] team0: entered allmulticast mode [ 489.984873][T25176] dummy0: entered promiscuous mode [ 490.000277][T25176] dummy0: entered allmulticast mode [ 490.018747][T25176] nlmon0: entered promiscuous mode [ 490.024575][T25176] nlmon0: entered allmulticast mode [ 490.031517][T25176] caif0: entered promiscuous mode [ 490.038884][T25176] caif0: entered allmulticast mode [ 490.044895][T25176] batadv0: entered promiscuous mode [ 490.050172][T25176] batadv0: entered allmulticast mode [ 490.055823][T25176] vxcan0: entered promiscuous mode [ 490.060952][T25176] vxcan0: entered allmulticast mode [ 490.066518][T25176] vxcan1: entered promiscuous mode [ 490.071636][T25176] vxcan1: entered allmulticast mode [ 490.077605][T25176] veth0: entered promiscuous mode [ 490.082691][T25176] veth0: entered allmulticast mode [ 490.088308][T25176] veth1: entered promiscuous mode [ 490.095870][T25176] veth1: entered allmulticast mode [ 490.101099][T25176] wg0: entered promiscuous mode [ 490.106829][T25176] wg0: entered allmulticast mode [ 490.111889][T25176] wg1: entered promiscuous mode [ 490.117001][T25176] wg1: entered allmulticast mode [ 490.122077][T25176] wg2: entered promiscuous mode [ 490.127090][T25176] wg2: entered allmulticast mode [ 490.132109][T25176] veth0_to_bridge: entered promiscuous mode [ 490.141544][T25176] veth0_to_bridge: entered allmulticast mode [ 490.148106][T25176] bridge_slave_0: entered promiscuous mode [ 490.154115][T25176] bridge_slave_0: entered allmulticast mode [ 490.160110][T25176] veth1_to_bridge: entered promiscuous mode [ 490.166506][T25176] veth1_to_bridge: entered allmulticast mode [ 490.172591][T25176] bridge_slave_1: entered promiscuous mode [ 490.178684][T25176] bridge_slave_1: entered allmulticast mode [ 490.184814][T25176] veth0_to_bond: entered promiscuous mode [ 490.190545][T25176] veth0_to_bond: entered allmulticast mode [ 490.198651][T25176] bond_slave_0: entered promiscuous mode [ 490.204358][T25176] bond_slave_0: entered allmulticast mode [ 490.210234][T25176] veth1_to_bond: entered promiscuous mode [ 490.216252][T25176] veth1_to_bond: entered allmulticast mode [ 490.222279][T25176] bond_slave_1: entered promiscuous mode [ 490.228514][T25176] bond_slave_1: entered allmulticast mode [ 490.234632][T25176] veth0_to_team: entered promiscuous mode [ 490.240359][T25176] veth0_to_team: entered allmulticast mode [ 490.246441][T25176] team_slave_0: entered promiscuous mode [ 490.252067][T25176] team_slave_0: entered allmulticast mode [ 490.258889][T25176] veth1_to_team: entered promiscuous mode [ 490.264713][T25176] veth1_to_team: entered allmulticast mode [ 490.270615][T25176] team_slave_1: entered promiscuous mode [ 490.276362][T25176] team_slave_1: entered allmulticast mode [ 490.282261][T25176] veth0_to_batadv: entered promiscuous mode [ 490.288914][T25176] veth0_to_batadv: entered allmulticast mode [ 490.297841][T25176] batadv_slave_0: entered promiscuous mode [ 490.305519][T25176] batadv_slave_0: entered allmulticast mode [ 490.311524][T25176] veth1_to_batadv: entered promiscuous mode [ 490.317978][T25176] veth1_to_batadv: entered allmulticast mode [ 490.324179][T25176] batadv_slave_1: entered promiscuous mode [ 490.330118][T25176] xfrm0: entered promiscuous mode [ 490.335263][T25176] xfrm0: entered allmulticast mode [ 490.340538][T25176] veth0_to_hsr: entered promiscuous mode [ 490.346783][T25176] veth0_to_hsr: entered allmulticast mode [ 490.352821][T25176] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 490.425175][ T991] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 490.453435][ T991] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.515754][ T991] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 490.534648][ T991] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.561502][T25203] netlink: 'syz.2.6140': attribute type 21 has an invalid length. [ 490.626441][T25204] netlink: 'syz.4.6139': attribute type 4 has an invalid length. [ 490.745222][T25213] __nla_validate_parse: 31 callbacks suppressed [ 490.745241][T25213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6143'. [ 490.798252][T25213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6143'. [ 490.830364][T25216] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6144'. [ 490.854650][T25213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6143'. [ 490.983408][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 490.993855][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 491.001993][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 491.017524][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 491.026280][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 491.129091][T25228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6148'. [ 491.146694][T25224] gretap0 speed is unknown, defaulting to 1000 [ 491.351584][T25224] wlan0 speed is unknown, defaulting to 1000 [ 491.379313][T25242] netlink: 'syz.1.6154': attribute type 21 has an invalid length. [ 491.398395][T25242] IPv6: NLM_F_CREATE should be specified when creating new route [ 491.478132][T25251] netlink: 'syz.0.6157': attribute type 10 has an invalid length. [ 491.535867][T25254] netlink: 'syz.0.6157': attribute type 21 has an invalid length. [ 491.778569][T25224] chnl_net:caif_netlink_parms(): no params data found [ 491.796754][T25264] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 491.811556][T25271] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6159'. [ 491.872160][T25264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6160'. [ 492.059438][T25224] bridge0: port 1(bridge_slave_0) entered blocking state [ 492.095096][T25224] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.113954][T25224] bridge_slave_0: entered allmulticast mode [ 492.122112][T25224] bridge_slave_0: entered promiscuous mode [ 492.136976][T25224] bridge0: port 2(bridge_slave_1) entered blocking state [ 492.163436][T25224] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.171057][T25224] bridge_slave_1: entered allmulticast mode [ 492.190671][T25224] bridge_slave_1: entered promiscuous mode [ 492.230954][T25289] netlink: 'syz.2.6164': attribute type 10 has an invalid length. [ 492.276795][T25289] batadv0: left promiscuous mode [ 492.290149][T25289] batadv0: left allmulticast mode [ 492.363512][T25224] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 492.447810][T25224] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 492.460166][T25312] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6171'. [ 492.480154][T25312] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6171'. [ 492.577190][T25316] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6172'. [ 492.589958][T25316] tc_dump_action: action bad kind [ 492.599853][T25224] team0: Port device team_slave_0 added [ 492.639756][T25224] team0: Port device team_slave_1 added [ 492.736271][T25224] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 492.744006][T25224] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 492.772146][T25224] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 492.818139][T25224] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 492.833201][T25224] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 492.864077][T25224] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 493.054571][T25349] netlink: 'syz.2.6182': attribute type 30 has an invalid length. [ 493.072522][T25224] hsr_slave_0: entered promiscuous mode [ 493.080595][T25224] hsr_slave_1: entered promiscuous mode [ 493.087220][T25224] debugfs: 'hsr0' already exists in 'hsr' [ 493.094054][T25224] Cannot create hsr debugfs directory [ 493.103450][ T5846] Bluetooth: hci3: command tx timeout [ 493.437029][T25367] atomic_op ffff888054ce8998 conn xmit_atomic 0000000000000000 [ 493.581013][T25224] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.602291][T25224] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.675358][T25224] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.687779][T25224] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.766302][T25224] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.780893][T25224] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.841528][T25224] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.852830][T25391] netlink: 'syz.2.6195': attribute type 1 has an invalid length. [ 493.857446][T25224] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.976819][T25224] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 493.990319][T25224] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 494.001940][T25224] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 494.014315][T25224] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 494.044265][T25401] ieee802154 phy0 wpan0: encryption failed: -22 [ 494.053261][T25401] netlink: 'syz.0.6197': attribute type 10 has an invalid length. [ 494.066921][T25401] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 494.181575][T25224] 8021q: adding VLAN 0 to HW filter on device bond0 [ 494.206175][T25224] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.220309][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.227461][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.258107][T15634] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.265320][T15634] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.521957][T25224] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 494.650181][T25224] veth0_vlan: entered promiscuous mode [ 494.672031][T25224] veth1_vlan: entered promiscuous mode [ 494.758444][T25224] veth0_macvtap: entered promiscuous mode [ 494.769828][T25224] veth1_macvtap: entered promiscuous mode [ 494.796157][T25224] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 494.872341][T25224] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 494.938022][ T991] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.986077][ T991] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.004455][ T991] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.031263][ T991] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.184262][ T5846] Bluetooth: hci3: command tx timeout [ 495.254367][T25461] netlink: 'syz.2.6214': attribute type 22 has an invalid length. [ 495.277097][T25462] netlink: 'syz.2.6214': attribute type 22 has an invalid length. [ 495.305786][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.325519][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.445000][ T991] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.465323][ T991] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.611456][T25481] netlink: 'syz.1.6221': attribute type 1 has an invalid length. [ 495.752315][T25487] syzkaller0: entered promiscuous mode [ 495.766745][T25487] syzkaller0: entered allmulticast mode [ 495.884771][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 495.894227][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 495.902166][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 495.919047][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 495.930357][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 495.992308][T25498] __nla_validate_parse: 15 callbacks suppressed [ 495.992326][T25498] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6226'. [ 496.055698][T25495] gretap0 speed is unknown, defaulting to 1000 [ 496.075085][T25499] netlink: 136 bytes leftover after parsing attributes in process `syz.3.6226'. [ 496.088530][T25495] wlan0 speed is unknown, defaulting to 1000 [ 496.205638][T25503] netlink: 384 bytes leftover after parsing attributes in process `syz.0.6228'. [ 496.525199][ T68] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.669489][ T68] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.691654][T25524] tipc: Enabled bearer , priority 0 [ 496.700894][T25524] syzkaller0: entered promiscuous mode [ 496.715418][T25524] syzkaller0: entered allmulticast mode [ 496.793463][ T68] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.812446][T25524] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 496.831903][T25495] chnl_net:caif_netlink_parms(): no params data found [ 496.867064][T25524] tipc: Resetting bearer [ 496.888465][T25524] xt_bpf: check failed: parse error [ 496.958102][ T68] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.008783][T25523] tipc: Resetting bearer [ 497.040858][T25523] tipc: Disabling bearer [ 497.263228][ T5846] Bluetooth: hci3: command tx timeout [ 497.328400][T25567] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6248'. [ 497.349370][T25567] chnl_net:caif_netlink_parms(): no params data found [ 497.436585][T25495] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.446900][T25570] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6249'. [ 497.448421][T25495] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.466932][T25495] bridge_slave_0: entered allmulticast mode [ 497.475963][T25495] bridge_slave_0: entered promiscuous mode [ 497.484314][T25570] netlink: 43 bytes leftover after parsing attributes in process `syz.3.6249'. [ 497.502506][T25570] netlink: 'syz.3.6249': attribute type 6 has an invalid length. [ 497.528106][T25570] netlink: 'syz.3.6249': attribute type 5 has an invalid length. [ 497.529599][T25495] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.545766][T25570] netlink: 43 bytes leftover after parsing attributes in process `syz.3.6249'. [ 497.575698][T25495] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.593460][T25495] bridge_slave_1: entered allmulticast mode [ 497.597473][T25576] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6252'. [ 497.607912][T25495] bridge_slave_1: entered promiscuous mode [ 497.729466][T25580] netlink: 184 bytes leftover after parsing attributes in process `syz.3.6253'. [ 497.750916][T25580] openvswitch: netlink: Flow key attr not present in new flow. [ 497.777611][T25580] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6253'. [ 497.890422][T25594] netlink: 'syz.2.6258': attribute type 11 has an invalid length. [ 497.964970][T25599] netlink: 'syz.1.6257': attribute type 1 has an invalid length. [ 497.986345][ T5846] Bluetooth: hci2: command tx timeout [ 498.132443][ T68] bond2 (unregistering): (slave gretap1): Releasing active interface [ 498.162492][ T68] bond5 (unregistering): (slave gretap4): Releasing active interface [ 498.212395][ T68] dvmrp0 (unregistering): left allmulticast mode [ 498.661680][ T68] bond0 (unregistering): Released all slaves [ 498.676037][ T68] bond1 (unregistering): Released all slaves [ 498.694119][ T68] bond2 (unregistering): Released all slaves [ 498.789964][ T68] bond3 (unregistering): Released all slaves [ 498.879936][ T68] bond4 (unregistering): Released all slaves [ 498.892412][ T68] bond5 (unregistering): Released all slaves [ 498.910661][T25495] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 498.927053][T25591] ip6gre1: entered allmulticast mode [ 498.956874][T25495] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 499.123072][ T68] tipc: Disabling bearer [ 499.153338][ T68] tipc: Disabling bearer [ 499.189705][ T68] tipc: Left network mode [ 499.260155][T25612] bond1: entered promiscuous mode [ 499.266504][T25612] bond1: entered allmulticast mode [ 499.272230][T25612] 8021q: adding VLAN 0 to HW filter on device bond1 [ 499.326041][T25619] bond1: (slave macvlan2): Opening slave failed [ 499.343117][ T5846] Bluetooth: hci3: command tx timeout [ 499.346914][T25627] workqueue: Failed to create a rescuer kthread for wq "bond13": -EINTR [ 499.350933][T25628] workqueue: Failed to create a rescuer kthread for wq "bond13": -EINTR [ 499.369127][T25637] netlink: 'syz.3.6270': attribute type 12 has an invalid length. [ 499.400985][T25495] team0: Port device team_slave_0 added [ 499.455175][T25637] bond1: option primary_reselect: invalid value (255) [ 499.464209][T25637] bond1 (unregistering): Released all slaves [ 499.494324][T25495] team0: Port device team_slave_1 added [ 499.644850][T25650] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 499.814724][T25495] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 499.832698][T25495] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.909791][T25495] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.940584][T25495] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.949443][T25495] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.977767][T25495] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 500.027611][T25670] netlink: 'syz.2.6279': attribute type 1 has an invalid length. [ 500.064067][ T5846] Bluetooth: hci2: command tx timeout [ 500.081792][T25671] netlink: 'syz.1.6278': attribute type 1 has an invalid length. [ 500.093621][T25671] netlink: 'syz.1.6278': attribute type 1 has an invalid length. [ 500.101958][T25671] netlink: 'syz.1.6278': attribute type 1 has an invalid length. [ 500.110610][T25671] netlink: 'syz.1.6278': attribute type 2 has an invalid length. [ 500.173566][T25670] bond13: entered promiscuous mode [ 500.179166][T25670] 8021q: adding VLAN 0 to HW filter on device bond13 [ 500.225727][T25672] bond13: (slave bridge2): making interface the new active one [ 500.253348][T25672] bridge2: entered promiscuous mode [ 500.259716][T25672] bond13: (slave bridge2): Enslaving as an active interface with an up link [ 500.319185][T25677] bond2: entered promiscuous mode [ 500.324579][T25677] bond2: entered allmulticast mode [ 500.334096][T25677] 8021q: adding VLAN 0 to HW filter on device bond2 [ 500.404279][T25681] bond2: (slave macvlan2): Opening slave failed [ 500.512403][ T68] hsr_slave_0: left promiscuous mode [ 500.519620][ T68] hsr_slave_1: left promiscuous mode [ 500.532386][ T68] veth1_macvtap: left promiscuous mode [ 500.539950][ T68] veth0_macvtap: left promiscuous mode [ 501.109628][T25495] hsr_slave_0: entered promiscuous mode [ 501.117272][T25495] hsr_slave_1: entered promiscuous mode [ 501.123926][T25495] debugfs: 'hsr0' already exists in 'hsr' [ 501.129731][T25495] Cannot create hsr debugfs directory [ 501.303950][T25694] netlink: 'syz.2.6285': attribute type 4 has an invalid length. [ 501.356141][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.453890][T25710] __nla_validate_parse: 10 callbacks suppressed [ 501.453908][T25710] netlink: 228 bytes leftover after parsing attributes in process `syz.3.6288'. [ 501.761862][T25726] IPVS: set_ctl: invalid protocol: 43 224.0.0.2:20002 [ 501.801340][T25728] openvswitch: netlink: IP tunnel dst address not specified [ 501.919078][T25734] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6297'. [ 501.966520][T25736] FAULT_INJECTION: forcing a failure. [ 501.966520][T25736] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 501.971291][T25738] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6299'. [ 501.987583][T25736] CPU: 0 UID: 0 PID: 25736 Comm: syz.0.6298 Not tainted syzkaller #0 PREEMPT(full) [ 501.987608][T25736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 501.987619][T25736] Call Trace: [ 501.987627][T25736] [ 501.987635][T25736] dump_stack_lvl+0x189/0x250 [ 501.987660][T25736] ? __pfx____ratelimit+0x10/0x10 [ 501.987679][T25736] ? __pfx_dump_stack_lvl+0x10/0x10 [ 501.987698][T25736] ? __pfx__printk+0x10/0x10 [ 501.987722][T25736] ? __might_fault+0xb0/0x130 [ 501.987758][T25736] should_fail_ex+0x414/0x560 [ 501.987787][T25736] _copy_from_iter+0x1cd/0x1630 [ 501.987804][T25736] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 501.987832][T25736] ? policy_nodemask+0x27c/0x720 [ 501.987852][T25736] ? __pfx__copy_from_iter+0x10/0x10 [ 501.987876][T25736] ? set_page_refcounted+0xa0/0x1e0 [ 501.987896][T25736] ? page_copy_sane+0x4e/0x280 [ 501.987916][T25736] copy_page_from_iter+0xdd/0x170 [ 501.987938][T25736] tun_get_user+0x1d40/0x3dc0 [ 501.987963][T25736] ? tun_get_user+0x6fc/0x3dc0 [ 501.987994][T25736] ? aa_file_perm+0x44c/0x1530 [ 501.988017][T25736] ? __pfx_tun_get_user+0x10/0x10 [ 501.988039][T25736] ? __lock_acquire+0x6b6/0x2cf0 [ 501.988060][T25736] ? kstrtoull+0x12f/0x1d0 [ 501.988091][T25736] ? ref_tracker_alloc+0x318/0x460 [ 501.988111][T25736] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 501.988134][T25736] ? tun_get+0x1c/0x2f0 [ 501.988159][T25736] ? tun_get+0x1c/0x2f0 [ 501.988177][T25736] ? tun_get+0x1c/0x2f0 [ 501.988201][T25736] tun_chr_write_iter+0x113/0x200 [ 501.988224][T25736] vfs_write+0x5c9/0xb30 [ 501.988245][T25736] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 501.988267][T25736] ? __pfx_vfs_write+0x10/0x10 [ 501.988293][T25736] ? __fget_files+0x2a/0x420 [ 501.988322][T25736] ksys_write+0x145/0x250 [ 501.988342][T25736] ? __pfx_ksys_write+0x10/0x10 [ 501.988362][T25736] ? do_syscall_64+0xbe/0xf80 [ 501.988384][T25736] do_syscall_64+0xfa/0xf80 [ 501.988402][T25736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.988419][T25736] ? clear_bhb_loop+0x60/0xb0 [ 501.988440][T25736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.988457][T25736] RIP: 0033:0x7fd876b8e1ff [ 501.988473][T25736] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 501.988487][T25736] RSP: 002b:00007fd877b06000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 501.988506][T25736] RAX: ffffffffffffffda RBX: 00007fd876de5fa0 RCX: 00007fd876b8e1ff [ 501.988518][T25736] RDX: 000000000000004a RSI: 0000200000000000 RDI: 00000000000000c8 [ 501.988529][T25736] RBP: 00007fd877b06090 R08: 0000000000000000 R09: 0000000000000000 [ 501.988540][T25736] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000001 [ 501.988551][T25736] R13: 00007fd876de6038 R14: 00007fd876de5fa0 R15: 00007ffc18d4ec78 [ 501.988586][T25736] [ 502.093977][T25739] x_tables: unsorted entry at hook 1 [ 502.201738][ T5846] Bluetooth: hci2: command tx timeout [ 502.287422][T25739] openvswitch: netlink: Missing valid actions attribute. [ 502.314027][T25739] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 502.350183][T25748] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6303'. [ 502.534153][T25495] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 502.576996][T25495] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 502.606179][T25761] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 502.615848][T25495] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 502.653383][T25495] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 502.705406][T25766] veth0_to_bridge: entered promiscuous mode [ 502.792003][T25774] veth0_to_bridge: left promiscuous mode [ 502.925299][T25495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 502.936678][T25786] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 502.979231][T25495] 8021q: adding VLAN 0 to HW filter on device team0 [ 503.019631][ T6252] bridge0: port 1(bridge_slave_0) entered blocking state [ 503.026835][ T6252] bridge0: port 1(bridge_slave_0) entered forwarding state [ 503.048193][ T6252] bridge0: port 2(bridge_slave_1) entered blocking state [ 503.055403][ T6252] bridge0: port 2(bridge_slave_1) entered forwarding state [ 503.160148][T25797] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6318'. [ 503.250738][T25803] netlink: 1 bytes leftover after parsing attributes in process `syz.3.6320'. [ 503.335440][T25808] netlink: 96 bytes leftover after parsing attributes in process `syz.0.6322'. [ 503.360312][T25808] 8021q: VLANs not supported on gre0 [ 503.491752][T25495] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 503.526743][T25818] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6325'. [ 504.089459][T25495] veth0_vlan: entered promiscuous mode [ 504.100137][T25856] validate_nla: 3 callbacks suppressed [ 504.100154][T25856] netlink: 'syz.0.6337': attribute type 10 has an invalid length. [ 504.130709][T25495] veth1_vlan: entered promiscuous mode [ 504.226700][T25495] veth0_macvtap: entered promiscuous mode [ 504.244056][T25495] veth1_macvtap: entered promiscuous mode [ 504.254196][T25857] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6335'. [ 504.264256][T25865] netlink: 'syz.3.6339': attribute type 4 has an invalid length. [ 504.281632][T25857] xfrm1: entered promiscuous mode [ 504.287515][T25857] xfrm1: entered allmulticast mode [ 504.298183][T25857] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6335'. [ 504.303477][ T5846] Bluetooth: hci2: command tx timeout [ 504.325892][T25495] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 504.358898][T25495] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 504.388001][T25869] C: renamed from lo (while UP) [ 504.400178][T25869] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 504.428287][T25871] tipc: Enabling of bearer rejected, failed to enable media [ 504.439645][ T6062] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.463229][ T6062] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.472203][ T6062] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.504717][ T6062] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.675137][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 504.695459][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 504.727392][T25881] netlink: 'syz.2.6344': attribute type 11 has an invalid length. [ 504.735986][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 504.736009][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 505.005764][T25902] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1500) ! [ 505.231331][T25911] bond14: Unable to set down delay as MII monitoring is disabled [ 505.250554][T25911] bond14 (unregistering): Released all slaves [ 505.251763][T25921] netlink: 'syz.0.6353': attribute type 15 has an invalid length. [ 505.296393][T25919] tipc: Started in network mode [ 505.301488][T25919] tipc: Node identity 76e8dd230e3f, cluster identity 4711 [ 505.311626][T25919] tipc: Enabled bearer , priority 0 [ 505.414281][T25919] syzkaller0: entered promiscuous mode [ 505.420292][T25919] syzkaller0: entered allmulticast mode [ 505.433952][T25919] tipc: Resetting bearer [ 505.595005][ T68] tipc: Resetting bearer [ 505.629868][T25918] tipc: Resetting bearer [ 506.116232][T25959] sctp: [Deprecated]: syz.0.6366 (pid 25959) Use of int in max_burst socket option deprecated. [ 506.116232][T25959] Use struct sctp_assoc_value instead [ 507.173387][T25918] tipc: Disabling bearer [ 507.192493][T25950] syzkaller0: entered promiscuous mode [ 507.212307][T25950] syzkaller0: entered allmulticast mode [ 507.225876][T25961] veth1_macvtap: left promiscuous mode [ 507.243283][T25961] macsec0: entered promiscuous mode [ 507.248543][T25961] macsec0: entered allmulticast mode [ 507.267950][T25962] veth1_macvtap: entered promiscuous mode [ 507.303283][T25962] veth1_macvtap: entered allmulticast mode [ 507.309346][T25962] macsec0: left promiscuous mode [ 507.323210][T25962] macsec0: left allmulticast mode [ 507.328264][T25962] veth1_macvtap: left allmulticast mode [ 507.346711][ T6567] tipc: Node number set to 2027412771 [ 507.647980][T25984] tipc: Enabling of bearer rejected, failed to enable media [ 507.676364][T25989] openvswitch: netlink: Unexpected mask (mask=2020040, allowed=2010048) [ 507.784397][T25997] xt_CONNSECMARK: invalid mode: 0 [ 507.980592][T26004] syzkaller0: entered promiscuous mode [ 507.988492][T26004] syzkaller0: entered allmulticast mode [ 508.000541][T26006] vlan2: entered promiscuous mode [ 508.005820][T26006] bridge0: entered promiscuous mode [ 508.047541][T26008] __nla_validate_parse: 6 callbacks suppressed [ 508.047554][T26008] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6382'. [ 508.098630][T26011] netlink: zone id is out of range [ 508.104141][T26011] netlink: zone id is out of range [ 508.110013][T26011] netlink: zone id is out of range [ 508.118511][T26011] netlink: get zone limit has 4 unknown bytes [ 508.464768][T26029] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6388'. [ 508.639396][T26036] netlink: 'syz.0.6390': attribute type 1 has an invalid length. [ 508.658254][T26038] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6389'. [ 508.845399][T26047] netlink: 45 bytes leftover after parsing attributes in process `syz.0.6393'. [ 510.073559][T26056] netlink: 'syz.0.6397': attribute type 11 has an invalid length. [ 510.080710][T26054] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6396'. [ 510.090654][T26056] netlink: 244 bytes leftover after parsing attributes in process `syz.0.6397'. [ 510.117429][T26056] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6397'. [ 510.147765][T26060] syzkaller0: entered promiscuous mode [ 510.153538][T26060] syzkaller0: entered allmulticast mode [ 510.175014][T26060] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 510.189231][T26063] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6400'. [ 510.259961][T26067] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6400'. [ 510.414758][T26077] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6406'. [ 510.449098][T26074] Bluetooth: MGMT ver 1.23 [ 510.715154][T26096] tipc: Started in network mode [ 510.728729][T26096] tipc: Node identity 46ab4b4866e9, cluster identity 4711 [ 510.747541][T26096] tipc: Enabled bearer , priority 0 [ 510.882064][T26101] syzkaller0: entered promiscuous mode [ 510.896006][T26101] syzkaller0: entered allmulticast mode [ 510.909586][T26101] tipc: Resetting bearer [ 510.971890][T26095] tipc: Resetting bearer [ 511.129619][ T6062] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 512.440754][T26095] tipc: Disabling bearer [ 512.461237][ T5900] tipc: Node number set to 541215560 [ 513.201849][T26180] __nla_validate_parse: 9 callbacks suppressed [ 513.201869][T26180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6434'. [ 513.222869][T26180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6434'. [ 513.429168][T26190] netlink: 256 bytes leftover after parsing attributes in process `syz.1.6437'. [ 513.517027][T26193] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6438'. [ 516.150181][T26208] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6444'. [ 516.162296][T26210] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.6443'. [ 516.177078][T26212] netlink: 144 bytes leftover after parsing attributes in process `syz.4.6442'. [ 516.197792][T26213] netlink: 'syz.0.6446': attribute type 7 has an invalid length. [ 516.220495][T26213] netlink: 'syz.0.6446': attribute type 27 has an invalid length. [ 516.228772][T26216] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.6443'. [ 516.255008][T26217] netlink: 'syz.1.6445': attribute type 62 has an invalid length. [ 516.441046][T26225] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 516.571370][T26236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6454'. [ 516.605724][T26236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6454'. [ 516.768056][T26244] 8021q: adding VLAN 0 to HW filter on device bond14 [ 516.790169][T26248] ieee802154 phy0 wpan0: encryption failed: -22 [ 516.826153][T26248] ieee802154 phy0 wpan0: encryption failed: -22 [ 516.939274][T26258] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 517.117728][T26266] netlink: 'syz.0.6465': attribute type 1 has an invalid length. [ 517.194228][T26275] bridge_slave_1: left allmulticast mode [ 517.199954][T26275] bridge_slave_1: left promiscuous mode [ 517.206325][T26275] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.258893][T26279] netlink: 'syz.3.6469': attribute type 1 has an invalid length. [ 517.275326][T26275] bridge_slave_0: left allmulticast mode [ 517.280992][T26275] bridge_slave_0: left promiscuous mode [ 517.287556][T26275] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.465833][T26292] batadv_slave_0: entered promiscuous mode [ 517.646950][T26305] FAULT_INJECTION: forcing a failure. [ 517.646950][T26305] name failslab, interval 1, probability 0, space 0, times 0 [ 517.672768][T26305] CPU: 0 UID: 0 PID: 26305 Comm: syz.1.6479 Not tainted syzkaller #0 PREEMPT(full) [ 517.672792][T26305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 517.672801][T26305] Call Trace: [ 517.672810][T26305] [ 517.672817][T26305] dump_stack_lvl+0x189/0x250 [ 517.672842][T26305] ? __pfx____ratelimit+0x10/0x10 [ 517.672857][T26305] ? __pfx_dump_stack_lvl+0x10/0x10 [ 517.672877][T26305] ? __pfx__printk+0x10/0x10 [ 517.672912][T26305] should_fail_ex+0x414/0x560 [ 517.672943][T26305] should_failslab+0xa8/0x100 [ 517.672965][T26305] __kmalloc_cache_noprof+0x84/0x700 [ 517.672981][T26305] ? fib_table_insert+0x4b1/0x1b80 [ 517.672997][T26305] ? fib_magic+0x2c4/0x390 [ 517.673014][T26305] ? fib_modify_prefix_metric+0x201/0x3a0 [ 517.673033][T26305] ? nsim_fib_event_nb+0x187/0x1080 [ 517.673053][T26305] ? rtnetlink_rcv_msg+0x7cf/0xb70 [ 517.673076][T26305] ? netlink_rcv_skb+0x208/0x470 [ 517.673099][T26305] nsim_fib_event_nb+0x187/0x1080 [ 517.673134][T26305] notifier_call_chain+0x19d/0x3a0 [ 517.673159][T26305] ? atomic_notifier_call_chain+0x26/0x180 [ 517.673181][T26305] atomic_notifier_call_chain+0xda/0x180 [ 517.673209][T26305] call_fib_notifiers+0x31/0x60 [ 517.673232][T26305] call_fib_entry_notifiers+0x14b/0x1f0 [ 517.673255][T26305] ? __pfx_call_fib_entry_notifiers+0x10/0x10 [ 517.673279][T26305] ? rcu_is_watching+0x15/0xb0 [ 517.673298][T26305] ? fib_insert_alias+0xd7f/0x10b0 [ 517.673315][T26305] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 517.673338][T26305] ? lockdep_rtnl_is_held+0x26/0x40 [ 517.673360][T26305] ? fib_table_insert+0x4b1/0x1b80 [ 517.673383][T26305] fib_table_insert+0xcc1/0x1b80 [ 517.673430][T26305] fib_magic+0x2c4/0x390 [ 517.673456][T26305] ? __pfx_fib_magic+0x10/0x10 [ 517.673491][T26305] ? __pfx_call_rcu+0x10/0x10 [ 517.673519][T26305] fib_modify_prefix_metric+0x201/0x3a0 [ 517.673547][T26305] inet_rtm_newaddr+0x111d/0x18b0 [ 517.673579][T26305] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 517.673620][T26305] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 517.673640][T26305] rtnetlink_rcv_msg+0x7cf/0xb70 [ 517.673663][T26305] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 517.673681][T26305] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 517.673698][T26305] ? ref_tracker_free+0x63a/0x7d0 [ 517.673717][T26305] ? __asan_memcpy+0x40/0x70 [ 517.673734][T26305] ? __pfx_ref_tracker_free+0x10/0x10 [ 517.673763][T26305] netlink_rcv_skb+0x208/0x470 [ 517.673787][T26305] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 517.673808][T26305] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 517.673842][T26305] ? netlink_deliver_tap+0x2e/0x1b0 [ 517.673873][T26305] netlink_unicast+0x82f/0x9e0 [ 517.673904][T26305] ? __pfx_netlink_unicast+0x10/0x10 [ 517.673926][T26305] ? netlink_sendmsg+0x642/0xb30 [ 517.673946][T26305] ? skb_put+0x11b/0x210 [ 517.673970][T26305] netlink_sendmsg+0x805/0xb30 [ 517.674003][T26305] ? __pfx_netlink_sendmsg+0x10/0x10 [ 517.674029][T26305] ? aa_sock_msg_perm+0xf1/0x1b0 [ 517.674053][T26305] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 517.674075][T26305] ? __pfx_netlink_sendmsg+0x10/0x10 [ 517.674098][T26305] __sock_sendmsg+0x21c/0x270 [ 517.674127][T26305] ____sys_sendmsg+0x505/0x820 [ 517.674155][T26305] ? __pfx_____sys_sendmsg+0x10/0x10 [ 517.674187][T26305] ? import_iovec+0x74/0xa0 [ 517.674212][T26305] ___sys_sendmsg+0x21f/0x2a0 [ 517.674236][T26305] ? __pfx____sys_sendmsg+0x10/0x10 [ 517.674265][T26305] ? rcu_read_lock_any_held+0xb3/0x120 [ 517.674317][T26305] ? __fget_files+0x2a/0x420 [ 517.674338][T26305] ? __fget_files+0x3a0/0x420 [ 517.674371][T26305] __x64_sys_sendmsg+0x19b/0x260 [ 517.674396][T26305] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 517.674427][T26305] ? __pfx_ksys_write+0x10/0x10 [ 517.674450][T26305] ? do_syscall_64+0xbe/0xf80 [ 517.674473][T26305] do_syscall_64+0xfa/0xf80 [ 517.674493][T26305] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.674511][T26305] ? clear_bhb_loop+0x60/0xb0 [ 517.674533][T26305] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.674558][T26305] RIP: 0033:0x7f097878f749 [ 517.674577][T26305] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 517.674593][T26305] RSP: 002b:00007f097967c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 517.674613][T26305] RAX: ffffffffffffffda RBX: 00007f09789e5fa0 RCX: 00007f097878f749 [ 517.674627][T26305] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 517.674639][T26305] RBP: 00007f097967c090 R08: 0000000000000000 R09: 0000000000000000 [ 517.674655][T26305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 517.674666][T26305] R13: 00007f09789e6038 R14: 00007f09789e5fa0 R15: 00007ffd6c255d78 [ 517.674698][T26305] [ 518.260560][T26316] __nla_validate_parse: 12 callbacks suppressed [ 518.260580][T26316] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6482'. [ 518.302989][T26319] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6483'. [ 518.316176][T26313] netlink: 'syz.0.6481': attribute type 1 has an invalid length. [ 518.324032][T26313] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6481'. [ 518.337396][T26319] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6483'. [ 518.338648][T26289] batadv_slave_0: left promiscuous mode [ 518.390233][T26313] netlink: 14 bytes leftover after parsing attributes in process `syz.0.6481'. [ 518.421294][T26323] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6485'. [ 518.664445][T26340] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6491'. [ 518.852441][T26357] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6496'. [ 518.872973][T26357] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6496'. [ 519.006785][T26368] netlink: 'syz.4.6500': attribute type 1 has an invalid length. [ 519.030894][T26369] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6502'. [ 519.080876][T26368] 8021q: adding VLAN 0 to HW filter on device bond1 [ 519.117730][T26374] bond1: (slave veth0_to_bond): making interface the new active one [ 519.154108][T26374] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 519.239663][T26380] tap0: tun_chr_ioctl cmd 1074025678 [ 519.245631][T26380] tap0: group set to 0 [ 519.930381][T26431] netlink: 'syz.4.6522': attribute type 5 has an invalid length. [ 519.985407][T26439] netlink: 'syz.1.6523': attribute type 2 has an invalid length. [ 520.329507][T26461] netlink: 'syz.4.6528': attribute type 2 has an invalid length. [ 520.626480][ T5846] Bluetooth: hci2: command tx timeout [ 521.120088][T26494] netlink: 'syz.4.6538': attribute type 11 has an invalid length. [ 521.138858][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 521.161612][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 521.172400][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 521.181571][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 521.192237][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 521.239933][T26491] gretap0 speed is unknown, defaulting to 1000 [ 521.250512][T26491] wlan0 speed is unknown, defaulting to 1000 [ 521.528063][T26513] validate_nla: 1 callbacks suppressed [ 521.528081][T26513] netlink: 'syz.4.6544': attribute type 16 has an invalid length. [ 521.815934][T26528] tipc: Started in network mode [ 521.820840][T26528] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 521.837575][T26528] tipc: Enabled bearer , priority 10 [ 522.316223][T26535] ------------[ cut here ]------------ [ 522.321784][T26535] WARNING: net/core/skbuff.c:7243 at skb_attempt_defer_free+0x572/0x6d0, CPU#1: syz.4.6550/26535 [ 522.332490][T26535] Modules linked in: [ 522.337045][T26535] CPU: 1 UID: 0 PID: 26535 Comm: syz.4.6550 Not tainted syzkaller #0 PREEMPT(full) [ 522.347724][T26535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 522.359565][T26535] RIP: 0010:skb_attempt_defer_free+0x572/0x6d0 [ 522.367390][T26535] Code: ff e8 72 c4 8f f8 90 0f 0b 90 e9 a8 fb ff ff e8 64 c4 8f f8 eb 85 e8 5d c4 8f f8 90 0f 0b 90 e9 94 fc ff ff e8 4f c4 8f f8 90 <0f> 0b 90 e9 af fc ff ff e8 41 c4 8f f8 90 0f 0b 90 e9 da fc ff ff [ 522.388085][T26535] RSP: 0018:ffffc9000c427400 EFLAGS: 00010287 [ 522.396153][T26535] RAX: ffffffff8931ee01 RBX: ffff888044538a00 RCX: 0000000000080000 [ 522.404948][T26535] RDX: ffffc90010e1a000 RSI: 0000000000011bb6 RDI: 0000000000011bb7 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 522.413721][T26535] RBP: ffffc9000c4274b0 R08: ffffffff8f822177 R09: 1ffffffff1f0442e [ 522.423199][T26535] R10: dffffc0000000000 R11: fffffbfff1f0442f R12: 0000000000000000 [ 522.431456][T26535] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888044538a60 [ 522.440580][T26535] FS: 00007f2ca73d56c0(0000) GS:ffff888125f35000(0000) knlGS:0000000000000000 [ 522.449580][T26535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 522.457025][T26535] CR2: 00007f0979639f98 CR3: 0000000069130000 CR4: 00000000003526f0 [ 522.466830][T26535] Call Trace: [ 522.470122][T26535] [ 522.473141][T26535] ? __lock_acquire+0x6b6/0x2cf0 [ 522.478102][T26535] ? __pfx_skb_attempt_defer_free+0x10/0x10 [ 522.484085][T26535] ? skb_consume_udp+0x90/0x260 [ 522.488968][T26535] udp_recvmsg+0xdb0/0x1050 [ 522.493584][T26535] ? __pfx_udp_recvmsg+0x10/0x10 [ 522.498564][T26535] ? udp_bpf_recvmsg+0xe7/0xda0 [ 522.503527][T26535] udp_bpf_recvmsg+0xb84/0xda0 [ 522.508323][T26535] ? udp_bpf_recvmsg+0xe7/0xda0 [ 522.513292][T26535] ? get_page_from_freelist+0x2365/0x2440 [ 522.519038][T26535] ? __pfx___might_resched+0x10/0x10 [ 522.524454][T26535] ? __pfx_udp_bpf_recvmsg+0x10/0x10 [ 522.529765][T26535] ? aa_sk_perm+0x15f/0x920 [ 522.534400][T26535] ? aa_sk_perm+0x7ee/0x920 [ 522.538922][T26535] ? sock_rps_record_flow+0x19/0x410 [ 522.544410][T26535] ? __pfx_udp_bpf_recvmsg+0x10/0x10 [ 522.550444][T26535] inet_recvmsg+0x24a/0x250 [ 522.555728][T26535] ? __pfx_inet_recvmsg+0x10/0x10 [ 522.560776][T26535] ? __lock_acquire+0x6b6/0x2cf0 [ 522.565823][T26535] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 522.571183][T26535] ? security_socket_recvmsg+0x7e/0x2e0 [ 522.576940][T26535] sock_recvmsg+0x1a8/0x270 [ 522.581487][T26535] ____sys_recvmsg+0x1c9/0x460 [ 522.586367][T26535] ? __pfx_____sys_recvmsg+0x10/0x10 [ 522.591738][T26535] ? import_iovec+0x74/0xa0 [ 522.596366][T26535] ___sys_recvmsg+0x1b5/0x510 [ 522.601087][T26535] ? __pfx____sys_recvmsg+0x10/0x10 [ 522.606499][T26535] ? __fget_files+0x3a0/0x420 [ 522.611319][T26535] do_recvmmsg+0x307/0x770 [ 522.615879][T26535] ? __pfx_do_recvmmsg+0x10/0x10 [ 522.620830][T26535] ? handle_mm_fault+0xdb/0x32b0 [ 522.626075][T26535] __x64_sys_recvmmsg+0x190/0x240 [ 522.631889][T26535] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 522.637609][T26535] ? do_syscall_64+0xbe/0xf80 [ 522.642329][T26535] do_syscall_64+0xfa/0xf80 [ 522.646936][T26535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.653781][T26535] ? clear_bhb_loop+0x60/0xb0 [ 522.658489][T26535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.665120][T26535] RIP: 0033:0x7f2ca918f749 [ 522.669556][T26535] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 522.689330][T26535] RSP: 002b:00007f2ca73d5038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 522.697966][T26535] RAX: ffffffffffffffda RBX: 00007f2ca93e6090 RCX: 00007f2ca918f749 [ 522.706158][T26535] RDX: 0000000000000001 RSI: 00002000000047c0 RDI: 0000000000000003 [ 522.714221][T26535] RBP: 00007f2ca9213f91 R08: 0000000000000000 R09: 0000000000000000 [ 522.722191][T26535] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 522.730337][T26535] R13: 00007f2ca93e6128 R14: 00007f2ca93e6090 R15: 00007fffd656cdc8 [ 522.738390][T26535] [ 522.741395][T26535] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 522.748654][T26535] CPU: 1 UID: 0 PID: 26535 Comm: syz.4.6550 Not tainted syzkaller #0 PREEMPT(full) [ 522.758000][T26535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 522.768037][T26535] Call Trace: [ 522.771300][T26535] [ 522.774214][T26535] dump_stack_lvl+0x99/0x250 [ 522.778788][T26535] ? __asan_memcpy+0x40/0x70 [ 522.783355][T26535] ? __pfx_dump_stack_lvl+0x10/0x10 [ 522.788536][T26535] ? __pfx__printk+0x10/0x10 [ 522.793135][T26535] vpanic+0x237/0x6d0 [ 522.797129][T26535] ? __pfx_vpanic+0x10/0x10 [ 522.801638][T26535] ? is_bpf_text_address+0x292/0x2b0 [ 522.806913][T26535] ? is_bpf_text_address+0x26/0x2b0 [ 522.812098][T26535] panic+0xb9/0xc0 [ 522.815809][T26535] ? __pfx_panic+0x10/0x10 [ 522.820216][T26535] __warn+0x317/0x4b0 [ 522.824178][T26535] ? skb_attempt_defer_free+0x572/0x6d0 [ 522.829705][T26535] ? skb_attempt_defer_free+0x572/0x6d0 [ 522.835230][T26535] __report_bug+0x288/0x500 [ 522.839717][T26535] ? skb_attempt_defer_free+0x572/0x6d0 [ 522.845318][T26535] ? __pfx___report_bug+0x10/0x10 [ 522.850362][T26535] ? __skb_wait_for_more_packets+0x2a4/0x580 [ 522.856355][T26535] ? __might_fault+0xb0/0x130 [ 522.861045][T26535] ? skb_attempt_defer_free+0x572/0x6d0 [ 522.866592][T26535] report_bug+0x16a/0x220 [ 522.870913][T26535] ? skb_attempt_defer_free+0x572/0x6d0 [ 522.876456][T26535] ? skb_attempt_defer_free+0x574/0x6d0 [ 522.882003][T26535] handle_bug+0x98/0x200 [ 522.886241][T26535] exc_invalid_op+0x1a/0x50 [ 522.890739][T26535] asm_exc_invalid_op+0x1a/0x20 [ 522.895583][T26535] RIP: 0010:skb_attempt_defer_free+0x572/0x6d0 [ 522.901738][T26535] Code: ff e8 72 c4 8f f8 90 0f 0b 90 e9 a8 fb ff ff e8 64 c4 8f f8 eb 85 e8 5d c4 8f f8 90 0f 0b 90 e9 94 fc ff ff e8 4f c4 8f f8 90 <0f> 0b 90 e9 af fc ff ff e8 41 c4 8f f8 90 0f 0b 90 e9 da fc ff ff [ 522.921331][T26535] RSP: 0018:ffffc9000c427400 EFLAGS: 00010287 [ 522.927390][T26535] RAX: ffffffff8931ee01 RBX: ffff888044538a00 RCX: 0000000000080000 [ 522.935348][T26535] RDX: ffffc90010e1a000 RSI: 0000000000011bb6 RDI: 0000000000011bb7 [ 522.943311][T26535] RBP: ffffc9000c4274b0 R08: ffffffff8f822177 R09: 1ffffffff1f0442e [ 522.951313][T26535] R10: dffffc0000000000 R11: fffffbfff1f0442f R12: 0000000000000000 [ 522.959280][T26535] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888044538a60 [ 522.967260][T26535] ? skb_attempt_defer_free+0x571/0x6d0 [ 522.972815][T26535] ? __lock_acquire+0x6b6/0x2cf0 [ 522.977742][T26535] ? __pfx_skb_attempt_defer_free+0x10/0x10 [ 522.983630][T26535] ? skb_consume_udp+0x90/0x260 [ 522.988475][T26535] udp_recvmsg+0xdb0/0x1050 [ 522.992990][T26535] ? __pfx_udp_recvmsg+0x10/0x10 [ 522.997935][T26535] ? udp_bpf_recvmsg+0xe7/0xda0 [ 523.002778][T26535] udp_bpf_recvmsg+0xb84/0xda0 [ 523.007539][T26535] ? udp_bpf_recvmsg+0xe7/0xda0 [ 523.012383][T26535] ? get_page_from_freelist+0x2365/0x2440 [ 523.018093][T26535] ? __pfx___might_resched+0x10/0x10 [ 523.023373][T26535] ? __pfx_udp_bpf_recvmsg+0x10/0x10 [ 523.028660][T26535] ? aa_sk_perm+0x15f/0x920 [ 523.033153][T26535] ? aa_sk_perm+0x7ee/0x920 [ 523.037648][T26535] ? sock_rps_record_flow+0x19/0x410 [ 523.042932][T26535] ? __pfx_udp_bpf_recvmsg+0x10/0x10 [ 523.048220][T26535] inet_recvmsg+0x24a/0x250 [ 523.052720][T26535] ? __pfx_inet_recvmsg+0x10/0x10 [ 523.057733][T26535] ? __lock_acquire+0x6b6/0x2cf0 [ 523.062665][T26535] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 523.067952][T26535] ? security_socket_recvmsg+0x7e/0x2e0 [ 523.073495][T26535] sock_recvmsg+0x1a8/0x270 [ 523.077998][T26535] ____sys_recvmsg+0x1c9/0x460 [ 523.082769][T26535] ? __pfx_____sys_recvmsg+0x10/0x10 [ 523.088055][T26535] ? import_iovec+0x74/0xa0 [ 523.092550][T26535] ___sys_recvmsg+0x1b5/0x510 [ 523.097224][T26535] ? __pfx____sys_recvmsg+0x10/0x10 [ 523.102451][T26535] ? __fget_files+0x3a0/0x420 [ 523.107130][T26535] do_recvmmsg+0x307/0x770 [ 523.111550][T26535] ? __pfx_do_recvmmsg+0x10/0x10 [ 523.116473][T26535] ? handle_mm_fault+0xdb/0x32b0 [ 523.121431][T26535] __x64_sys_recvmmsg+0x190/0x240 [ 523.126449][T26535] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 523.131985][T26535] ? do_syscall_64+0xbe/0xf80 [ 523.136650][T26535] do_syscall_64+0xfa/0xf80 [ 523.141139][T26535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.147194][T26535] ? clear_bhb_loop+0x60/0xb0 [ 523.151865][T26535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.157745][T26535] RIP: 0033:0x7f2ca918f749 [ 523.162152][T26535] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 523.181745][T26535] RSP: 002b:00007f2ca73d5038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 523.190155][T26535] RAX: ffffffffffffffda RBX: 00007f2ca93e6090 RCX: 00007f2ca918f749 [ 523.198118][T26535] RDX: 0000000000000001 RSI: 00002000000047c0 RDI: 0000000000000003 [ 523.206077][T26535] RBP: 00007f2ca9213f91 R08: 0000000000000000 R09: 0000000000000000 [ 523.214032][T26535] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 523.221987][T26535] R13: 00007f2ca93e6128 R14: 00007f2ca93e6090 R15: 00007fffd656cdc8 [ 523.229962][T26535] [ 523.233105][T26535] Kernel Offset: disabled [ 523.237414][T26535] Rebooting in 86400 seconds..